pkg/cmd/cli/restore/logs.go was the last command in the CLI still calling
cmd.Exit, which calls os.Exit directly. Two of its own tests were skipped
because of it, and said so:
t.Skip("Cannot test restore not complete case due to cmd.Exit() call")
This gives restore logs the LogsOptions shape that backup logs already
uses: Complete, BindFlags and Run returning an error, with the cobra
command passing that to cmd.CheckError. Both skipped tests now run and
assert on the returned errors.
Exit status is unchanged; cmd.CheckError also exits 1. The two refusal
messages now carry the standard "An error occurred:" prefix and match
the wording backup logs uses.
Signed-off-by: saral <ilovegojo2580@gmail.com>
* Add printer columns for Backup and Restore CRDs
kubectl get backup and kubectl get restore fall back to the default
NAME/AGE table because neither type declares printer columns, while
Schedule and BackupStorageLocation do. Anything reading the API without
the velero binary cannot see a backup's phase, error count or timing.
Printer columns were added in #2881 and reverted in #3652 as a
workaround for #3600, a CRD install error that was never root-caused.
Schedule regained columns in 2022 and BackupStorageLocation has them
today, with no recurrence.
Only fields expressible as plain JSONPath are included. Expiration is
deliberately omitted: kubectl renders a date column as time elapsed,
so a future expiration prints <invalid>, which covers every backup that
has not yet expired.
Fixes#10199
Signed-off-by: saral <ilovegojo2580@gmail.com>
* Rename changelog name to pass changelog check
Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>
---------
Signed-off-by: saral <ilovegojo2580@gmail.com>
Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>
Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>
troubleshooting.md covers SignatureDoesNotMatch but not the other way a
log or results download fails: the pre-signed URL carries the s3Url host,
which for an in-cluster Service name does not resolve on the client.
The backup or restore itself is unaffected, which makes the error easy to
misread. The fix, publicUrl, is documented only under exposing Minio, so
this links there instead of duplicating it.
Signed-off-by: saral <ilovegojo2580@gmail.com>
kubectl get volumesnapshotlocation falls back to NAME and AGE, while
BackupStorageLocation beside it shows provider and phase. This follows
the same pattern for the remaining location type.
Phase is worth surfacing here because the CLI does not print it.
velero snapshot-location get shows only NAME and PROVIDER, so
status.phase, which carries the same Available/Unavailable enum as
BackupStorageLocation, is currently not visible from either tool.
Raised as an open question on #10199 and left out of #10200 to keep that
change to the two types the issue was filed about.
Signed-off-by: saral <ilovegojo2580@gmail.com>
restore-wait's securityContext fallback chain checked the fs-restore
ConfigMap, then the first container's SecurityContext, then hardcoded
runAsUser 1000. It never consulted pod.Spec.SecurityContext, so pods
that set identity only at the pod level got a helper running as uid
1000 regardless of the workload's actual uid. On volumes where restored
content is owner-only-visible to a non-1000 uid, the helper's stat on
the done-file returns EACCES forever and the pod deadlocks at Init:0/1.
Add pod-level spec.securityContext.runAsUser/runAsGroup as a fallback
between the container-level check and the hardcoded default, since the
workload's own identity is the one that can read what it restored.
Defer to the pod's own RunAsNonRoot setting when runAsUser is 0, since
the hardcoded RunAsNonRoot: true would otherwise contradict a root uid.
Also add a test case covering both container-level and pod-level
SecurityContext set together, confirming container-level still wins.
Fixes#10046
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Register cobra completion callbacks for all commands that accept
existing Velero resource names. A centralized completeNames helper
uses apimachinery's meta.ExtractList/Accessor to list resources with
a 3-second timeout, filter by prefix, and deduplicate already-typed
arguments. Wires ValidArgsFunction on 20 commands and
RegisterFlagCompletionFunc on 9 flags across backup, restore,
schedule, backuplocation, snapshotlocation, repo, and debug.
Closes#9782
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add SnapshotClassParameter constant and GetSnapshotClass getter
Add a new snapshotClass action parameter to volume policies, allowing
users to specify which VolumeSnapshotClass to use for CSI snapshots.
This follows the existing dataMover parameter pattern with a typed
constant and getter method on the Action struct.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add snapshotClass parameter validation
Validate the snapshotClass parameter in Action.validate(): it must only
appear on snapshot actions, must be a string, and must not be empty.
Follows the same validation pattern as the dataMover parameter.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add volume policy tier to VolumeSnapshotClass selection
Add GetVolumeSnapshotClassFromVolumePolicy helper and extend
GetVolumeSnapshotClass with a policySnapshotClass parameter. The new
tier sits between PVC annotation and backup annotation in the priority
chain: PVC annotation > volume policy > backup annotation > VSC label.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Wire snapshotClass from volume policy through CSI plugin
In pvcBackupItemAction.Execute, call GetActionParameters to extract the
snapshotClass from the matched volume policy and pass it through
getVolumeSnapshotReference and createVolumeSnapshot to
GetVolumeSnapshotClass. This connects the volume policy parameter to
the CSI snapshot creation path.
Fixes#8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #10070
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Document snapshotClass volume policy parameter
Add documentation for the new snapshotClass parameter in the volume
policy snapshot action. Update the CSI docs to include volume policy
as a tier in the VolumeSnapshotClass selection priority, and add
Example 6 to resource-filtering.md showing multi-array usage.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix import ordering in pvc_action.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add end-to-end test for snapshotClass volume policy parameter
Verify that when a volume policy specifies snapshotClass, the CSI
plugin creates a VolumeSnapshot using that VolumeSnapshotClass. The
test uses a VSC without the velero label to confirm selection comes
from the volume policy parameter, not the label-based fallback.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt struct field alignment in pvc_action_test.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add GetSnapshotClass to VolumeHelper interface
Add a GetSnapshotClass method to VolumeHelper that encapsulates the
extraction of the snapshotClass parameter from volume policy actions.
This avoids requiring callers to parse raw parameters from
GetActionParameters. Simplify the CSI plugin to use the new method.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt formatting in resource_policies.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Pin architecture-specific SHA-256 checksums for kubebuilder, protoc, and GoReleaser before installation.
Signed-off-by: chlins <chlins.zhang@gmail.com>
EnsureNamespaceExistsAndIsReady wrote the tracker key with namespace.Kind
(getNamespace() sets Kind=Namespace) but read it with clusterNS.Kind
(client.Get strips TypeMeta -> Kind=empty). The keys never matched, so the
skip-path never fired and every item in a terminating namespace paid the full
--terminating-resource-timeout wait (per-resource instead of per-namespace).
Use the passed-in namespace object for Contains so Add/Contains keys match.
Add a regression test that reproduces the production Kind divergence.
Signed-off-by: Shashank1306s <shashasingh@microsoft.com>
Co-authored-by: Shashank1306s <shashasingh@microsoft.com>
Co-authored-by: Priyansh Choudhary <im1706@gmail.com>
Modify the logs.
Modify the CRD's data mover's comment.
Modify the resource policy's GetDataMover for default data mover case.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
The CSI snapshot and generic restore exposers access data through PVCs, so they no longer inherit the node-agent host path volumes. Also drop all capabilities on the data mover container.
Signed-off-by: chlins <chlins.zhang@gmail.com>
Hook timeouts come from pod annotations via time.ParseDuration, which accepts
negative and arbitrarily large values, and the exec stream was never cancelled.
Signed-off-by: chlins <chlins.zhang@gmail.com>
archive.GetItemFilePath/GetVersionedItemFilePath joined the group resource,
namespace and name into a path without checking the result against rootDir.
Those components can come from backup contents - the additional items a
RestoreItemAction returns are built from annotations on a backed up object -
so a component containing ".." resolved to an arbitrary file on the Velero
pod, which was then Stat'd, unmarshalled and restored as a Kubernetes object.
Both helpers now return an error when the joined path escapes rootDir, and all
callers handle it. rootDir is empty when building an entry path inside the
backup tarball, so "." is used as the containment base for that relative form.
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Replace rebase action with GitHub CLI
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Add contents write permission for rebase workflow
Updating the PR branch pushes to the head branch, which requires contents: write for the GITHUB_TOKEN.
Signed-off-by: chlins <chlins.zhang@gmail.com>
---------
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Support overriding Schedule annotations via template.metadata.annotations
Adds an Annotations field to BackupSpec.Metadata, mirroring the existing
Labels override. When Schedule.Spec.Template.Metadata.Annotations is set,
it is used for the resulting Backup's annotations instead of copying
Schedule.Annotations directly, allowing users to opt out of unwanted
annotations (e.g. ArgoCD tracking annotations) being propagated from
Schedule to Backup.
Fixes#5836
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
* Rename changelog fragment to match PR number 10045
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
---------
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>
Stop force-including VolumeSnapshotContents via resourceMustHave on
every restore; CSI VolumeSnapshot/PVC RestoreItemActions now set
`restore.velero.io/must-include-additional-items` so bound snapshot
dependencies are restored only when their parent is restored.
Fixes: #9957
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Let RestoreItemActions opt in via annotation to
bypass global restore filters for AdditionalItems,
mirroring the backup-side must-include behavior.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Support set-based filter label selectors
Use matchLabels/matchExpressions in fine-grained filters.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* omit the details of resource policy for cli
The reason to not resolve and display CLI is because it may go
out of sync, we want to avoid display it to mislead users.
We may consider to cpature those information and display it
in later release.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Co-authored-by: Scott Seago <sseago@redhat.com>
Design for `restore.velero.io/must-include-additional-items` annotation
and its usage and interaction with existing filtering mechanism.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
RalthosandGitHub
Chlins ZhangandGitHub
lyndon-liandGitHub
Wenkai Yin(尹文开)andGitHub
Lyndon-Li
Xun Jiang/Bruce JiangandGitHub
Tiger KaovilaiandGitHub
JosephandClaude Opus 4.6
Shubham PampattiwarandGitHub
Jay2006sawant
Adam ZhangandGitHub
Xun Jiang
Scott SeagoandGitHub