* Issue #3194: Add velero client set-context-as-velero-namespace command
Saves the namespace of the current (or a specified) kubeconfig context
into the Velero client config file, so operational commands default to
it without requiring --namespace on every invocation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
* Fix CI: rename changelog to PR number, add unit tests for coverage
- changelogs/unreleased must be named <pr-number>-<username>; rename
from the 0000 placeholder to 10127 to satisfy hack/changelog-check.sh.
- Extract the command's logic into setContextAsVeleroNamespace so it's
testable without triggering os.Exit via cmd.CheckError, and add unit
tests covering: namespace read from context, context with no explicit
namespace, overwriting an existing config value, and invalid
kubeconfig path. Addresses 0% codecov patch coverage on the PR.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
* Move set-namespace-from-context under client config
Shubham suggested nesting the new command under `config` for
hierarchy consistency, and renaming it since the original
set-context-as-velero-namespace name was long and ambiguous. Moves
it to `velero client config set-namespace-from-context`, matching
the existing config get/set subcommands and my follow-up naming
suggestion on the review thread.
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 3 (Low)
AI-Code-Category: Category 1 (Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
* Replace set-namespace-from-context with namespace-mode=auto
kaovilai noted on #10127 that a one-shot command to snapshot the
kubecontext namespace becomes redundant once a config toggle can
resolve it dynamically, and isn't much simpler than the existing
`config set namespace=...` alternative.
Drop the dedicated set-namespace-from-context subcommand and instead
teach the client Factory to resolve the operational namespace from the
current kubeconfig context on every invocation when
`namespace-mode=auto` is set via the existing generic
`config set` command. Explicit --namespace flags and VELERO_NAMESPACE
still take precedence, so the new mode only changes behavior when
neither is set.
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 2 (Medium)
AI-Code-Category: Category 1 (Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
* Address PR review: doc, fallback test, t.Setenv
Resolve feedback from PR #10127 review 4966054980:
- Document how to disable namespace-mode=auto (namespace-mode=)
and note the fallback to the static namespace, in namespace.md.
- Add a factory test covering the fallback to the stored/default
namespace when kubeconfig namespace resolution fails.
- Switch the VELERO_NAMESPACE override test to t.Setenv, wrapped
in a subtest so its cleanup runs before later tests execute.
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 2 (Medium)
AI-Code-Category: Category 2 (Non-Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
---------
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Add readWriteOncePod backupPVC config to enable mount-level SELinux labeling
On SELinux-enabled clusters the kubelet recursively relabels every file of
the backupPVC at mount time, which can take hours on volumes with a high
file count. Kubernetes avoids this when the volume is ReadWriteOncePod and
the CSI driver advertises SELinux mount support, by mounting with
-o context= instead.
Add an opt-in per-storage-class 'readWriteOncePod' backupPVC config option
that creates the backupPVC with the ReadWriteOncePod access mode and sets
the backup pod's SecurityContext.SELinuxChangePolicy to MountOption. It is
mutually exclusive with 'readOnly', which takes precedence.
Fixes#9873
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog file
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Do not set SELinuxChangePolicy for the backup pod
Live testing on OCP 4.22 (k8s 1.35) showed that setting
SecurityContext.SELinuxChangePolicy to MountOption makes backup pod
creation fail outright when the SELinuxMount feature gate is disabled,
which is the default on current clusters:
Pod is invalid: spec.securityContext.seLinuxChangePolicy:
Unsupported value: "MountOption": supported values: "Recursive"
The field is also unnecessary. For ReadWriteOncePod volumes the kubelet
already performs mount-level SELinux labeling via the
SELinuxMountReadWriteOncePod feature gate, which has been on by default
since k8s 1.28. Setting the backupPVC access mode to ReadWriteOncePod is
sufficient on its own, and is portable to clusters where the broader
SELinuxMount gate is still off.
Verified on-cluster that the backupPVC is mounted with
context="system_u:object_r:container_file_t:s0:c22,c28" instead of the
recursive seclabel mount used without the flag.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Document the new backupPVC/restorePVC secretNames and configMapNames
options (velero#9920) that copy namespace-scoped secrets/configmaps to
the Velero namespace so datamover can back up and restore encrypted CSI
volumes (e.g. ODF/ceph-csi with Vault KMS). Updates the main and v1.18
docs.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* site: add conference talks to resources page and LinkedIn to community page
Add a Conference Talks section to the resources page with Velero-related
talks from KubeCon EU 2026, KubeCon India 2026, KubeCon China 2024,
KubeCon EU 2023, and DevConf.IN 2025. Includes YouTube embeds where
recordings are available and sched.com links for all talks.
Add LinkedIn page link to the community page alongside existing
Twitter and Slack links.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* site: add Open Source Summit NA 2022 Velero talk to resources
Add the Velero talk by Orlin Vasilev and Scott Seago from
Open Source Summit North America 2022 with YouTube embed
and sched.com link.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
troubleshooting.md covers SignatureDoesNotMatch but not the other way a
log or results download fails: the pre-signed URL carries the s3Url host,
which for an in-cluster Service name does not resolve on the client.
The backup or restore itself is unaffected, which makes the error easy to
misread. The fix, publicUrl, is documented only under exposing Minio, so
this links there instead of duplicating it.
Signed-off-by: saral <ilovegojo2580@gmail.com>
The list of commands supporting --insecure-skip-tls-verify referred to
`velero restore log`, but the registered command is `velero restore logs`
(pkg/cmd/cli/restore/logs.go). `velero restore log` silently falls through
to the parent command's help text and exits 0, so a user following the docs
gets no logs and no error.
Fixes#10183
Signed-off-by: Harshit saini <harshitsaini1188@gmail.com>
Register cobra completion callbacks for all commands that accept
existing Velero resource names. A centralized completeNames helper
uses apimachinery's meta.ExtractList/Accessor to list resources with
a 3-second timeout, filter by prefix, and deduplicate already-typed
arguments. Wires ValidArgsFunction on 20 commands and
RegisterFlagCompletionFunc on 9 flags across backup, restore,
schedule, backuplocation, snapshotlocation, repo, and debug.
Closes#9782
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Joseph <jvaikath@redhat.com>
* Add SnapshotClassParameter constant and GetSnapshotClass getter
Add a new snapshotClass action parameter to volume policies, allowing
users to specify which VolumeSnapshotClass to use for CSI snapshots.
This follows the existing dataMover parameter pattern with a typed
constant and getter method on the Action struct.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add snapshotClass parameter validation
Validate the snapshotClass parameter in Action.validate(): it must only
appear on snapshot actions, must be a string, and must not be empty.
Follows the same validation pattern as the dataMover parameter.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add volume policy tier to VolumeSnapshotClass selection
Add GetVolumeSnapshotClassFromVolumePolicy helper and extend
GetVolumeSnapshotClass with a policySnapshotClass parameter. The new
tier sits between PVC annotation and backup annotation in the priority
chain: PVC annotation > volume policy > backup annotation > VSC label.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Wire snapshotClass from volume policy through CSI plugin
In pvcBackupItemAction.Execute, call GetActionParameters to extract the
snapshotClass from the matched volume policy and pass it through
getVolumeSnapshotReference and createVolumeSnapshot to
GetVolumeSnapshotClass. This connects the volume policy parameter to
the CSI snapshot creation path.
Fixes#8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #10070
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Document snapshotClass volume policy parameter
Add documentation for the new snapshotClass parameter in the volume
policy snapshot action. Update the CSI docs to include volume policy
as a tier in the VolumeSnapshotClass selection priority, and add
Example 6 to resource-filtering.md showing multi-array usage.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix import ordering in pvc_action.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add end-to-end test for snapshotClass volume policy parameter
Verify that when a volume policy specifies snapshotClass, the CSI
plugin creates a VolumeSnapshot using that VolumeSnapshotClass. The
test uses a VSC without the velero label to confirm selection comes
from the volume policy parameter, not the label-based fallback.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt struct field alignment in pvc_action_test.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add GetSnapshotClass to VolumeHelper interface
Add a GetSnapshotClass method to VolumeHelper that encapsulates the
extraction of the snapshotClass parameter from volume policy actions.
This avoids requiring callers to parse raw parameters from
GetActionParameters. Simplify the CSI plugin to use the new method.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt formatting in resource_policies.go
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add release blog posts for v1.17 (Sep 2025) and v1.18 (Mar 2026)
covering major features, breaking changes, and community contributions.
v1.17 highlights: VolumeGroupSnapshot support, modernized fs-backup,
Windows cluster support, priority class support.
v1.18 highlights: concurrent backup processing, cache volume support
for data movers, incremental backup size reporting, VolumePolicy
enhancements.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- Add Default Resource Modifiers section to restore-resource-modifiers.md
- Add --default-resource-modifier-configmap to customize-installation.md
- Add examples/default-resource-modifier-cni.yaml with CNI annotation
stripping rules for OVN-K and Multus
- Update restore describer to show SkipDefaultResourceModifier when set
- Log warning when ResourceModifier Kind is not ConfigMap instead of
silently doing nothing
- Add deployment_test.go coverage for the new server flag
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
- update resource-filtering to incorporate fine-grained filters
- update backward compatibility parts to focus on this feature itself
- update example 3 to be more percise
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
- update example 14 to be an validation error case when user tried to
reuse backup side resource policies which contains fields not accepted
by restore side
- enhance example 8 with exact match on namespace
- update the validation errors to match implementation
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Announce Velero's acceptance into the CNCF Sandbox, covering the
governance change, project history, current maintainers, and how
to get involved. This is the first blog post since v1.11 in 2023.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* site: update homepage CTA and add LinkedIn to footer
Replace stale 'How Do You Use Velero?' link (GitHub issue #1327 from 2019)
with 'Join the Velero Community' pointing to the community page.
Add the new Velero LinkedIn page to the footer social links.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* site: fix invisible CNCF logo in footer
The footer uses a white background but the CNCF logo was a white SVG
(cncf-white.svg), making it invisible. Switch to the color version
from the CNCF artwork repository.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Support overriding Schedule annotations via template.metadata.annotations
Adds an Annotations field to BackupSpec.Metadata, mirroring the existing
Labels override. When Schedule.Spec.Template.Metadata.Annotations is set,
it is used for the resulting Backup's annotations instead of copying
Schedule.Annotations directly, allowing users to opt out of unwanted
annotations (e.g. ArgoCD tracking annotations) being propagated from
Schedule to Backup.
Fixes#5836
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
* Rename changelog fragment to match PR number 10045
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
---------
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>
Let RestoreItemActions opt in via annotation to
bypass global restore filters for AdditionalItems,
mirroring the backup-side must-include behavior.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Update the landing page CTA link from the outdated Velero 1.11 blog
post to the GitHub releases/latest URL, which always resolves to the
most recent release and will not go stale.
Fixes#10080
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add documentation for the new snapshotClass parameter in the volume
policy snapshot action. Update the CSI docs to include volume policy
as a tier in the VolumeSnapshotClass selection priority, and add
Example 6 to resource-filtering.md showing multi-array usage.
Ref: #8807
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Support set-based filter label selectors
Use matchLabels/matchExpressions in fine-grained filters.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* omit the details of resource policy for cli
The reason to not resolve and display CLI is because it may go
out of sync, we want to avoid display it to mislead users.
We may consider to cpature those information and display it
in later release.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Co-authored-by: Scott Seago <sseago@redhat.com>
The Velero repositories have moved to the velero-io GitHub organization.
Update references in docs, GOVERNANCE.md, and SECURITY.md for repos
that have migrated (velero, plugin-for-aws, plugin-for-gcp,
plugin-for-microsoft-azure, plugin-for-example). References to repos
that have not moved (helm-charts, plugin-for-vsphere, plugin-for-csi)
are left unchanged.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* add documentation for backup filters
Add user guide for fine grained backup filters with examples
from easy to advanced.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address review comments
- enhanced example 3, explain how each item got excluded
- enhanced example 8, explain the exact match rule, and how the
ordering affecting namespace that has multiple match patterns
- cross link to restore side design
- fix the error msg to be consistent with implemenation
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Document that Velero 1.18.1+ requires external-snapshotter v8.2.0 or
later for VolumeGroupSnapshot support, since Velero upgraded from
v1beta1 to v1beta2 APIs.
Relates to #9882
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
This commit updates the doc to make the order of resources during
restore is consistent with the code.
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
Update the community page to add the correct links to community meeting
and meeting notes.
I also removed the referece of google group as I confirmed the last
message was sent 2 years ago.
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
Tiger KaovilaiandGitHub
Pierluigi Lenoci
Xun Jiang
Lyndon-Li
Tiger Kaovilai
Shubham PampattiwarandGitHub
lyndon-liandGitHub
RalthosandGitHub
Jay SawantandGitHub
harshit sainiandGitHub
UajjawalandGitHub
Adam ZhangandGitHub
James Hewitt
chlins
Subhramit BasuandGitHub
