mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-03 14:47:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add configmap copy support and move secret copy after accept

Browse Source 
- Add ConfigMapNames field to BackupPVC config for copying tenant
  configmaps (e.g., ceph-csi-kms-config with Vault connection overrides)
- Add CopyConfigMap, DeleteConfigMapIfAny, DeleteConfigMapsWithLabel
  utilities mirroring the secret copy functions
- Move secret/configmap copy after acceptDataUpload() so only the
  accepting node handles it, avoiding multi-node contest
- Clean up copied configmaps in CleanUp() alongside secrets

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
This commit is contained in:
Shubham Pampattiwar
2026-08-18 10:28:27 -07:00
parent f91f669e77
commit c15cf084e3
4 changed files with 105 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/data_upload_controller.go
+20 -18
View File
@@ -270,24 +270,6 @@ func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request)
return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil
}
// Copy secrets required for backup PVC provisioning (e.g., encrypted volumes with KMS).
// This must happen before Expose() since Expose() errors are non-retryable.
// On collision (same secret name, different data from another DataUpload), requeue.
if du.Spec.CSISnapshot != nil {
if bpvcConfig, exists := r.backupPVCConfig[du.Spec.CSISnapshot.StorageClass]; exists {
for _, secretName := range bpvcConfig.SecretNames {
if copyErr := kube.CopySecret(ctx, r.kubeClient.CoreV1(), secretName,
du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil {
if errors.Is(copyErr, kube.ErrSecretCollision) {
log.Infof("Secret %s collision detected, requeue later", secretName)
return ctrl.Result{Requeue: true, RequeueAfter: time.Second * 5}, nil
}
return r.errorOut(ctx, du, copyErr, "error copying secret for backup PVC", log)
}
}
}
}
log.Info("Data upload starting")
accepted, err := r.acceptDataUpload(ctx, du)
@@ -302,6 +284,26 @@ func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request)
log.Info("Data upload is accepted")
// Copy secrets and configmaps required for backup PVC provisioning
// (e.g., encrypted volumes with KMS). Done after accept so only the
// accepting node handles it, avoiding multi-node contest.
if du.Spec.CSISnapshot != nil {
if bpvcConfig, exists := r.backupPVCConfig[du.Spec.CSISnapshot.StorageClass]; exists {
for _, secretName := range bpvcConfig.SecretNames {
if copyErr := kube.CopySecret(ctx, r.kubeClient.CoreV1(), secretName,
du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil {
return r.errorOut(ctx, du, copyErr, "error copying secret for backup PVC", log)
}
}
for _, cmName := range bpvcConfig.ConfigMapNames {
if copyErr := kube.CopyConfigMap(ctx, r.kubeClient.CoreV1(), cmName,
du.Spec.SourceNamespace, du.Namespace, du.Name, log); copyErr != nil {
return r.errorOut(ctx, du, copyErr, "error copying configmap for backup PVC", log)
}
}
}
}
exposeParam, err := r.setupExposeParam(du)
if err != nil {
return r.errorOut(ctx, du, err, "failed to set exposer parameters", log)