When CreateSnapshot fails (e.g. quota limit), the snapshot is recorded
with an empty ProviderSnapshotID. During backup deletion, velero was
calling DeleteSnapshot("") which produces unnecessary 404 API calls.
Skip the DeleteSnapshot call when ProviderSnapshotID is empty and log
a warning instead.
Fixes#9429
Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Happy <yesreply@happy.engineering>
* Skip signing a download URL when no artifacts can exist yet
Reported in #10232: a DownloadRequest for a backup that never ran still
reaches Processed with a signed URL, and fetching it returns 404.
The controller already has the backup, and the restore for restore
targets, in hand before it signs, so checking the phase costs no extra
call to the object store.
The check is deliberately narrow. It refuses only the pre-execution
phases, where nothing has been written for any target kind: New, Queued,
ReadyToStart and FailedValidation for backups, New and FailedValidation
for restores. InProgress onwards may hold a partial log or other
artifacts, and Deleting may still hold all of them, so those keep the
behaviour callers have today.
That matters because velero backup download has no client side phase
check of its own, unlike backup logs and restore logs. Reusing the
allowlist from pkg/cmd/cli/backup/logs.go would have changed what
backup download can fetch; this does not.
A backup with an empty phase is left alone as well, since that state is
transient and the caller can retry.
Refs #10232
Signed-off-by: saral <ilovegojo2580@gmail.com>
* Derive the phase coverage test from the generated CRDs
The previous test built a slice of phases by hand and asserted its own
length, so it passed no matter what the API did. Adding a fourteenth
backup phase would not have failed it.
This reads the status.phase enum out of the generated CRDs, via the
exported v1crds.CRDs that pkg/install already uses. The enum comes from
the same kubebuilder markers as the Go constants, so a phase added to
the API fails here until it is classified.
Verified by removing Deleting from the expectations, which now fails with
'BackupPhase "Deleting" is served by the CRD but not classified'.
Signed-off-by: saral <ilovegojo2580@gmail.com>
* Use US spelling in comments to satisfy the misspell linter
golangci-lint runs misspell, which flags behaviour as a misspelling of
behavior. Comments only, no functional change.
Signed-off-by: saral <ilovegojo2580@gmail.com>
* Set a Failed phase with a reason when the guard refuses to sign
The guard added in the previous commit left the request at New with no URL, so
the CLI polled until its own timeout and then reported that the backup storage
location may be unavailable. The BSL is fine; the backup never ran.
DownloadRequestPhase gains Failed and DownloadRequestStatus gains Message. The
controller sets both where it refuses, and the CLI stops as soon as it sees the
phase and surfaces the message instead of its generic timeout error.
Adding an enum value is additive, per the direction on the PR discussion.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: saral <ilovegojo2580@gmail.com>
---------
Signed-off-by: saral <ilovegojo2580@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Backup metadata with an empty or New phase was synced into the cluster as a pending backup, which the queue controller then ran as if it were newly requested. Hooks are dropped as well, since a synced backup never executes them.
Signed-off-by: chlins <chlins.zhang@gmail.com>
The DataUpload and DataDownload controllers now copy and delete
namespace-scoped secrets/configmaps for backup/restore PVC provisioning.
Add the corresponding kubebuilder RBAC markers (get;list;create;delete
on secrets and configmaps) and regenerate the ClusterRole.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Move the secret and configmap copy logic from the DataUpload controller
into the CSI snapshot exposer's Expose() method. This keeps all
CSI-specific logic in the exposer and maintains symmetry with CleanUp()
which already handles the cleanup of copied resources.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Copy configured secrets from the source namespace to the Velero
namespace in the New phase of the DataUpload reconcile loop, before
calling Expose(). This is done in the controller rather than the
exposer because Expose() errors are non-retryable (marked as permanent
failure), while the controller can requeue on collision.
On secret collision (same name, different data from another
DataUpload), the controller requeues with a 5s delay, matching the
existing pattern used for VGDP constraint checking.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* refactor: use k8s.io/api well-known label constants
Several well-known Kubernetes label strings were hardcoded across the
codebase instead of using the constants already exported by
k8s.io/api/core/v1, which is an existing dependency:
"kubernetes.io/hostname" -> corev1api.LabelHostname
"kubernetes.io/os" -> corev1api.LabelOSStable
"topology.kubernetes.io/zone" -> corev1api.LabelTopologyZone
The local kube.NodeOSLabel and zoneLabel consts, which duplicated the
upstream values verbatim, are now defined in terms of the upstream
constants rather than repeating the literal. Both are kept: NodeOSLabel
is exported and referenced from four packages alongside NodeOSLinux and
NodeOSWindows, which have no upstream equivalent, and zoneLabel sits
beside the deprecated-label fallback it is compared against.
No functional change - every replacement is a constant with an identical
value.
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
* Add changelog for #10279
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
* Cover the selected-node path in createRestorePod
TestCreateRestorePod only exercised selectedNode == "", so the branch
that pins the restore pod to a node was never executed. Add a case with
a selected node and assert the resulting pod carries the hostname label
in its node selector.
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
* Also use constants for the arch and deprecated zone labels
Extends the same replacement to the two remaining well-known labels
raised on the issue:
"kubernetes.io/arch" -> corev1api.LabelArchStable
"failure-domain.beta.kubernetes.io/zone" -> corev1api.LabelFailureDomainBetaZone
zoneLabelDeprecated in item_backupper.go was the last local const still
repeating a literal that upstream already exports, so the zone pair now
reads consistently against k8s.io/api. The deprecation note upstream
applies to the label itself, not the constant; Velero reads that label
deliberately as the fallback for PVs created before the topology labels
existed.
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
---------
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
This commit hardens the func "patchDynamicPVWithVolumeInfo":
1. Add nil checks for storageClass and the attributes.
2. Remove the double reported errors.
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
When a Schedule has no explicit spec.skipImmediately, the reconciler
assigned &c.skipImmediately directly into the Schedule's spec pointer.
The subsequent write-through-pointer (*ptr = false) mutated the
reconciler's own shared field, silently disabling
--schedule-skip-immediately for every schedule reconciled afterward
for the life of the process.
Fix: copy the value into a fresh bool before taking its address.
Adds TestReconcileDoesNotCorruptReconcilerSkipImmediately, which
reconciles two schedules against one reconciler instance and asserts
the shared default is preserved.
Signed-off-by: Prajwal <percy38621@gmail.com>
* Fix switch case ordering in filterBackupOwnerReferences (Issue #10160)
When client.Get returns a transient (non-NotFound) error, the previous
case ordering caused the UID mismatch case to fire against a zero-value
struct, silently dropping the owner reference and logging a misleading
'mismatched UIDs' warning instead of the intended error log.
Fix: move the general error handler before the UID mismatch check so
it is evaluated while err is still relevant. The UID check now only
runs when err == nil (i.e. the Schedule was successfully fetched).
Also add a test case that injects a transient Get error via the fake
client interceptor to verify the owner reference is preserved.
Signed-off-by: aftab <aftab123215@gmail.com>
* Add changelog for #10160
Signed-off-by: aftab <aftab123215@gmail.com>
---------
Signed-off-by: aftab <aftab123215@gmail.com>
- Fix 'dataudownload' typo in DataDownload warning log message
(data_download_controller.go:696)
- Fix 'datadownlad' misspelled structured log field key to 'datadownload'
(data_download_controller.go:700) - this caused the log field to be
unqueryable by the correct key name
- Fix 'retrieveable' -> 'retrievable' in BackupRepository maintenance
status messages (maintenance.go:354, 417)
- Update corresponding test assertion to match corrected string
(maintenance_test.go:792)
Signed-off-by: shellyco-code <shellyco-code@users.noreply.github.com>
Co-authored-by: shellyco-code <shellyco-code@users.noreply.github.com>
Modify the logs.
Modify the CRD's data mover's comment.
Modify the resource policy's GetDataMover for default data mover case.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
- Log when SkipDefaultResourceModifier skips the default modifier
- Add test for unsupported ResourceModifier Kind (warns, does not
apply default)
- Add test for default ConfigMap with invalid rules (validation
failure is non-fatal)
- loadResourceModifierConfigMap now at 100% coverage
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- Add Default Resource Modifiers section to restore-resource-modifiers.md
- Add --default-resource-modifier-configmap to customize-installation.md
- Add examples/default-resource-modifier-cni.yaml with CNI annotation
stripping rules for OVN-K and Multus
- Update restore describer to show SkipDefaultResourceModifier when set
- Log warning when ResourceModifier Kind is not ConfigMap instead of
silently doing nothing
- Add deployment_test.go coverage for the new server flag
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- Fix fallthrough bug: when ResourceModifier is set with a non-ConfigMap
kind, do not fall through to applying the server default. The outer
check on ResourceModifier != nil now prevents default application
regardless of the Kind value.
- Include underlying error in fatal validation message for ConfigMap
retrieval failures.
- Strengthen exclusive precedence test: default ConfigMap intentionally
does not exist while per-restore does, proving the default is never
consulted.
- Add test for invalid default ConfigMap data (non-fatal, warn and
proceed).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Thread DefaultResourceModifierConfigMap from server config through to
restoreReconciler. Refactor validateAndComplete to use a shared
loadResourceModifierConfigMap helper that handles both default and
per-restore ConfigMap loading.
Precedence: per-restore modifier takes exclusive precedence over the
default. Default ConfigMap errors are non-fatal (warn and proceed).
SkipDefaultResourceModifier opt-out is respected.
Includes unit tests covering: default-only, per-restore override,
skip flag, missing default (non-fatal), missing per-restore (fatal),
and no modifier configured.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Replace blanket Reset() with targeted DeleteLabelValues to avoid
briefly wiping metrics for schedules that still exist. Track known
schedules in a set and only delete stale entries on each resync.
Extract the wait.Until closure into resyncBackupMetrics() so tests
can call it directly without goroutine timing. Replace hand-rolled
collectGaugeCount helper with testutil.CollectAndCount.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add a test that exercises the actual updateTotalBackupMetric goroutine
with a fake client to verify stale backupLastSuccessfulTimestamp
entries are pruned during a real resync cycle.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Avoid clearing backupLastSuccessfulTimestamp on transient API errors.
The reset and re-set now only run when the backup List call succeeds,
so existing metric values remain stable across temporary failures.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Remove the exported method that was only used in tests. Use the
existing Metrics() getter to access the gauge directly in the
backup controller test instead.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
The periodic backup metrics resync in updateTotalBackupMetric only set
backupLastSuccessfulTimestamp values but never removed stale entries.
When a schedule was deleted and its backups removed, the gauge persisted
until the Velero pod was restarted.
Reset the gauge before re-setting current values so that deleted
schedules are pruned automatically each resync cycle.
Fixes#9239
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- normalized the input to lower case for consistency
- added validations for kind collision
- add flag for unresolved kinds, and defer skip decision base on that
- move peek-and-map test cases to restore_policies_test.go
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Add change-id and volume-id retrieve logic for both vks and vanilla k8s environment.
* Add change-id and volume-id support code in exposer.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
restore filters via resource policy, support ClusterScopedFilterPolicy
and NamespaceFilterPolicies.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Merge backup PV labels instead of wholesale replacement during restore finalization
Change patchDynamicPVWithVolumeInfo to merge backup labels into the
dynamically provisioned PV rather than overwriting its entire label map.
Labels already present on the new PV (e.g. topology labels set by the
provisioner) are preserved, and only missing labels from the backup are
added. This prevents stale topology labels from the source cluster from
overwriting correct values set by the target cluster's provisioner.
Update needPatch to only trigger when backup labels are absent from the
new PV, not when values differ — since differing values now intentionally
favour the dynamically provisioned PV.
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add changelog
Signed-off-by: Joseph <jvaikath@redhat.com>
* Update changelog to reflect new approach
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Trigger CI rebuild
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
---------
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
Change errors.Cause to errors.Is, because github.com/cockroachdb/errors
New() function create a error with error stack with depth 1, but
github.com/pkg/errors's New() function create error with no depth.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
chlins
Shubham Pampattiwar
lyndon-liandGitHub
harshit sainiandGitHub
Daniel JiangandGitHub
Lyndon-Li
V PrajwalandGitHub
Krishna AwasthiandGitHub
AftAb-25andGitHub
Xun Jiang
Wenkai Yin(尹文开)andGitHub
Adam ZhangandGitHub
Joseph Antony VaikathandGitHub
Xun Jiang/Bruce JiangandGitHub