* Validate user-provided labels and annotations in maintenance job
User-provided labels and annotations from maintenance JobConfigs
are now validated before being applied to the maintenance Job pod
template. Invalid label keys, label values, and annotation keys
are skipped with a warning log. This prevents the Kubernetes API
from rejecting the entire Job when a user provides labels or
annotations that violate naming rules.
Additionally, user-provided labels can no longer overwrite the
internal RepositoryNameLabel used for job tracking.
Fixes velero-io/velero#9981
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add tests for label and annotation validation in maintenance job
Add test cases to TestBuildJob covering:
- Invalid label key is skipped
- Invalid label value is skipped
- Label value exceeding 63 characters is skipped
- User-provided label cannot overwrite RepositoryNameLabel
- Invalid annotation key is skipped
Also fix a latent test issue where param.BackupRepo was not reset
between test cases, and add the missing assertion for
expectedPodAnnotation which was defined but never checked.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt formatting in maintenance test file
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #9982
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Added CLI for creating restore resource policies, and view
the resource policies associated with resource if present.
Only list the name of the configmap for now.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
The Kubernetes image volume type (GA in k8s 1.31) was not recognized by
Velero's volume type detection logic, causing volume policies with
volumeTypes condition set to "image" to be silently ignored. This led
to failed fs-backups when defaultVolumesToFsBackup was enabled, since
image volumes have no host path for the node agent to back up.
Add the "image" SupportedVolume constant and detection in
getVolumeTypeFromVolume() so that volume policies can properly match
and skip image volumes.
Fixesvelero-io/velero#9977
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add change-id and volume-id retrieve logic for both vks and vanilla k8s environment.
* Add change-id and volume-id support code in exposer.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
For resource policy in restore, it will reject invalid sections
such as volumePolicies or includeExcludePolicy, to prevent user
from misuse backup side resource policy configmap.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Add resourcePolicy field for restore CRD which is backed by
a configmap that holds ClusterScopedFilterPolicy and
NamespacedFilterPolicies for restore side filtering.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Fixes a flaky test in TestWaitExecHandleHooks:
"should return no error with 2 spec hooks in 2 different containers,
1st container starts running after 10ms, 2nd container after 20ms,
both succeed"
Observed failure (CI run https://github.com/velero-io/velero/actions/runs/28119573625/job/83267758421):
mock: Unexpected Method Call
ExecutePodCommand called with resourceVersion:"3" (both containers running),
but mock was registered expecting resourceVersion:"2" (container1 running,
container2 still waiting).
Root cause: the two source.Modify calls were 10ms apart. The informer's
DeltaFIFO queue can coalesce rapid updates, delivering only the latest pod
state (resourceVersion:3) to the handler before the hook for container1 fires.
The comment "each of these states will be seen by the UpdateFunc handler" was
incorrect — intermediate states can be silently skipped under load.
Fix: add waitForSignal chan struct{} to the change struct and onCalled func()
to the expectedExecution struct. The goroutine now blocks after sending the
first change until the mock signals that the hook has fired (via close), then
sends the second change. This guarantees the handler observes the intermediate
pod state (resourceVersion:2) when executing container1's hook.
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extract pkg/apis into a standalone Go module with its own go.mod/go.sum,
and wire it back into the main module via a local replace directive.
Signed-off-by: Lubron Zhan <lubronzhan@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Shubham PampattiwarandGitHub
Xun Jiang/Bruce JiangandGitHub
lyndon-liandGitHub
Adam ZhangandGitHub
Wenkai Yin(尹文开)andGitHub
Lyndon-Li
Chlins ZhangandGitHub
dependabot[bot]andGitHub
copilot-swe-agent[bot]andGitHub
Scott Seagoandaider
Xun Jiang
Lubron ZhanandClaude Sonnet 4.6