Fix excluded namespace objects leaking into backup with cross-namespace listing

When getNamespacesToList returns "" (cross-namespace listing), resources
from all namespaces are listed. The nsTracker.track call for each
resource's namespace would inadvertently track excluded namespaces,
causing their namespace objects to pass through filterNamespaces.

Add a ShouldInclude check before tracking a namespace from non-namespace
resources to ensure excluded namespaces are not tracked.

Add test case for includedNamespaces ["*"] with excludedNamespaces to
verify both the namespace object exclusion and resource exclusion.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

pkg/backup/backup_test.go

@@ -5426,6 +5426,29 @@ func TestBackupNamespaces(t *testing.T) {
 			},
 			want: []string{},
 		},
+		{
+			name:   "Wildcard star with excluded namespaces test",
+			backup: defaultBackup().IncludedNamespaces("*").ExcludedNamespaces("ns-2").Result(),
+			apiResources: []*test.APIResource{
+				test.Namespaces(
+					builder.ForNamespace("ns-1").Phase(corev1api.NamespaceActive).Result(),
+					builder.ForNamespace("ns-2").Phase(corev1api.NamespaceActive).Result(),
+					builder.ForNamespace("ns-3").Phase(corev1api.NamespaceActive).Result(),
+				),
+				test.Deployments(
+					builder.ForDeployment("ns-1", "deploy-1").Result(),
+					builder.ForDeployment("ns-2", "deploy-2").Result(),
+				),
+			},
+			want: []string{
+				"resources/namespaces/cluster/ns-1.json",
+				"resources/namespaces/v1-preferredversion/cluster/ns-1.json",
+				"resources/namespaces/cluster/ns-3.json",
+				"resources/namespaces/v1-preferredversion/cluster/ns-3.json",
+				"resources/deployments.apps/namespaces/ns-1/deploy-1.json",
+				"resources/deployments.apps/v1-preferredversion/namespaces/ns-1/deploy-1.json",
+			},
+		},
 		{
 			name:   "Default namespace filter test",
 			backup: defaultBackup().Result(),

pkg/backup/item_collector.go

@@ -497,7 +497,8 @@ func (r *itemCollector) getResourceItems(
 				kind:          resource.Kind,
 			})
 
-			if item.GetNamespace() != "" {
+			if item.GetNamespace() != "" &&
+				r.backupRequest.NamespaceIncludesExcludes.ShouldInclude(item.GetNamespace()) {
 				log.Debugf("Track namespace %s in nsTracker", item.GetNamespace())
 				r.nsTracker.track(item.GetNamespace())
 			}