* Validate user-provided labels and annotations in maintenance job
User-provided labels and annotations from maintenance JobConfigs
are now validated before being applied to the maintenance Job pod
template. Invalid label keys, label values, and annotation keys
are skipped with a warning log. This prevents the Kubernetes API
from rejecting the entire Job when a user provides labels or
annotations that violate naming rules.
Additionally, user-provided labels can no longer overwrite the
internal RepositoryNameLabel used for job tracking.
Fixes velero-io/velero#9981
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add tests for label and annotation validation in maintenance job
Add test cases to TestBuildJob covering:
- Invalid label key is skipped
- Invalid label value is skipped
- Label value exceeding 63 characters is skipped
- User-provided label cannot overwrite RepositoryNameLabel
- Invalid annotation key is skipped
Also fix a latent test issue where param.BackupRepo was not reset
between test cases, and add the missing assertion for
expectedPodAnnotation which was defined but never checked.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt formatting in maintenance test file
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #9982
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Added CLI for creating restore resource policies, and view
the resource policies associated with resource if present.
Only list the name of the configmap for now.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
- normalized the input to lower case for consistency
- added validations for kind collision
- add flag for unresolved kinds, and defer skip decision base on that
- move peek-and-map test cases to restore_policies_test.go
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
The Kubernetes image volume type (GA in k8s 1.31) was not recognized by
Velero's volume type detection logic, causing volume policies with
volumeTypes condition set to "image" to be silently ignored. This led
to failed fs-backups when defaultVolumesToFsBackup was enabled, since
image volumes have no host path for the node agent to back up.
Add the "image" SupportedVolume constant and detection in
getVolumeTypeFromVolume() so that volume policies can properly match
and skip image volumes.
Fixesvelero-io/velero#9977
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
When a user specifies a Custom Resource Kind in a restore filter
policy (e.g., kinds: [MyCustomKind]), the discovery helper fails
to resolve it if the CRD hasn't been restored yet.
This adds a peek-and-map fallback: if a resource type in the
backup tarball doesn't match the resolved filters, Velero peeks
at the actual Kind of the first item in the tarball and matches
it against the user's original policy strings.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Add change-id and volume-id retrieve logic for both vks and vanilla k8s environment.
* Add change-id and volume-id support code in exposer.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
restore filters via resource policy, support ClusterScopedFilterPolicy
and NamespaceFilterPolicies.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
For resource policy in restore, it will reject invalid sections
such as volumePolicies or includeExcludePolicy, to prevent user
from misuse backup side resource policy configmap.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Add resourcePolicy field for restore CRD which is backed by
a configmap that holds ClusterScopedFilterPolicy and
NamespacedFilterPolicies for restore side filtering.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Xun Jiang/Bruce Jiang
Adam Zhang
Shubham Pampattiwar
lyndon-li
Wenkai Yin(尹文开)
Lyndon-Li
Chlins Zhang
dependabot[bot]
copilot-swe-agent[bot]
Scott Seago
Xun Jiang