diff --git a/pkg/backup/item_collector.go b/pkg/backup/item_collector.go index 459a3fb65..4b2f4ff75 100644 --- a/pkg/backup/item_collector.go +++ b/pkg/backup/item_collector.go @@ -66,8 +66,9 @@ type itemCollector struct { // The namespaces, which do not have backup including resources, // are not collected. // -// b. If the namespace I/E filters and the (Or)LabelSelectors selected -// namespaces are different. The tracker takes the union of them. +// b. Explicit namespace exclusion takes precedence over the +// (Or)LabelSelectors: an excluded namespace is never tracked, even +// when its own labels (or a resource within it) match the selector(s). type nsTracker struct { singleLabelSelector labels.Selector orLabelSelector []labels.Selector @@ -125,9 +126,15 @@ func (nt *nsTracker) init( continue } + // Explicit namespace exclusion takes precedence over the + // (Or)LabelSelectors, so check it upfront once instead of + // repeating it in every branch below. + if !nt.namespaceFilter.ShouldInclude(namespace.GetName()) { + continue + } + if nt.singleLabelSelector != nil && - nt.singleLabelSelector.Matches(labels.Set(namespace.GetLabels())) && - nt.namespaceFilter.ShouldInclude(namespace.GetName()) { + nt.singleLabelSelector.Matches(labels.Set(namespace.GetLabels())) { nt.logger.Debugf("Track namespace %s, because its labels match backup LabelSelector.", namespace.GetName(), ) @@ -136,7 +143,7 @@ func (nt *nsTracker) init( continue } - if len(nt.orLabelSelector) > 0 && nt.namespaceFilter.ShouldInclude(namespace.GetName()) { + if len(nt.orLabelSelector) > 0 { for _, selector := range nt.orLabelSelector { if selector.Matches(labels.Set(namespace.GetLabels())) { nt.logger.Debugf("Track namespace %s, because its labels match the backup OrLabelSelector.", @@ -157,12 +164,10 @@ func (nt *nsTracker) init( continue } - if nt.namespaceFilter.ShouldInclude(namespace.GetName()) { - nt.logger.Debugf("Track namespace %s, because its name match the backup namespace filter.", - namespace.GetName(), - ) - nt.track(namespace.GetName()) - } + nt.logger.Debugf("Track namespace %s, because its name match the backup namespace filter.", + namespace.GetName(), + ) + nt.track(namespace.GetName()) } }