6203 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Chlins ZhangandGitHub	0fe080edc6	Merge pull request #10474 from chlins/backport-10464-to-release-1.18 ... [release-1.18] Add operation context to user-facing error messages	2026-09-03 14:52:14 +08:00
lyndon-liandGitHub	d7025edf83	Merge branch 'release-1.18' into backport-10464-to-release-1.18	2026-09-03 13:49:48 +08:00
lyndon-liandGitHub	80a7b41f7b	Merge pull request #10473 from adam-jian-zhang/fix-wildcard-ns-filters-for-1.18 ... [Cherry-Pick]Enforce resource filters on cluster-wide items (#10455)	2026-09-03 13:43:20 +08:00
chlins	ef95718d26	Add operation context to user-facing error messages ... Prefix raw err.Error() strings surfaced in CR statuses and CLI stderr with the failed operation. Signed-off-by: chlins <chlins.zhang@gmail.com> (cherry picked from commit e03ff894ff)	2026-09-03 10:43:08 +08:00
Adam Zhang	ecac71ac65	Enforce resource filters on cluster-wide items (#10455) ... * Enforce resource filters on cluster-wide items When backups query all namespaces (wildcard or omitted includes), the item collector retrieved resources in bulk, bypassing per-namespace resource filter policies in Stage 1 collection. This caused resources not listed in the policy to be backed up. To preserve cluster-wide query performance while enforcing policy rules, evaluate namespace exclusions, resource kind allowlists, and label selectors in memory for each collected item. Signed-off-by: Adam Zhang <adam.zhang@broadcom.com> * Optimize in-memory resource filter checks Optimize per-item filter evaluation in the item collector: - Precalculate GroupResource string once per resource type - Skip filter policy evaluation when no namespaced policies exist - Restrict in-memory filtering to cluster-wide queries - Cache consecutive namespace lookups across collected items - Lazily extract resource labels only when selectors are present Signed-off-by: Adam Zhang <adam.zhang@broadcom.com> --------- Signed-off-by: Adam Zhang <adam.zhang@broadcom.com> (cherry picked from commit 85c660612b)	2026-09-03 10:33:44 +08:00
lyndon-liandGitHub	6e8f61c35f	Merge pull request #10450 from Lyndon-Li/release-1.18 ... Add 1.18.3 changelog v1.18.3-rc.1	2026-08-31 16:43:14 +08:00
Lyndon-Li	3f70a01dfa	add 1.18.3 changelog ... Signed-off-by: Lyndon-Li <lyonghui@vmware.com>	2026-08-31 16:19:49 +08:00
5 people	b521c555cd	1.18: #9795: Skip DeleteSnapshot when ProviderSnapshotID is empty (#10381) ... * Skip DeleteSnapshot when ProviderSnapshotID is empty When CreateSnapshot fails (e.g. quota limit), the snapshot is recorded with an empty ProviderSnapshotID. During backup deletion, velero was calling DeleteSnapshot("") which produces unnecessary 404 API calls. Skip the DeleteSnapshot call when ProviderSnapshotID is empty and log a warning instead. Fixes #9429 Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> (cherry picked from commit f84c9766ca) Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> * Add new changelog entry for 10381-kaovilai Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Co-authored-by: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com>	2026-08-28 04:51:23 +00:00
6 people	ddbd646eb7	[Backport release-1.18] fix(restore_finalizer): bound WaitRestoreExecHook poll with resourceT… (#10394) ... * fix(restore_finalizer): bound WaitRestoreExecHook poll with resourceT… (#10280) * fix: reuse DefaultResourceTimeout from server config for hook wait Signed-off-by: Nitish Malang <71919457+nitishmalang@users.noreply.github.com> * Add changelog for PR 10280 Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> --------- Signed-off-by: Nitish Malang <71919457+nitishmalang@users.noreply.github.com> Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> (cherry picked from commit 1e26cf7ca0) * Rename 10280-nitishmalang to 10394-nitishmalang Signed-off-by: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com> --------- Signed-off-by: Nitish Malang <71919457+nitishmalang@users.noreply.github.com> Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> Signed-off-by: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com> Co-authored-by: Nitish Malang <71919457+nitishmalang@users.noreply.github.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> Co-authored-by: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com> Co-authored-by: Xun Jiang/Bruce Jiang <59276555+blackpiglet@users.noreply.github.com>	2026-08-28 02:50:27 +00:00
lyndon-liandGitHub	e2610c7860	Merge pull request #10392 from velero-io/backport-10370-to-release-1.18 ... [Backport release-1.18] fix log format string mismatches that produce wrong or mangled output	2026-08-28 10:05:45 +08:00
lyndon-liandGitHub	c205acd54b	Merge branch 'release-1.18' into backport-10370-to-release-1.18	2026-08-28 09:55:16 +08:00
lyndon-liandGitHub	438942cc55	Merge pull request #10420 from blackpiglet/jxun/fix_cves_for_1.18.3 ... Fix CVEs for 1.18.3	2026-08-28 09:48:24 +08:00
Xun Jiang	69dbce1fea	Delete Requeue from ctrl.Result, because Requeue is deprecated by controller-runtime. ... The change is used to address the linter issue after golangci-lint bump to v2.13.1. Requeue is replaced by RequeueAfter. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-27 17:50:52 +08:00
Xun JiangandCursor	32db614154	Bump base images and Go version to fix CVEs ... Bumps golang to 1.26.7 and paketobuildpacks/run-jammy-tiny to 0.2.165 to resolve OS and Go vulnerabilities reported by trivy image scan. Bump golangci-lint that supports Golang 1.26. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-27 17:32:43 +08:00
Xun JiangandCursor	2b8da49df1	Bump dependencies in restic patch to fix CVEs ... Bumps golang.org/x/net to v0.56.0, golang.org/x/text to v0.39.0, and google.golang.org/grpc to v1.82.1 in the restic patch file to resolve vulnerabilities reported by trivy image scan. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-27 14:47:00 +08:00
Xun JiangandCursor	79f6249110	Bump google.golang.org/grpc to v1.82.1 to fix CVE ... This fixes the GHSA-hrxh-6v49-42gf (gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities) found in google.golang.org/grpc v1.81.1. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-27 14:47:00 +08:00
Xun Jiang/Bruce JiangandGitHub	02dd30a900	Merge pull request #10348 from velero-io/copilot/backport-10342 ... 1.18: Backport #10342: Fix LoadAffinity mutation accumulating OS node selector terms	2026-08-27 11:26:24 +08:00
Xun Jiang/Bruce JiangandGitHub	cedd89afff	Merge branch 'release-1.18' into copilot/backport-10342	2026-08-27 11:16:11 +08:00
5 people	2b49e8e0ce	Validate kind node tags before adding to e2e test matrix (#10407) ... (cherry picked from commit 23a8cc64f6) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-26 13:16:55 -04:00
Tiger Kaovilai	3f4415d16f	Fix go.sum: restore checksum entries needed by go.mod ... `make verify-modules` (go mod tidy --diff / go.sum comparison) was failing: an earlier commit on this branch trimmed several go.sum entries (al.essio.dev/pkg/shellescape, cloud.google.com/go/logging, cloud.google.com/go/longrunning, cloud.google.com/go/trace, and others) that go.mod's dependency graph still requires. Running `go mod tidy` restores exactly those entries; go.mod itself is unchanged. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-26 10:25:08 -04:00
Tiger Kaovilai	46cd67c8a2	Add new changelog for unreleased updates ... Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-26 10:25:08 -04:00
3 people	cd5f8064a6	Apply remaining changes ... Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-26 10:25:08 -04:00
3 people	3e55988c56	Fix LoadAffinity mutation accumulating OS node selector terms (#10342) ... * Fix LoadAffinity mutation accumulating OS node selector terms The node-agent parses the loadAffinity configuration once at startup and keeps it in memory. GetLoadAffinityByStorageClass returned a pointer to one of the elements of that cached list rather than a copy, so the exposers, which append a kubernetes.io/os match expression to the returned affinity, were mutating the shared configuration. Every DataUpload or DataDownload appended another OS term, growing the data mover pod spec until it could eventually exceed the object size limit. Return a deep copy from GetLoadAffinityByStorageClass so that callers can safely modify the result. A shallow copy is not enough because the MatchExpressions slice header would still be shared with the source. Fixes #10341 Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> * Add changelog Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> --------- Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> (cherry picked from commit f27a4ad8c0) Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-26 10:25:08 -04:00
Joseph Antony VaikathandGitHub	8ee1cf0137	Merge pull request #10408 from Joeavaikath/cherry-pick/10402-release-1.18 ... chore(deps): bump golang.org/x libs to fix HIGH CVEs (x/mod, x/net, x/text) [release-1.18]	2026-08-25 22:24:29 -07:00
Joseph Antony VaikathandGitHub	793f4d62d6	Merge branch 'release-1.18' into cherry-pick/10402-release-1.18	2026-08-25 21:55:38 -07:00
lyndon-liandGitHub	ba3d50ff7a	Merge pull request #10405 from Joeavaikath/backport-10397-release-1.18 ... [Backport release-1.18] Fix node agent readiness check issue	2026-08-26 09:06:31 +08:00
Joseph	e21fd918c4	chore(deps): bump golang.org/x libs to fix CVEs (release-1.18) ... Cherry-pick of velero-io/velero#10402 adapted for release-1.18. Fixes: - CVE-2026-56864, CVE-2026-56865: golang.org/x/mod v0.36.0 → v0.40.0 - CVE-2026-46600: golang.org/x/net v0.55.0 → v0.58.0 - CVE-2026-56852: golang.org/x/text v0.38.0 → v0.41.0 Transitive golang.org/x dependencies (crypto, sync, sys, term, tools) updated accordingly to satisfy version constraints. Signed-off-by: Joseph <jvaikath@redhat.com>	2026-08-25 17:23:16 -07:00
Lyndon-LiandJoseph	a171687dd7	fix node agent rediness check issue ... Signed-off-by: Lyndon-Li <lyonghui@vmware.com>	2026-08-25 16:07:41 -07:00
5 people	7770a0884e	[cherry-pick release-1.18] Fast-fail backup when built-in data mover has no running node-agent (#10360) ... * Fast-fail backup when built-in data mover has no running node-agent Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Joseph <jvaikath@redhat.com> Signed-off-by: Chai Bot <ship-help-github@redhat.com> * Run make update to fix import ordering Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Joseph <jvaikath@redhat.com> Signed-off-by: Chai Bot <ship-help-github@redhat.com> * Create new changelog for release 10360 Signed-off-by: Chai Bot <ship-help-github@redhat.com> --------- Signed-off-by: Joseph <jvaikath@redhat.com> Signed-off-by: Chai Bot <ship-help-github@redhat.com> Co-authored-by: Joseph <jvaikath@redhat.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>	2026-08-25 22:52:02 +00:00
Tiger Kaovilai	827c6e3bcd	Create changelog entry for release 10392-samay43 ... Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-25 15:39:53 -04:00
R4mboandTiger Kaovilai	3cd1a6947e	fix log format string mismatches that produce wrong or mangled output (#10370) ... * fix log format string mismatches that produce wrong or mangled output Signed-off-by: samay43 <samayrbhat43@gmail.com> * add changelog entry Signed-off-by: samay43 <samayrbhat43@gmail.com> --------- Signed-off-by: samay43 <samayrbhat43@gmail.com> (cherry picked from commit d374854b0e) (cherry picked from commit 8142ab5df4) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Signed-off-by: R4mbo <samayrbhat43@gmail.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-25 15:39:50 -04:00
Xun Jiang/Bruce JiangandGitHub	882d409195	Merge pull request #10396 from blackpiglet/jxun/1.18_resolve_duplicate_initCotainer_name ... [cherry-pick][1.18] Avoid duplicated InitContainer names generated in velero install CLI.	2026-08-25 17:18:30 +08:00
Xun JiangandXun Jiang/Bruce Jiang	651e740977	Avoid duplicated InitContainer names generated in velero install CLI. ... Add random string at the end when there is name collision detected. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-25 17:05:33 +08:00
3 people	ec1a1d7d18	Avoid io.ReadAll in buildFinalTarball() (#10311) (#10387) ... This commit updates the func buildFinalTarball so it won't use io.ReadAll, in order to optimize memory usage. (cherry picked from commit 763f3a1db4) Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com> Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>	2026-08-24 19:30:44 +00:00
lyndon-liandGitHub	b6c763badf	Merge pull request #10377 from Lyndon-Li/release-1.18 ... [1.18] Fix repo connection contest	2026-08-24 21:52:51 +08:00
lyndon-liandGitHub	27453d2dc5	Merge branch 'release-1.18' into release-1.18	2026-08-24 21:37:07 +08:00
3 people	301ed14dbd	Fix e2e kind matrix misparsing pre-release node tags (#10359) (#10378) ... * Fix e2e kind matrix misparsing pre-release node tags The setup-test-matrix step excluded "alpha|beta" pre-release tags but not "rc" ones. A tag like v1.37.0-rc.1 slipped through to the awk field-splitter, which treats "." as the only separator: splitting "v1.37.0-rc.1" yields ["v1","37","0-rc","1"], and printing $1"."$2"."$NF produced the bogus version "v1.37.1" - an image that was never published, since the real tag is v1.37.0-rc.1. Replace the two greps with a single anchored pattern that only matches well-formed vX.Y.Z tags, so any hyphenated pre-release suffix (rc, alpha, beta, or otherwise) is excluded before reaching the awk step. Fixes #10358 AI-Tool-Used: Claude Code AI-Tool-Use-Level: Category 2 (Medium) AI-Code-Category: Category 2 (Non-Production) --------- Signed-off-by: lubronzhan <lubron.zhan@broadcom.com> Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> Co-authored-by: Lubron <lubron.zhan@broadcom.com>	2026-08-24 20:34:19 +08:00
Lyndon-Li	61a4cdd09c	fix repo connection contest of the two repositories with the same storage type ... - fix repo connection contest between two BSL - add UT for repo connection contest Signed-off-by: Lyndon-Li <lyonghui@vmware.com>	2026-08-24 17:35:01 +08:00
Chlins ZhangandGitHub	25a2a449cb	Only sync finished backups from object storage (#10347) ... Backup metadata with an empty or New phase was synced into the cluster as a pending backup, which the queue controller then ran as if it were newly requested. Hooks are dropped as well, since a synced backup never executes them. Signed-off-by: chlins <chlins.zhang@gmail.com>	2026-08-20 07:57:16 -04:00
lyndon-liandGitHub	cda5aab24d	Merge pull request #10335 from shubham-pampattiwar/cherry-pick/9920-release-1.18 ... [release-1.18] Support copying namespace-scoped secrets/configmaps for backup and restore PVC provisioning	2026-08-20 14:04:01 +08:00
Shubham Pampattiwar	7922bb33c2	Support copying namespace-scoped secrets/configmaps for backup and restore PVC provisioning ... Backport of #9920 to release-1.18. Enables datamover backup/restore of CSI volumes that require namespace-scoped secrets/configmaps for provisioning (e.g., ODF/ceph-csi encrypted volumes with Vault KMS). Adds secretNames/configMapNames to the backupPVC/restorePVC node-agent config; the CSI snapshot and generic restore exposers copy the named resources from the source/target namespace to the Velero namespace before creating the intermediate PVC, and clean them up afterward (labeled with the owner UID). Adds the corresponding RBAC for secrets/configmaps. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>	2026-08-19 09:14:51 -07:00
Xun Jiang/Bruce JiangandGitHub	ffe6cffe37	Merge pull request #10319 from blackpiglet/jxun/1.18_remove_pvc_pv_check_for_pvr_creation ... [cherry-pick][1.18] Remove PVC and PV inclusion check during creating PVR.	2026-08-18 15:40:00 +08:00
Xun Jiang	3872b039bb	Remove PVC and PV inclusion check during creating PVR. ... Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-08-18 15:18:11 +08:00
lyndon-liandGitHub	2454335c80	Merge pull request #10263 from velero-io/copilot/backport-10250 ... [release-1.18] Backport #10250: Fix pod volume restore deadlock	2026-08-14 15:45:34 +08:00
Tiger KaovilaiandGitHub	d469d81125	Add changelog for release 10263 ... Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-13 12:31:57 -04:00
3 people	636be631a4	Backport #10250: fix pvr deadlock ... Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com>	2026-08-13 16:25:26 +00:00
5 people	843a3b4696	Backport typo fixes from #10192 (#10222) ... Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-11 16:58:53 +00:00
5 people	4e19118e04	1.18: Backport #10047: Fix restore-wait init container ignoring pod-level securityContext (#10224) ... * Backport #10047: fix restore-wait init container ignoring pod-level securityContext Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> * Add changelog for release 10224-kaovilai Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com>	2026-08-11 16:32:14 +08:00
Adam ZhangandGitHub	e413227009	Merge pull request #10164 from adam-jian-zhang/restore-filters-guide-for-1.18 ... [Cherry-Pick]add documentation for fine-grained restore filters	2026-08-05 16:40:06 +08:00
Adam Zhang	101496d5a3	add documentation for fine-grained restore filters ... Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>	2026-08-05 14:40:47 +08:00