* Fix backup queue permanently stuck when a dequeued backup completes during the patch
Motivation: backupQueueReconciler patched a dequeued backup to ReadyToStart and
only called backupTracker.AddReadyToStart on the next line. If backupReconciler
picked up that patch and completed the backup (e.g. immediate FailedValidation
while a BackupStorageLocation is briefly unavailable) before the queue
controller reached that line, backupReconciler's Add + deferred Delete ran
first, and the later AddReadyToStart re-inserted a tracker key nothing would
ever delete again. backupTracker is in-memory and never reconciled against
actual Backup phases, so RunningCount() stayed stuck at concurrentBackups and
every later reconcile, including the periodic recheck, was refused at that
gate -- the queue stopped dequeuing permanently until the deployment restarted.
Approach: record the backup as ReadyToStart in the tracker before patching it,
and roll that back if the patch itself fails, so the tracker entry always
exists before the backup can become visible to any other reconciler. Also
folds in two related fixes: the concurrency-refusal log line is now Info
instead of Debug so a stuck queue is visible at the default log level, and the
queue-position renumbering loop's error log (which built a logrus.Entry via
log.WithError(errors.Wrapf(...)) but never called a terminal method on it, so
it never actually logged anything) now emits properly.
Validation: go build ./pkg/controller/..., go vet ./pkg/controller/..., and
gofmt -l on both changed files are all clean. golangci-lint run
./pkg/controller/... reports no findings. go mod tidy produces a zero diff to
go.mod/go.sum, matching this repo's verify-modules check. Mirrored this repo's
own hack/test.sh invocation for this package (-short -vet=... -skip TestAPIs)
and it passes; TestAPIs is a separate envtest suite that needs a local
kubebuilder etcd binary not installed on this machine and fails identically on
an unmodified checkout, so it is a pre-existing environment gap, not a
regression. Added TestBackupQueueReconcilerTrackerNotLeakedWhenBackupCompletesDuringPatch,
which uses a controller-runtime fake client with a Patch interceptor to
simulate a racing reconciler completing the backup right after the
ReadyToStart patch lands; it fails (RunningCount leaks to 1) against the
pre-fix ordering and passes (RunningCount returns to 0) against the fix.
Report: https://github.com/velero-io/velero/issues/10519
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5 (via Claude Code)
* Add changelog file for PR #10521
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
* Add test covering tracker rollback when ReadyToStart patch fails
Addresses review comment: verify backupTracker.RunningCount() returns
to 0 when the ReadyToStart patch itself errors, covering the Delete
rollback path alongside the existing race-condition regression test.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
---------
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com>
(cherry picked from commit 473f7529e1)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Bump Golang to latest 1.26: v1.26.8
Bump google.golang.org/grpc to v1.83.1 to fix CVE-2026-84304 for both Velero and Restic
Bump golang.org/x/crypto to v0.56.0 to fix CVE-2026-56854, CVE-2026-56855, and CVE-2026-78662 for both Velero and Restic.
Modify the restic build script to allow verification on local dev environment.
Ignore spell check for the restic patch file.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Prefix raw err.Error() strings surfaced in CR statuses and CLI stderr with the failed operation.
Signed-off-by: chlins <chlins.zhang@gmail.com>
(cherry picked from commit e03ff894ff)
* Enforce resource filters on cluster-wide items
When backups query all namespaces (wildcard or omitted includes),
the item collector retrieved resources in bulk, bypassing
per-namespace resource filter policies in Stage 1 collection.
This caused resources not listed in the policy to be backed up.
To preserve cluster-wide query performance while enforcing policy
rules, evaluate namespace exclusions, resource kind allowlists,
and label selectors in memory for each collected item.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Optimize in-memory resource filter checks
Optimize per-item filter evaluation in the item collector:
- Precalculate GroupResource string once per resource type
- Skip filter policy evaluation when no namespaced policies exist
- Restrict in-memory filtering to cluster-wide queries
- Cache consecutive namespace lookups across collected items
- Lazily extract resource labels only when selectors are present
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
(cherry picked from commit 85c660612b)
The change is used to address the linter issue after golangci-lint bump to v2.13.1.
Requeue is replaced by RequeueAfter.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Bumps golang to 1.26.7 and paketobuildpacks/run-jammy-tiny to 0.2.165
to resolve OS and Go vulnerabilities reported by trivy image scan.
Bump golangci-lint that supports Golang 1.26.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Bumps golang.org/x/net to v0.56.0, golang.org/x/text to v0.39.0,
and google.golang.org/grpc to v1.82.1 in the restic patch file
to resolve vulnerabilities reported by trivy image scan.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
This fixes the GHSA-hrxh-6v49-42gf (gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities)
found in google.golang.org/grpc v1.81.1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
`make verify-modules` (go mod tidy --diff / go.sum comparison) was
failing: an earlier commit on this branch trimmed several go.sum
entries (al.essio.dev/pkg/shellescape, cloud.google.com/go/logging,
cloud.google.com/go/longrunning, cloud.google.com/go/trace, and
others) that go.mod's dependency graph still requires. Running
`go mod tidy` restores exactly those entries; go.mod itself is
unchanged.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
* Fix LoadAffinity mutation accumulating OS node selector terms
The node-agent parses the loadAffinity configuration once at startup and
keeps it in memory. GetLoadAffinityByStorageClass returned a pointer to one
of the elements of that cached list rather than a copy, so the exposers,
which append a kubernetes.io/os match expression to the returned affinity,
were mutating the shared configuration. Every DataUpload or DataDownload
appended another OS term, growing the data mover pod spec until it could
eventually exceed the object size limit.
Return a deep copy from GetLoadAffinityByStorageClass so that callers can
safely modify the result. A shallow copy is not enough because the
MatchExpressions slice header would still be shared with the source.
Fixes#10341
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
(cherry picked from commit f27a4ad8c0)
Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com>
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
This commit updates the func buildFinalTarball so it won't use
io.ReadAll, in order to optimize memory usage.
(cherry picked from commit 763f3a1db4)
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>
* Fix e2e kind matrix misparsing pre-release node tags
The setup-test-matrix step excluded "alpha|beta" pre-release tags but
not "rc" ones. A tag like v1.37.0-rc.1 slipped through to the awk
field-splitter, which treats "." as the only separator: splitting
"v1.37.0-rc.1" yields ["v1","37","0-rc","1"], and printing
$1"."$2"."$NF produced the bogus version "v1.37.1" - an image that
was never published, since the real tag is v1.37.0-rc.1.
Replace the two greps with a single anchored pattern that only
matches well-formed vX.Y.Z tags, so any hyphenated pre-release
suffix (rc, alpha, beta, or otherwise) is excluded before reaching
the awk step.
Fixes#10358
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 2 (Medium)
AI-Code-Category: Category 2 (Non-Production)
---------
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Co-authored-by: Lubron <lubron.zhan@broadcom.com>
Backup metadata with an empty or New phase was synced into the cluster as a pending backup, which the queue controller then ran as if it were newly requested. Hooks are dropped as well, since a synced backup never executes them.
Signed-off-by: chlins <chlins.zhang@gmail.com>
Backport of #9920 to release-1.18.
Enables datamover backup/restore of CSI volumes that require
namespace-scoped secrets/configmaps for provisioning (e.g., ODF/ceph-csi
encrypted volumes with Vault KMS). Adds secretNames/configMapNames to the
backupPVC/restorePVC node-agent config; the CSI snapshot and generic
restore exposers copy the named resources from the source/target
namespace to the Velero namespace before creating the intermediate PVC,
and clean them up afterward (labeled with the owner UID). Adds the
corresponding RBAC for secrets/configmaps.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
github-actions[bot]
Pujitha Paladuguandgithub-actions[bot]
lyndon-liandGitHub
Yonghui Li
Xun Jiang/Bruce JiangandGitHub
Chlins ZhangandGitHub
Adam Zhang
Xun Jiang
Joseph Antony VaikathandGitHub
R4mboandTiger Kaovilai
