From a5e3c25fc92ef68924f83b2342dcd3951648cd8c Mon Sep 17 00:00:00 2001
From: Shubham Pampattiwar <spampatt@redhat.com>
Date: Wed, 3 Jun 2026 10:46:18 -0700
Subject: [PATCH] Fix excluded namespace objects leaking into backup with
 cross-namespace listing

When getNamespacesToList returns "" (cross-namespace listing), resources
from all namespaces are listed. The nsTracker.track call for each
resource's namespace would inadvertently track excluded namespaces,
causing their namespace objects to pass through filterNamespaces.

Add a ShouldInclude check before tracking a namespace from non-namespace
resources to ensure excluded namespaces are not tracked.

Add test case for includedNamespaces ["*"] with excludedNamespaces to
verify both the namespace object exclusion and resource exclusion.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---
 pkg/backup/backup_test.go    | 23 +++++++++++++++++++++++
 pkg/backup/item_collector.go |  3 ++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/pkg/backup/backup_test.go b/pkg/backup/backup_test.go
index af15224da..5607db9dd 100644
--- a/pkg/backup/backup_test.go
+++ b/pkg/backup/backup_test.go
@@ -5426,6 +5426,29 @@ func TestBackupNamespaces(t *testing.T) {
 			},
 			want: []string{},
 		},
+		{
+			name:   "Wildcard star with excluded namespaces test",
+			backup: defaultBackup().IncludedNamespaces("*").ExcludedNamespaces("ns-2").Result(),
+			apiResources: []*test.APIResource{
+				test.Namespaces(
+					builder.ForNamespace("ns-1").Phase(corev1api.NamespaceActive).Result(),
+					builder.ForNamespace("ns-2").Phase(corev1api.NamespaceActive).Result(),
+					builder.ForNamespace("ns-3").Phase(corev1api.NamespaceActive).Result(),
+				),
+				test.Deployments(
+					builder.ForDeployment("ns-1", "deploy-1").Result(),
+					builder.ForDeployment("ns-2", "deploy-2").Result(),
+				),
+			},
+			want: []string{
+				"resources/namespaces/cluster/ns-1.json",
+				"resources/namespaces/v1-preferredversion/cluster/ns-1.json",
+				"resources/namespaces/cluster/ns-3.json",
+				"resources/namespaces/v1-preferredversion/cluster/ns-3.json",
+				"resources/deployments.apps/namespaces/ns-1/deploy-1.json",
+				"resources/deployments.apps/v1-preferredversion/namespaces/ns-1/deploy-1.json",
+			},
+		},
 		{
 			name:   "Default namespace filter test",
 			backup: defaultBackup().Result(),
diff --git a/pkg/backup/item_collector.go b/pkg/backup/item_collector.go
index 7f5ed6a4f..15efca2db 100644
--- a/pkg/backup/item_collector.go
+++ b/pkg/backup/item_collector.go
@@ -497,7 +497,8 @@ func (r *itemCollector) getResourceItems(
 				kind:          resource.Kind,
 			})
 
-			if item.GetNamespace() != "" {
+			if item.GetNamespace() != "" &&
+				r.backupRequest.NamespaceIncludesExcludes.ShouldInclude(item.GetNamespace()) {
 				log.Debugf("Track namespace %s in nsTracker", item.GetNamespace())
 				r.nsTracker.track(item.GetNamespace())
 			}