From 2a440480244121aa3ae9c61317e7fe62f7624ed4 Mon Sep 17 00:00:00 2001 From: Shubham Pampattiwar Date: Mon, 15 Jun 2026 11:32:56 -0700 Subject: [PATCH] Copy secrets before Expose in DataUpload controller Copy configured secrets from the source namespace to the Velero namespace in the New phase of the DataUpload reconcile loop, before calling Expose(). This is done in the controller rather than the exposer because Expose() errors are non-retryable (marked as permanent failure), while the controller can requeue on collision. On secret collision (same name, different data from another DataUpload), the controller requeues with a 5s delay, matching the existing pattern used for VGDP constraint checking. Signed-off-by: Shubham Pampattiwar --- pkg/controller/data_upload_controller.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkg/controller/data_upload_controller.go b/pkg/controller/data_upload_controller.go index e7eaff956..c01918daa 100644 --- a/pkg/controller/data_upload_controller.go +++ b/pkg/controller/data_upload_controller.go @@ -270,6 +270,24 @@ func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request) return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil } + // Copy secrets required for backup PVC provisioning (e.g., encrypted volumes with KMS). + // This must happen before Expose() since Expose() errors are non-retryable. + // On collision (same secret name, different data from another DataUpload), requeue. + if du.Spec.CSISnapshot != nil { + if bpvcConfig, exists := r.backupPVCConfig[du.Spec.CSISnapshot.StorageClass]; exists { + for _, secretName := range bpvcConfig.SecretNames { + if copyErr := kube.CopySecret(ctx, r.kubeClient.CoreV1(), secretName, + du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil { + if errors.Is(copyErr, kube.ErrSecretCollision) { + log.Infof("Secret %s collision detected, requeue later", secretName) + return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil + } + return r.errorOut(ctx, du, copyErr, "error copying secret for backup PVC", log) + } + } + } + } + log.Info("Data upload starting") accepted, err := r.acceptDataUpload(ctx, du)