* test: use the Kind constant instead of the string literal
test/types.go defines `const Kind = "kind"` and most of the suite compares
against it, but three sites still use the bare string. deletion.go is
inconsistent with itself: the BeforeEach skip uses Kind while the one in
runBackupDeletionTests uses "kind", and its skip message hardcodes the
provider name where the other formats it.
namespace-mapping.go dot-imports test/e2e/test rather than test, so the
constant was not in scope there. Import the test package by name, as
test/e2e/migration/migration.go already does alongside its framework
import, and reference test.Kind.
No behavioural change: the constant's value is the string being replaced.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10524
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
#10506 added SourceSize to the PodVolumeBackup and DataUpload status
types but did not regenerate the CRD manifests. Without the field in the
CRD schema, the API server silently drops status.sourceSize on write, so
the recorded source size never reaches the cluster objects.
Generated with hack/update-3generated-crd-code.sh (controller-gen
v0.16.5).
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Scope schedule and repo CLI list calls to the Velero namespace
velero schedule get, velero schedule describe, velero schedule
pause/unpause and velero repo get built a ctrlclient.ListOptions with a
LabelSelector but no Namespace, so the list ran across every namespace in
the cluster. Their single-name paths in the same functions already scope
to f.Namespace(), and every sibling command (backup get, restore get,
backup describe, restore describe, snapshot-location get, schedule
delete) passes Namespace too, so the omission was an oversight rather
than intent.
The read commands print another installation's Schedules and
BackupRepositories. runPause is worse: velero schedule pause --all and
velero schedule unpause --all fetch Schedules from every namespace and
then write Spec.Paused on each, so pausing one installation's schedules
pauses every other installation's schedules as well.
Add Namespace: f.Namespace() to the four List calls:
pkg/cmd/cli/schedule/get.go:61
pkg/cmd/cli/schedule/describe.go:59
pkg/cmd/cli/schedule/pause.go:114
pkg/cmd/cli/repo/get.go:61
Neither pkg/cmd/cli/schedule nor pkg/cmd/cli/repo had any tests, so the
regression tests are new files. Each seeds a fake client with one object
in the Velero namespace and one in another-velero, and asserts the second
is neither listed, described, nor paused.
Signed-off-by: Max Freedom Pollard <272618364+MaxFreedomPollard@users.noreply.github.com>
* Add changelog for PR 10482
Signed-off-by: Max Freedom Pollard <272618364+MaxFreedomPollard@users.noreply.github.com>
---------
Signed-off-by: Max Freedom Pollard <272618364+MaxFreedomPollard@users.noreply.github.com>
Velero has no published OpenSSF Scorecard results, so the Scorecard
badge does not resolve and CLOMonitor flags the openssf_scorecard_badge
check as missing.
Add the ossf/scorecard-action workflow (SHA-pinned, least-privilege
permissions, publish_results enabled) running weekly and on push to
main. Once it runs post-merge, results publish to the OpenSSF API and
the README badge resolves. This also surfaces the project's security
posture (currently 6.2/10) to guide further hardening.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
formatUserPriorities stripped only spaces, so an enableapigroupversions
ConfigMap written with CRLF line endings (common for files edited on
Windows) kept a trailing carriage return in each version string, e.g.
"v2beta1\r". versionsContain compares versions with equality, so the
user priority never matched and was silently ignored. Trim the trailing
carriage return so stored versions match again.
Signed-off-by: HeonJe LEE <lhjnano@gmail.com>
* Fix datamover backup arg mismatch for CSI CBT service account name
The exposer built the pod command with --csi-snapshot-metadata-service-sa,
but the datamover backup command only registered --cbt-sa-name. cobra
rejects unknown flags, so the data mover pod exited immediately whenever
a dedicated CBT service account was configured -- and the reverse also
held: since the flags never matched, the SA name never actually reached
the pod, so any code path depending on it stayed unreachable.
Not limited to the block data mover: this line sits outside the
DataMoverTypeVeleroBlock gate and the cbtInfo != nil gate, so it fires
for any CSI snapshot data-movement backup.
Fix: emit --cbt-sa-name (already consumed by the backup command), naming
it consistently with the other CBT flags on the same line (--change-id,
--volume-id, --snapshot-id).
Add a regression test asserting the emitted flag string parses cleanly
against NewBackupCommand's own flag set, so the two sides can't drift
apart again without a test failure.
* Add changelog for #10318
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
* Add MustIncludeAdditionalItemPVCs structure in backup. It's used to track PVCs returned by BIA with mustIncluded annotaion and PVC is excluded from backup by global filter.
* Modfiy the volumeHelper interface to add a parameter function for ShouldPerformFSBackup.
* Modify to support fine-grained backup filters.
* Modify according to comments. Use a read-only interface to replace the parameter function.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
* Add block data mover support for Velero backup/restore describe CLI.
Update output tests to accommodate RestoreType in VolumeInfo
This commit addresses the compilation and assertion errors caused by the introduction of `RestoreType` in `VolumeInfo` and the separation of `SnapshotDataMovementInfo` / `PodVolumeInfo` into their backup and restore counterparts. It fixes references across the test fixtures and the print guard conditions in `restore_describer.go`.
* Modify according to comments
* Add missing JSON tag in the VolumeInfo structures.
* Get uploaderType from the DU and DD's dataMover for the data mover volume info.
* Add IncrementalSize in the data mover volume info.
* Add existingVolumeDataPolicy and restoreType in the restore describe CLI output
* Add more UTs.
* Add some fields value setting that were previously missed.
* Fix the timestamp compare error only found in the GitHub action.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The Velero core repository is not distributed as an Artifact Hub package,
so the CLOMonitor artifacthub_badge check is not applicable. Declare an
exemption with justification per CLOMonitor's metadata schema.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix dead GOVERNANCE.md link in MAINTAINERS.md
The GOVERNANCE.md link pointed to the old vmware-tanzu/velero path,
which now returns a 404. Governance now lives at the org level under
velero-io/.github. Repoint the link so it resolves correctly.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add Governance section to README for discoverability
CLOMonitor's governance check looks for a governance file or a
governance reference (header/link) in the README, not in MAINTAINERS.md.
Add a Governance section to the README linking the org-level
GOVERNANCE.md so the check passes and the info is discoverable.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
The README had no reference to Velero's community meetings, which CLOMonitor
flags via the community_meeting check. Community meeting details already live
on the community page but were not discoverable from the README.
Add a Community section linking the bi-weekly community meetings, project
meeting calendar, YouTube archive, Slack, and mailing list.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:
* nightly-trivy-scan keeps security-events: write at the job level to
upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
actions/stale action to label and close stale items.
Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
The changelog check decided whether a PR was exempt using the labels in
the triggering event payload (github.event.pull_request.labels). That
payload is frozen at event time, so a PR that gets the
kind/changelog-not-required label after its first run could not pass by
re-running the failed job, and the exemption only took effect if a brand
new event happened to fire afterward.
Move the exemption logic into hack/changelog-check.sh and query the PR's
current labels via the GitHub API instead. Re-runs and labels added after
the initial run are now evaluated correctly. The workflow grants
pull-requests: read and passes github.token so the script can read labels.
The exempt label set (kind/changelog-not-required, Design, Website,
Documentation) is unchanged.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add a schema-valid OpenSSF Security Insights v2 (2.2.0) manifest at
SECURITY-INSIGHTS.yml describing the project's maintainers, vulnerability
reporting process, license, and links to governance, security, and
dependency management policies.
Also add a Dependency management section to the development docs covering
Go modules, Dependabot automation, review process, and how security
relevant dependency updates are handled. The manifest references this
section as the dependency management policy.
This improves the project's CLOMonitor score by satisfying the
security_insights and dependencies_policy checks.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
An in-place restore onto a different volume than the one backed up is
unsafe: an incremental (CBT) restore computes deltas against a different
volume lineage, and even a full restore would patch and write into an
unrelated volume. Verify the existing PVC is bound and still bound to
the PV recorded at backup time before any side effect, on both the CSI
data mover path (using the backed-up PVC's volume name) and the file
system path (using the PVC-to-PV mapping from the backup volume info).
The PV comparison is skipped for namespace-mapped restores, where the
target PVC is necessarily bound to a different PV (the documented
cross-namespace clone-and-restore workflow).
Signed-off-by: chlins <chlins.zhang@gmail.com>
KrishhnaTandGitHub
lyndon-liandGitHub
Chlins ZhangandGitHub
Wenkai Yin (尹文开)
Max Freedom PollardandGitHub
Shubham PampattiwarandGitHub
HeonJe LeeandGitHub
Lyndon-Li
Tiger KaovilaiandGitHub
Xun Jiang/Bruce JiangandGitHub
Daniel JiangandGitHub
Wenkai Yin(尹文开)andGitHub