<p>I have an Azure Kubernetes cluster with Velero installed. A Service Principal was created for Velero, per <a href="https://github.com/vmware-tanzu/velero-plugin-for-microsoft-azure/tree/master#option-1-create-service-principal" rel="nofollow noreferrer">option 1 of the instructions</a>.</p>
<p>Velero was working fine until the credentials for the Service Principal were reset. Now the scheduled backups are failing.</p>
<pre><code>NAME                                    STATUS      ERRORS   WARNINGS   CREATED                         EXPIRES   STORAGE LOCATION   SELECTOR
daily-entire-cluster-20210727030055     Failed      0        0          2021-07-26 23:00:55 -0000       13d       default            &lt;none&gt;
</code></pre>
<p>How can I update the secret for Velero?</p>

<h1>1. Update credentials file</h1>
<p>First, update your credentials file (for most providers, this is <code>credentials-velero</code> and the contents are described in the plugin installation instructions: <a href="https://github.com/vmware-tanzu/velero-plugin-for-aws#set-permissions-for-velero" rel="nofollow noreferrer">AWS</a>, <a href="https://github.com/vmware-tanzu/velero-plugin-for-microsoft-azure#create-service-principal" rel="nofollow noreferrer">Azure</a>, <a href="https://github.com/vmware-tanzu/velero-plugin-for-gcp#option-1-set-permissions-with-a-service-account" rel="nofollow noreferrer">GCP</a>)</p>
<h1>2. Update secret</h1>
<p>Now update the velero secret. On linux:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl patch -n velero secret cloud-credentials -p '{&quot;data&quot;: {&quot;cloud&quot;: &quot;'$(base64 -w 0 credentials-velero)'&quot;}}'
</code></pre>
<ul>
<li><code>patch</code> tells <code>kubectl</code> to update a resource by merging the provided data</li>
<li><code>-n velero</code> tells <code>kubectl</code> to use the <code>velero</code> namespace</li>
<li><code>secret</code> is the resource type</li>
<li><code>cloud-credentials</code> is the name of the secret used by Velero to store credentials</li>
<li><code>-p </code> specifies that the next word is the patch data. It's more common to patch using JSON rather than YAML</li>
<li><code>'{&quot;data&quot;: {&quot;cloud&quot;: &quot;&lt;your-base64-encoded-secret-will-go-here&gt;&quot;}}'</code> this is the JSON data that matches the existing structure of the Velero secret in Kubernetes. <code>&lt;your-base64-encoded-secret-will-go-here&gt;</code> is a placeholder for the command we'll insert.</li>
<li><code>$(base64 -w 0 credentials-velero)</code> reads the file <code>credentials-velero</code> in the current directory, turns off word wrapping of the output (<code>-w 0</code>), BASE64-encodes the contents of the file, and inserts the result in the data.</li>
</ul>
