diff --git a/changelogs/unreleased/10162-followup b/changelogs/unreleased/10162-followup new file mode 100644 index 000000000..7fb79bf4d --- /dev/null +++ b/changelogs/unreleased/10162-followup @@ -0,0 +1 @@ +Fix excluded namespaces still being tracked and backed up when their labels match the backup's LabelSelector or OrLabelSelector diff --git a/pkg/backup/backup_test.go b/pkg/backup/backup_test.go index 8d3e75837..c1acdb95d 100644 --- a/pkg/backup/backup_test.go +++ b/pkg/backup/backup_test.go @@ -5475,12 +5475,28 @@ func TestBackupNamespaces(t *testing.T) { ), }, want: []string{ - "resources/namespaces/cluster/ns-1.json", - "resources/namespaces/v1-preferredversion/cluster/ns-1.json", "resources/namespaces/cluster/ns-3.json", "resources/namespaces/v1-preferredversion/cluster/ns-3.json", }, }, + { + name: "excluded namespace whose labels match the LabelSelector", + backup: defaultBackup(). + IncludedNamespaces("*"). + ExcludedNamespaces("ns-2"). + LabelSelector(&metav1.LabelSelector{MatchLabels: map[string]string{"a": "b"}}). + Result(), + apiResources: []*test.APIResource{ + test.Namespaces( + builder.ForNamespace("ns-1").Phase(corev1api.NamespaceActive).ObjectMeta(builder.WithLabels("a", "b")).Result(), + builder.ForNamespace("ns-2").Phase(corev1api.NamespaceActive).ObjectMeta(builder.WithLabels("a", "b")).Result(), + ), + }, + want: []string{ + "resources/namespaces/cluster/ns-1.json", + "resources/namespaces/v1-preferredversion/cluster/ns-1.json", + }, + }, { name: "Wildcard star with excluded namespaces test", backup: defaultBackup().IncludedNamespaces("*").ExcludedNamespaces("ns-2").Result(), diff --git a/pkg/backup/item_collector.go b/pkg/backup/item_collector.go index 3828fc3a2..459a3fb65 100644 --- a/pkg/backup/item_collector.go +++ b/pkg/backup/item_collector.go @@ -126,7 +126,8 @@ func (nt *nsTracker) init( } if nt.singleLabelSelector != nil && - nt.singleLabelSelector.Matches(labels.Set(namespace.GetLabels())) { + nt.singleLabelSelector.Matches(labels.Set(namespace.GetLabels())) && + nt.namespaceFilter.ShouldInclude(namespace.GetName()) { nt.logger.Debugf("Track namespace %s, because its labels match backup LabelSelector.", namespace.GetName(), ) @@ -135,7 +136,7 @@ func (nt *nsTracker) init( continue } - if len(nt.orLabelSelector) > 0 { + if len(nt.orLabelSelector) > 0 && nt.namespaceFilter.ShouldInclude(namespace.GetName()) { for _, selector := range nt.orLabelSelector { if selector.Matches(labels.Set(namespace.GetLabels())) { nt.logger.Debugf("Track namespace %s, because its labels match the backup OrLabelSelector.", diff --git a/pkg/backup/item_collector_test.go b/pkg/backup/item_collector_test.go index 39e57621a..db2a5366e 100644 --- a/pkg/backup/item_collector_test.go +++ b/pkg/backup/item_collector_test.go @@ -196,7 +196,7 @@ func TestItemCollectorBackupNamespaces(t *testing.T) { expectedTrackedNS: []string{"ns1"}, }, { - name: "ns not included by IE filter, but included by labelSelector", + name: "ns excluded by IE filter is not tracked even though it matches labelSelector", backup: builder.ForBackup("velero", "backup").LabelSelector(&metav1.LabelSelector{ MatchLabels: map[string]string{"name": "ns1"}, }).Result(), @@ -205,10 +205,10 @@ func TestItemCollectorBackupNamespaces(t *testing.T) { builder.ForNamespace("ns1").ObjectMeta(builder.WithLabels("name", "ns1")).Phase(corev1api.NamespaceActive).Result(), builder.ForNamespace("ns2").Phase(corev1api.NamespaceActive).Result(), }, - expectedTrackedNS: []string{"ns1"}, + expectedTrackedNS: []string{"ns2"}, }, { - name: "ns not included by IE filter, but included by orLabelSelector", + name: "ns excluded by IE filter is not tracked even though it matches orLabelSelector", backup: builder.ForBackup("velero", "backup").OrLabelSelector([]*metav1.LabelSelector{ {MatchLabels: map[string]string{"name": "ns1"}}, }).Result(), @@ -218,7 +218,7 @@ func TestItemCollectorBackupNamespaces(t *testing.T) { builder.ForNamespace("ns2").Phase(corev1api.NamespaceActive).Result(), builder.ForNamespace("ns3").Phase(corev1api.NamespaceActive).Result(), }, - expectedTrackedNS: []string{"ns1", "ns3"}, + expectedTrackedNS: []string{"ns3"}, }, { name: "No ns filters",