Can not create new mysql database from backup

[atompie]

Context Percona Everest 1.4:

Back up was made to MinIo S3 that has self-signed certificate. Storage was configured not to verify cert and Force-path style URL.

When restoring. K8s restore-job-* fails 5 time with the message that it can not verify certificate. (Notice: Storage was configured not to verify cert)

Logs from rstore-job-* pod

+ LIB_PATH=/usr/lib/pxc
+ . /usr/lib/pxc/check-version.sh
+ . /usr/lib/pxc/vault.sh
++ set -o errexit
++ keyring_vault=/etc/mysql/vault-keyring-secret/keyring_vault.conf
+ XBCLOUD_ARGS='--curl-retriable-errors=7 '
+ MC_ARGS='-C /tmp/mc'
+ '[' -n true ']'
+ [[ true == \f\a\l\s\e ]]
+ '[' -n tracardi-mysql-backup/mysql-tracardi/7fdd15d3-1165-4430-8cea-7186f808dad0/mysql-tracardi-2025-02-11-12:34:10-full ']'
+ mc -C /tmp/mc config host add dest https://167.*.*.*:9000 ACCESS_KEY_ID SECRET_ACCESS_KEY
mc: <ERROR> Unable to initialize new alias from the provided credentials. Get "https://167.*.*.*:9000/probe-bsign-uc1sp3m1u3s4h4nubqxy0nsujxp9dc/?location=": tls: failed to verify certificate: x509: cannot validate certificate for 167.235.119.124 because it doesn't contain any IP SANs.

[oksana-grishchenko]

Hi @atompie!

Checked the logs for a minio storage which has:

• a self-signed sert
• unchecked Verify TLS certificate option
• checked Force path-style URL access option

The logs look differently, in particular there is this additional --insecure configuration:

which make me think that somehow the Verify TLS certificate was never unchecked. Have you added the storage via UI? Could you please share your backupstorage CR (please mask any data you consider sensitive):

kubectl get backupstorage STORAGE_NAME -n NAMESPACE -o yaml

So far I can assume that the storage was created not via Everest UI/API but directly as a k8s CR, bypassing validation. In that case, if the verifyTLS field was skipped in the BackupStorage CR, the default value (true) was used for that field.

[recharte]

@oksana-grishchenko we already have an internal ticket for this issue with some steps to reproduce, see https://perconadev.atlassian.net/browse/EVEREST-2017