From b7ffd5508505d79ac93744c12d6831e71dabb859 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Thu, 16 Jul 2026 18:37:03 -0400 Subject: [PATCH] Add set-based label selector test and docs coverage for restore Restore label selector filtering had only equality-based coverage; set-based selectors were exercised nowhere in the repo, relying entirely on apimachinery behavior. Add notin, in, and doesnotexist (!key) cases to TestRestoreResourceFiltering and set-based parse cases for the --selector CLI flag. Also document restore usage of --selector in resource-filtering.md: the notin phased-restore scenario (noting notin also matches resources without the label key), restoring only unlabeled resources via '!', and the caveat that restore item action dependencies bypass label selectors. Co-Authored-By: Claude Fable 5 Signed-off-by: Tiger Kaovilai --- pkg/cmd/util/flag/label_selector_test.go | 22 +++++ pkg/restore/restore_test.go | 93 ++++++++++++++++++++ site/content/docs/main/resource-filtering.md | 24 +++++ 3 files changed, 139 insertions(+) diff --git a/pkg/cmd/util/flag/label_selector_test.go b/pkg/cmd/util/flag/label_selector_test.go index 9d69a2718..ad2b4c711 100644 --- a/pkg/cmd/util/flag/label_selector_test.go +++ b/pkg/cmd/util/flag/label_selector_test.go @@ -24,6 +24,28 @@ func TestSetOfLabelSelector(t *testing.T) { assert.True(t, str == "k1=v1,k2=v2" || str == "k2=v2,k2=v2") } +func TestSetOfSetBasedLabelSelector(t *testing.T) { + selector := &LabelSelector{} + require.NoError(t, selector.Set("pr-label notin (1)")) + require.NotNil(t, selector.LabelSelector) + require.Len(t, selector.LabelSelector.MatchExpressions, 1) + req := selector.LabelSelector.MatchExpressions[0] + assert.Equal(t, "pr-label", req.Key) + assert.Equal(t, metav1.LabelSelectorOpNotIn, req.Operator) + assert.Equal(t, []string{"1"}, req.Values) +} + +func TestSetOfDoesNotExistLabelSelector(t *testing.T) { + selector := &LabelSelector{} + require.NoError(t, selector.Set("!pr-label")) + require.NotNil(t, selector.LabelSelector) + require.Len(t, selector.LabelSelector.MatchExpressions, 1) + req := selector.LabelSelector.MatchExpressions[0] + assert.Equal(t, "pr-label", req.Key) + assert.Equal(t, metav1.LabelSelectorOpDoesNotExist, req.Operator) + assert.Empty(t, req.Values) +} + func TestTypeOfLabelSelector(t *testing.T) { selector := &LabelSelector{} assert.Equal(t, "labelSelector", selector.Type()) diff --git a/pkg/restore/restore_test.go b/pkg/restore/restore_test.go index 074053444..942010e14 100644 --- a/pkg/restore/restore_test.go +++ b/pkg/restore/restore_test.go @@ -453,6 +453,99 @@ func TestRestoreResourceFiltering(t *testing.T) { test.PVs(): {"/pv-1"}, }, }, + { + name: "notin label selector excludes matching resources", + restore: defaultRestore().LabelSelector(&metav1.LabelSelector{MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "pr-label", Operator: metav1.LabelSelectorOpNotIn, Values: []string{"1"}}, + }}).Result(), + backup: defaultBackup().Result(), + tarball: test.NewTarWriter(t). + AddItems("pods", + builder.ForPod("ns-1", "pod-1").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + builder.ForPod("ns-2", "pod-2").Result(), + ). + AddItems("deployments.apps", + builder.ForDeployment("ns-1", "deploy-1").Result(), + builder.ForDeployment("ns-2", "deploy-2").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + ). + AddItems("persistentvolumes", + builder.ForPersistentVolume("pv-1").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + builder.ForPersistentVolume("pv-2").ObjectMeta(builder.WithLabels("pr-label", "2")).Result(), + ). + Done(), + apiResources: []*test.APIResource{ + test.Pods(), + test.Deployments(), + test.PVs(), + }, + want: map[*test.APIResource][]string{ + test.Pods(): {"ns-2/pod-2"}, + test.Deployments(): {"ns-1/deploy-1"}, + test.PVs(): {"/pv-2"}, + }, + }, + { + name: "in label selector only restores matching resources", + restore: defaultRestore().LabelSelector(&metav1.LabelSelector{MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "pr-label", Operator: metav1.LabelSelectorOpIn, Values: []string{"1", "2"}}, + }}).Result(), + backup: defaultBackup().Result(), + tarball: test.NewTarWriter(t). + AddItems("pods", + builder.ForPod("ns-1", "pod-1").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + builder.ForPod("ns-2", "pod-2").ObjectMeta(builder.WithLabels("pr-label", "3")).Result(), + ). + AddItems("deployments.apps", + builder.ForDeployment("ns-1", "deploy-1").Result(), + builder.ForDeployment("ns-2", "deploy-2").ObjectMeta(builder.WithLabels("pr-label", "2")).Result(), + ). + AddItems("persistentvolumes", + builder.ForPersistentVolume("pv-1").ObjectMeta(builder.WithLabels("pr-label", "2")).Result(), + builder.ForPersistentVolume("pv-2").Result(), + ). + Done(), + apiResources: []*test.APIResource{ + test.Pods(), + test.Deployments(), + test.PVs(), + }, + want: map[*test.APIResource][]string{ + test.Pods(): {"ns-1/pod-1"}, + test.Deployments(): {"ns-2/deploy-2"}, + test.PVs(): {"/pv-1"}, + }, + }, + { + name: "doesnotexist label selector only restores resources without the label key", + restore: defaultRestore().LabelSelector(&metav1.LabelSelector{MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "pr-label", Operator: metav1.LabelSelectorOpDoesNotExist}, + }}).Result(), + backup: defaultBackup().Result(), + tarball: test.NewTarWriter(t). + AddItems("pods", + builder.ForPod("ns-1", "pod-1").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + builder.ForPod("ns-2", "pod-2").Result(), + ). + AddItems("deployments.apps", + builder.ForDeployment("ns-1", "deploy-1").Result(), + builder.ForDeployment("ns-2", "deploy-2").ObjectMeta(builder.WithLabels("pr-label", "2")).Result(), + ). + AddItems("persistentvolumes", + builder.ForPersistentVolume("pv-1").ObjectMeta(builder.WithLabels("other-label", "x")).Result(), + builder.ForPersistentVolume("pv-2").ObjectMeta(builder.WithLabels("pr-label", "1")).Result(), + ). + Done(), + apiResources: []*test.APIResource{ + test.Pods(), + test.Deployments(), + test.PVs(), + }, + want: map[*test.APIResource][]string{ + test.Pods(): {"ns-2/pod-2"}, + test.Deployments(): {"ns-1/deploy-1"}, + test.PVs(): {"/pv-1"}, + }, + }, { name: "OrLabelSelectors only restores matching resources", restore: defaultRestore().OrLabelSelector([]*metav1.LabelSelector{{MatchLabels: map[string]string{"a1": "b1"}}, {MatchLabels: map[string]string{"a2": "b2"}}, diff --git a/site/content/docs/main/resource-filtering.md b/site/content/docs/main/resource-filtering.md index 9f57a7f4e..94838fe99 100644 --- a/site/content/docs/main/resource-filtering.md +++ b/site/content/docs/main/resource-filtering.md @@ -103,6 +103,30 @@ Includes cluster-scoped resources. Cannot work with `--include-cluster-scoped-re velero backup create --selector " notin ()" ``` +The same selector syntax works on restore. Set-based selectors are useful for phased restores: restore labeled resources first, then everything else. + +* Restore only resources matching the label selector. + + ```bash + velero restore create --from-backup --selector = + ``` + +* Restore everything in the backup except resources matching the selector. + + ```bash + velero restore create --from-backup --selector " notin ()" + ``` + + `notin` also matches resources that don't have the `` label at all: this restores resources whose `` label has any other value, as well as resources without the `` label. + +* Restore only resources that do not have a particular label key. + + ```bash + velero restore create --from-backup --selector '!' + ``` + +Note: resources pulled in as dependencies of selected items by restore item actions (for example, a restored pod's service account or persistent volume claims) are restored even if the label selector would exclude them. + For more information read the [Kubernetes label selector documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) ### --or-selector