mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-01 13:47:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Copy secrets before Expose in DataUpload controller

Browse Source 
Copy configured secrets from the source namespace to the Velero
namespace in the New phase of the DataUpload reconcile loop, before
calling Expose(). This is done in the controller rather than the
exposer because Expose() errors are non-retryable (marked as permanent
failure), while the controller can requeue on collision.

On secret collision (same name, different data from another
DataUpload), the controller requeues with a 5s delay, matching the
existing pattern used for VGDP constraint checking.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
This commit is contained in:
Shubham Pampattiwar
2026-08-18 10:28:27 -07:00
parent f65652bfc3
commit 2a44048024
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/data_upload_controller.go
+18
View File
@@ -270,6 +270,24 @@ func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request)
return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil
}
// Copy secrets required for backup PVC provisioning (e.g., encrypted volumes with KMS).
// This must happen before Expose() since Expose() errors are non-retryable.
// On collision (same secret name, different data from another DataUpload), requeue.
if du.Spec.CSISnapshot != nil {
if bpvcConfig, exists := r.backupPVCConfig[du.Spec.CSISnapshot.StorageClass]; exists {
for _, secretName := range bpvcConfig.SecretNames {
if copyErr := kube.CopySecret(ctx, r.kubeClient.CoreV1(), secretName,
du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil {
if errors.Is(copyErr, kube.ErrSecretCollision) {
log.Infof("Secret %s collision detected, requeue later", secretName)
return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil
}
return r.errorOut(ctx, du, copyErr, "error copying secret for backup PVC", log)
}
}
}
}
log.Info("Data upload starting")
accepted, err := r.acceptDataUpload(ctx, du)