- normalized the input to lower case for consistency
- added validations for kind collision
- add flag for unresolved kinds, and defer skip decision base on that
- move peek-and-map test cases to restore_policies_test.go
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
When a user specifies a Custom Resource Kind in a restore filter
policy (e.g., kinds: [MyCustomKind]), the discovery helper fails
to resolve it if the CRD hasn't been restored yet.
This adds a peek-and-map fallback: if a resource type in the
backup tarball doesn't match the resolved filters, Velero peeks
at the actual Kind of the first item in the tarball and matches
it against the user's original policy strings.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
- Use *bool for SkipDefaultResourceModifier to match RestoreSpec conventions
- Use boolptr.IsSetToTrue for nil-safe bool check in controller logic
- Fix warning message to say "failed to retrieve" instead of "not found"
- Add Restore Describe Output subsection covering all resolved states
- Only set SkipDefaultResourceModifier from CLI when flag is true
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* restore filter enhancement
enhance restore filter with resource policies, introduce resource
policies with fine-grained control for resources in restore, both
cluster scoped resources and namespace scoped resources, with
labels, names include/exclude support with glob patterns.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address review comments
- Add introductory sentence linking to the Phase 1 backup filters PR.
- Add clarification that a backup's ConfigMap may not exist on the
target cluster because it might be on a different Velero instance.
- Remove redundant explanations about backup-specific concepts
(volume policies, include/exclude policies).
- Remove the non-goal regarding restore-side `includeExcludePolicy`.
- Remove the "Interaction with Backup-Side Filters" section.
- Remove "Step 5" from the design, as additional items requested by
plugins should intentionally bypass fine-grained filter checks
(consistent with backup side Stage 2).
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address more review comments
- remove confusion rows regarding per-namespace kind list
- simplified CLI output to configmap name only
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Introduces a --default-resource-modifier-configmap server flag that
references a ConfigMap with resource modifier rules applied automatically
to all restores. This eliminates per-restore configuration for common
transformations like stripping stale CNI annotations (OVN-Kubernetes,
Multus) that can break workloads after restore.
Key design decisions:
- Exclusive precedence: per-restore modifiers fully replace the default
- Non-fatal default errors: misconfigured default does not break restores
- Opt-out via SkipDefaultResourceModifier field in RestoreSpec
- Ships with a curated example ConfigMap for CNI annotation stripping
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- rename FineGrainedGlobalFilterPolicy to ClusterScopedFilterPolicy
- add warning message in several places to help debug
- cleanup conflicting validations
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
enhance backup filter with resource policies, extend resource
policies with fine-grained control for backup resources, both
cluster scoped resources and namespace scoped resources, with
labels, names include/exclude support with glob patterns.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
- Introduced `CACertRef` field in `ObjectStorageLocation` to reference a Secret containing the CA certificate, replacing the deprecated `CACert` field.
- Implemented validation logic to ensure mutual exclusivity between `CACert` and `CACertRef`.
- Updated BSL controller and repository provider to handle the new certificate resolution logic.
- Enhanced CLI to support automatic certificate discovery from BSL configurations.
- Added unit and integration tests to validate new functionality and ensure backward compatibility.
- Documented migration strategy for users transitioning from inline certificates to Secret-based management.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
- Expanded the design to include detailed implementation steps for wildcard expansion in both backup and restore operations.
- Added new status fields to the backup and restore CRDs to track expanded wildcard namespaces.
- Clarified the approach to ensure backward compatibility with existing `*` behavior.
- Addressed limitations and provided insights on restore operations handling wildcard-expanded backups.
This update aims to provide a comprehensive and clear framework for implementing wildcard namespace support in Velero.
Signed-off-by: Joseph <jvaikath@redhat.com>
- Clarified the use of the standalone `*` character in namespace specifications.
- Ensured consistent formatting for `*` throughout the document.
- Maintained focus on backward compatibility and limitations regarding wildcard usage.
This update enhances the clarity and consistency of the design document for implementing wildcard namespace support in Velero.
Signed-off-by: Joseph <jvaikath@redhat.com>
- Updated the abstract to clarify the current limitations of namespace specifications in Velero.
- Expanded the goals section to include specific objectives for implementing wildcard patterns in `--include-namespaces` and `--exclude-namespaces`.
- Detailed the high-level design and implementation steps, including the addition of new status fields in the backup CRD and the creation of a utility package for wildcard expansion.
- Addressed backward compatibility and known limitations regarding the use of wildcards alongside the existing "*" character.
This update aims to provide a comprehensive overview of the proposed changes for improved namespace selection flexibility.
Signed-off-by: Joseph <jvaikath@redhat.com>
- Add --server-priority-class-name and --node-agent-priority-class-name flags to velero install command
- Configure data mover pods (PVB/PVR/DataUpload/DataDownload) to use priority class from node-agent-configmap
- Configure maintenance jobs to use priority class from repo-maintenance-job-configmap (global config only)
- Add priority class validation with ValidatePriorityClass and GetDataMoverPriorityClassName utilities
- Update e2e tests to include PriorityClass testing utilities
- Move priority class design document to Implemented folder
- Add comprehensive unit tests for all priority class implementations
- Update documentation for priority class configuration
- Add changelog entry for #8883
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
remove unused test utils
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
feat: add unit test for getting priority class name in maintenance jobs
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
doc update
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
feat: add priority class validation for repository maintenance jobs
- Add ValidatePriorityClassWithClient function to validate priority class existence
- Integrate validation in maintenance.go when creating maintenance jobs
- Update tests to cover the new validation functionality
- Return boolean from ValidatePriorityClass to allow fallback behavior
This ensures maintenance jobs don't fail due to non-existent priority classes,
following the same pattern used for data mover pods.
Addresses feedback from:
https://github.com/vmware-tanzu/velero/pull/8883#discussion_r2238681442
Refs #8869
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
refactor: clean up priority class handling for data mover pods
- Fix comment in node_agent.go to clarify PriorityClassName is only for data mover pods
- Simplify server.go to use dataPathConfigs.PriorityClassName directly
- Remove redundant priority class logging from controllers as it's already logged during server startup
- Keep logging centralized in the node-agent server initialization
This reduces code duplication and clarifies the scope of priority class configuration.
🤖 Generated with [Claude Code](https://claude.ai/code)
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
refactor: remove GetDataMoverPriorityClassName from kube utilities
Remove GetDataMoverPriorityClassName function and its tests as priority
class is now read directly from dataPathConfigs instead of parsing from
ConfigMap. This simplifies the codebase by eliminating the need for
indirect ConfigMap parsing.
Refs #8869🤖 Generated with [Claude Code](https://claude.ai/code)
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
refactor: remove priority class validation from install command
Remove priority class validation during install as it's redundant
since validation already occurs during server startup. Users cannot
see console logs during install, making the validation warnings
ineffective at this stage.
The validation remains in place during server and node-agent startup
where it's more appropriate and visible to users.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-Authored-By: Claude <noreply@anthropic.com>
lyndon-liandGitHub
Adam Zhang
Shubham Pampattiwar
Daniel JiangandGitHub
chlins
Lyndon-Li
Scott Seago
Tiger Kaovilai
Micah NagelandXun Jiang/Bruce Jiang
Joseph
