no EC2 IMDS role found when setting up BackupStorageLocation to Scaleway

[lordmathis]

Hi,

I'm trying to setup velero on my FluxCD cluster with the backup target being a Scaleway bucket. But the BackupStorageLocation remains unavailable with the following error in the velero pod logs:

time="2025-01-31T18:39:00Z" level=error msg="Current BackupStorageLocations available/unavailable/unknown: 0/1/0, BackupStorageLocation \"scaleway\" is unavailable: rpc error: code = Unknown desc = failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, http response error StatusCode: 404, request to EC2 IMDS failed)" controller=backup-storage-location logSource="pkg/controller/backup_storage_location_controller.go:179"
time="2025-01-31T18:39:00Z" level=info msg="plugin process exited" backup-storage-location=velero/scaleway cmd=/plugins/velero-plugin-for-aws controller=backup-storage-location id=80 logSource="pkg/plugin/clientmgmt/process/logrus_adapter.go:80" plugin=/plugins/velero-plugin-for-aws

Here's my setup. I'm deploying velero using flux helm release:

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: velero
  namespace: velero
spec:
  interval: 1h
  chart:
    spec:
      chart: velero
      version: 8.3.0
      sourceRef:
        kind: HelmRepository
        name: velero-helm-repo
        namespace: velero
  values:
    snapshotsEnabled: false
    deployNodeAgent: true
    configuration:
      backupStorageLocation:
      - name: scaleway
        provider: velero.io/aws
        default: true
        bucket: redacted
        config:
          region: nl-ams
          s3Url: https://s3.nl-ams.scw.cloud

      defaultVolumesToFsBackup: true
      
    schedules:
      daily-backup:
        schedule: "0 2 * * *"
        template:
          includedNamespaces:
            - gitea
          storageLocation: default
          ttl: "168h"
          includedResources:
            - persistentvolumeclaims
            - persistentvolumes
          labels:
            type: scheduled
            period: daily

    credentials:
      existingSecret: velero-s3-credentials

    initContainers:
      - name: velero-plugin-for-aws
        image: velero/velero-plugin-for-aws:v1.11.1
        imagePullPolicy: IfNotPresent
        volumeMounts:
          - mountPath: /target
            name: plugins

The velero-s3-credentials looks like this:

apiVersion: v1
kind: Secret
metadata:
  name: velero-s3-credentials
  namespace: velero
stringData:
  cloud: |
    [default]
    aws_access_key_id = redacted
    aws_secret_access_key = redacted

I am able to connect to the bucket using the aws cli with these credentials.