From 986350a6e5929e5a2bedc41f173e8e5b02544041 Mon Sep 17 00:00:00 2001 From: Shubham Pampattiwar Date: Fri, 10 Jul 2026 09:58:29 -0700 Subject: [PATCH] Move secret/configmap copy from controller to CSI snapshot exposer Move the secret and configmap copy logic from the DataUpload controller into the CSI snapshot exposer's Expose() method. This keeps all CSI-specific logic in the exposer and maintains symmetry with CleanUp() which already handles the cleanup of copied resources. Signed-off-by: Shubham Pampattiwar --- pkg/controller/data_upload_controller.go | 20 -------------------- pkg/exposer/csi_snapshot.go | 22 ++++++++++++++++++++++ 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/pkg/controller/data_upload_controller.go b/pkg/controller/data_upload_controller.go index 357bc943d..e7eaff956 100644 --- a/pkg/controller/data_upload_controller.go +++ b/pkg/controller/data_upload_controller.go @@ -284,26 +284,6 @@ func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request) log.Info("Data upload is accepted") - // Copy secrets and configmaps required for backup PVC provisioning - // (e.g., encrypted volumes with KMS). Done after accept so only the - // accepting node handles it, avoiding multi-node contest. - if du.Spec.CSISnapshot != nil { - if bpvcConfig, exists := r.backupPVCConfig[du.Spec.CSISnapshot.StorageClass]; exists { - for _, secretName := range bpvcConfig.SecretNames { - if copyErr := kube.CopySecret(ctx, r.kubeClient.CoreV1(), secretName, - du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil { - return r.errorOut(ctx, du, copyErr, "error copying secret for backup PVC", log) - } - } - for _, cmName := range bpvcConfig.ConfigMapNames { - if copyErr := kube.CopyConfigMap(ctx, r.kubeClient.CoreV1(), cmName, - du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil { - return r.errorOut(ctx, du, copyErr, "error copying configmap for backup PVC", log) - } - } - } - } - exposeParam, err := r.setupExposeParam(du) if err != nil { return r.errorOut(ctx, du, err, "failed to set exposer parameters", log) diff --git a/pkg/exposer/csi_snapshot.go b/pkg/exposer/csi_snapshot.go index ed19aeef1..60791fed9 100644 --- a/pkg/exposer/csi_snapshot.go +++ b/pkg/exposer/csi_snapshot.go @@ -249,6 +249,28 @@ func (e *csiSnapshotExposer) Expose(ctx context.Context, ownerObject corev1api.O } } + // Copy secrets and configmaps from source namespace to Velero namespace if configured. + // These are needed by CSI drivers that require namespace-scoped resources for volume + // provisioning (e.g., encrypted volumes with KMS tokens and tenant Vault configs). + if value, exists := csiExposeParam.BackupPVCConfig[csiExposeParam.StorageClass]; exists { + for _, secretName := range value.SecretNames { + if copyErr := kube.CopySecret(ctx, e.kubeClient.CoreV1(), secretName, + csiExposeParam.SourceNamespace, ownerObject.Namespace, ownerObject.Name, curLog); copyErr != nil { + err = errors.Wrapf(copyErr, "error copying secret %s from %s to %s", + secretName, csiExposeParam.SourceNamespace, ownerObject.Namespace) + return err + } + } + for _, cmName := range value.ConfigMapNames { + if copyErr := kube.CopyConfigMap(ctx, e.kubeClient.CoreV1(), cmName, + csiExposeParam.SourceNamespace, ownerObject.Namespace, ownerObject.Name, curLog); copyErr != nil { + err = errors.Wrapf(copyErr, "error copying configmap %s from %s to %s", + cmName, csiExposeParam.SourceNamespace, ownerObject.Namespace) + return err + } + } + } + backupPVC, err := e.createBackupPVC(ctx, ownerObject, backupVS.Name, backupPVCStorageClass, csiExposeParam.AccessMode, volumeSize, backupPVCReadOnly, backupPVCAnnotations, csiExposeParam.DataMover) if err != nil { return errors.Wrap(err, "error to create backup pvc")