Velero: Restic used during backup, even when not requested

[simon-anz]

What steps did you take and what happened:
Installed chart 2.19.1 . Values file had:

# Whether to deploy the restic daemonset.
deployRestic: false

The daemonset wasn't deployed, which is good, but something is still attempting to create secrets. We are running with a read-only clusterrole, and got the following error:

{"level":"warning","logSource":"pkg/cmd/server/server.go:496","msg":"Velero restic daemonset not found; restic backups/restores will not work until it's created","time":"2021-04-30T04:32:21Z"}
An error occurred: error creating velero-restic-credentials secret: secrets is forbidden: User "system:serviceaccount:platform-backup:default-velero-server" cannot create resource "secrets" in API group "" in the namespace "platform-backup"

When that permission was provided, a secret was created: velero-restic-credentials

What did you expect to happen:

No need to create secrets, no secret created,

Environment:

• helm version: v3.5.4
• helm chart version: 2.19.1
• Kubernetes version: GKE - v1.18.16-gke.2100
• Cloud provider or hardware configuration: Google GKE

[simon-anz]

This is probably a restic issue, not a chart issue.

[simon-anz]

Yeah, totally is. Looks like this is created by Velero when setting up the Restic repository

https://github.com/vmware-tanzu/velero/blob/e9c997839ebbb04688a88ffb981eeb74de51b380/pkg/restic/repository_keys.go

regardless of whether Restic is enabled

https://github.com/vmware-tanzu/velero/blob/e9c997839ebbb04688a88ffb981eeb74de51b380/pkg/cmd/server/server.go#L502

[jenting]

@carlisia Would you mind moving this issue to vmware-tanzu/velero? Thank you.

[carlisia]

@jenting, done!