From 8c79adde743bdfe8b545bdb4ab0ddaf5e1934ed2 Mon Sep 17 00:00:00 2001
From: Adam Zhang <adam.zhang@broadcom.com>
Date: Sat, 11 Jul 2026 09:39:41 +0800
Subject: [PATCH] fix globalExcludes lookup

The kind is normalized to lower case, so should the lookup.

Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---
 changelogs/unreleased/9989-adam-jian-zhang |  1 +
 pkg/restore/restore.go                     |  4 +-
 pkg/restore/restore_policies_test.go       | 47 ++++++++++++++++++++++
 3 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/9989-adam-jian-zhang

diff --git a/changelogs/unreleased/9989-adam-jian-zhang b/changelogs/unreleased/9989-adam-jian-zhang
new file mode 100644
index 000000000..ab0954c20
--- /dev/null
+++ b/changelogs/unreleased/9989-adam-jian-zhang
@@ -0,0 +1 @@
+Fix globalExcludes lookup, it should be lookup against lower case
diff --git a/pkg/restore/restore.go b/pkg/restore/restore.go
index 7ff1c3031..a1213eec0 100644
--- a/pkg/restore/restore.go
+++ b/pkg/restore/restore.go
@@ -552,7 +552,9 @@ func resolveRestoreNamespacedFilterPolicies(
 	// Build a quick lookup map for globally excluded resources
 	globalExcludes := make(map[string]bool)
 	for _, ex := range excludedResources {
-		globalExcludes[ex] = true
+		// We lowercase the excluded resources here because the kinds in the resource filters
+		// are lowercased during resolution, and we want to ensure case-insensitive matching.
+		globalExcludes[strings.ToLower(ex)] = true
 	}
 
 	for _, policy := range policies {
diff --git a/pkg/restore/restore_policies_test.go b/pkg/restore/restore_policies_test.go
index 795b0315b..42b8fb11f 100644
--- a/pkg/restore/restore_policies_test.go
+++ b/pkg/restore/restore_policies_test.go
@@ -2,9 +2,11 @@ package restore
 
 import (
 	"io"
+	"strings"
 	"testing"
 
 	"github.com/sirupsen/logrus"
+	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/require"
 	corev1api "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -283,3 +285,48 @@ func TestResolveRestoreClusterScopedFilterPolicy_Validation(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "ambiguous policy: duplicate kind")
 }
+
+func TestResolveRestoreNamespacedFilterPolicies_GlobalExcludesWarning(t *testing.T) {
+	log, hook := logrustest.NewNullLogger()
+	helper := test.NewFakeDiscoveryHelper(true, nil)
+
+	policies := []resourcepolicies.NamespacedFilterPolicy{
+		{
+			Namespaces: []string{"ns-1"},
+			ResourceFilters: []resourcepolicies.ResourceFilter{
+				{
+					Kinds: []string{"ConfigMaps"},
+				},
+			},
+		},
+	}
+
+	excludedResources := []string{"ConfigMaps"} // Same case
+	_, _, err := resolveRestoreNamespacedFilterPolicies(policies, excludedResources, helper, log)
+	require.NoError(t, err)
+
+	// Check if a warning was emitted
+	found := false
+	for _, entry := range hook.Entries {
+		if entry.Level == logrus.WarnLevel && strings.Contains(entry.Message, "namespacedFilterPolicies entry lists a kind that is globally excluded") {
+			found = true
+			break
+		}
+	}
+	require.True(t, found, "expected warning about globally excluded resource")
+
+	hook.Reset()
+
+	excludedResourcesDiffCase := []string{"configmaps"} // Different case
+	_, _, err = resolveRestoreNamespacedFilterPolicies(policies, excludedResourcesDiffCase, helper, log)
+	require.NoError(t, err)
+
+	found = false
+	for _, entry := range hook.Entries {
+		if entry.Level == logrus.WarnLevel && strings.Contains(entry.Message, "namespacedFilterPolicies entry lists a kind that is globally excluded") {
+			found = true
+			break
+		}
+	}
+	require.True(t, found, "expected warning about globally excluded resource even if case differs")
+}