When a user specifies a Custom Resource Kind in a restore filter
policy (e.g., kinds: [MyCustomKind]), the discovery helper fails
to resolve it if the CRD hasn't been restored yet.
This adds a peek-and-map fallback: if a resource type in the
backup tarball doesn't match the resolved filters, Velero peeks
at the actual Kind of the first item in the tarball and matches
it against the user's original policy strings.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
restore filters via resource policy, support ClusterScopedFilterPolicy
and NamespaceFilterPolicies.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
For resource policy in restore, it will reject invalid sections
such as volumePolicies or includeExcludePolicy, to prevent user
from misuse backup side resource policy configmap.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Add resourcePolicy field for restore CRD which is backed by
a configmap that holds ClusterScopedFilterPolicy and
NamespacedFilterPolicies for restore side filtering.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* restore filter enhancement
enhance restore filter with resource policies, introduce resource
policies with fine-grained control for resources in restore, both
cluster scoped resources and namespace scoped resources, with
labels, names include/exclude support with glob patterns.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address review comments
- Add introductory sentence linking to the Phase 1 backup filters PR.
- Add clarification that a backup's ConfigMap may not exist on the
target cluster because it might be on a different Velero instance.
- Remove redundant explanations about backup-specific concepts
(volume policies, include/exclude policies).
- Remove the non-goal regarding restore-side `includeExcludePolicy`.
- Remove the "Interaction with Backup-Side Filters" section.
- Remove "Step 5" from the design, as additional items requested by
plugins should intentionally bypass fine-grained filter checks
(consistent with backup side Stage 2).
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address more review comments
- remove confusion rows regarding per-namespace kind list
- simplified CLI output to configmap name only
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Merge backup PV labels instead of wholesale replacement during restore finalization
Change patchDynamicPVWithVolumeInfo to merge backup labels into the
dynamically provisioned PV rather than overwriting its entire label map.
Labels already present on the new PV (e.g. topology labels set by the
provisioner) are preserved, and only missing labels from the backup are
added. This prevents stale topology labels from the source cluster from
overwriting correct values set by the target cluster's provisioner.
Update needPatch to only trigger when backup labels are absent from the
new PV, not when values differ — since differing values now intentionally
favour the dynamically provisioned PV.
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add changelog
Signed-off-by: Joseph <jvaikath@redhat.com>
* Update changelog to reflect new approach
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Trigger CI rebuild
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
---------
Signed-off-by: Joseph <joseph@amazee.io>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add CONTAINER_TOOL variable to Makefile for podman support
Local development targets (shell, lint, build-image, clean, serve-docs)
hardcode `docker`, preventing developers who use podman from running
them. Add a CONTAINER_TOOL variable that defaults to `docker` and can
be overridden:
make lint CONTAINER_TOOL=podman
CI/release targets (container builds, manifest push, buildx instance
management) are left unchanged since they use Docker-specific features
like `docker buildx` and `docker manifest`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add changelog for PR #9904
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add guards to prevent podman on docker-only targets
Multi-arch image targets (container, push-manifest, etc.) require
docker buildx/manifest which podman does not support. Add explicit
guards that fail fast with a clear error message instead of producing
cryptic runtime failures.
Guarded targets: container, container-linux, container-windows,
push-manifest, push-build-image, and the buildx path in build-image.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Trigger CI rebuild
Signed-off-by: Joseph <jvaikath@redhat.com>
---------
Signed-off-by: Joseph <jvaikath@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Introduces a concurrent-safe sync.Map cache to the backup Request struct
to memoize GetNamespaceFilter results. This avoids re-evaluating glob
patterns for every item, significantly improving backup performance while
preserving the original exact-match precedence logic.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Adam Zhang
Chlins Zhang
lyndon-li
Lyndon-Li
Xun Jiang/Bruce Jiang
Joseph Antony Vaikath
Daniel Jiang