`make verify-modules` (go mod tidy --diff / go.sum comparison) was
failing: an earlier commit on this branch trimmed several go.sum
entries (al.essio.dev/pkg/shellescape, cloud.google.com/go/logging,
cloud.google.com/go/longrunning, cloud.google.com/go/trace, and
others) that go.mod's dependency graph still requires. Running
`go mod tidy` restores exactly those entries; go.mod itself is
unchanged.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
* Fix LoadAffinity mutation accumulating OS node selector terms
The node-agent parses the loadAffinity configuration once at startup and
keeps it in memory. GetLoadAffinityByStorageClass returned a pointer to one
of the elements of that cached list rather than a copy, so the exposers,
which append a kubernetes.io/os match expression to the returned affinity,
were mutating the shared configuration. Every DataUpload or DataDownload
appended another OS term, growing the data mover pod spec until it could
eventually exceed the object size limit.
Return a deep copy from GetLoadAffinityByStorageClass so that callers can
safely modify the result. A shallow copy is not enough because the
MatchExpressions slice header would still be shared with the source.
Fixes#10341
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
(cherry picked from commit f27a4ad8c0)
Co-authored-by: kaovilai <11228024+kaovilai@users.noreply.github.com>
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
This commit updates the func buildFinalTarball so it won't use
io.ReadAll, in order to optimize memory usage.
(cherry picked from commit 763f3a1db4)
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>
* Fix e2e kind matrix misparsing pre-release node tags
The setup-test-matrix step excluded "alpha|beta" pre-release tags but
not "rc" ones. A tag like v1.37.0-rc.1 slipped through to the awk
field-splitter, which treats "." as the only separator: splitting
"v1.37.0-rc.1" yields ["v1","37","0-rc","1"], and printing
$1"."$2"."$NF produced the bogus version "v1.37.1" - an image that
was never published, since the real tag is v1.37.0-rc.1.
Replace the two greps with a single anchored pattern that only
matches well-formed vX.Y.Z tags, so any hyphenated pre-release
suffix (rc, alpha, beta, or otherwise) is excluded before reaching
the awk step.
Fixes#10358
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 2 (Medium)
AI-Code-Category: Category 2 (Non-Production)
---------
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Co-authored-by: Lubron <lubron.zhan@broadcom.com>
Backup metadata with an empty or New phase was synced into the cluster as a pending backup, which the queue controller then ran as if it were newly requested. Hooks are dropped as well, since a synced backup never executes them.
Signed-off-by: chlins <chlins.zhang@gmail.com>
Backport of #9920 to release-1.18.
Enables datamover backup/restore of CSI volumes that require
namespace-scoped secrets/configmaps for provisioning (e.g., ODF/ceph-csi
encrypted volumes with Vault KMS). Adds secretNames/configMapNames to the
backupPVC/restorePVC node-agent config; the CSI snapshot and generic
restore exposers copy the named resources from the source/target
namespace to the Velero namespace before creating the intermediate PVC,
and clean them up afterward (labeled with the owner UID). Adds the
corresponding RBAC for secrets/configmaps.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* design for RIA must-include-additional-items
Design for `restore.velero.io/must-include-additional-items` annotation
and its usage and interaction with existing filtering mechanism.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
(cherry picked from commit ac76402aa0)
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Add RIA must-include additional items (#10082)
Let RestoreItemActions opt in via annotation to
bypass global restore filters for AdditionalItems,
mirroring the backup-side must-include behavior.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
(cherry picked from commit a43a1bce6a)
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* update v1.18 custom-plugins docs for RIA must-include additional items
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* remove VolumeSnapshotContents from resourceMustHave list
Stop force-including VolumeSnapshotContents via resourceMustHave on
every restore; CSI VolumeSnapshot/PVC RestoreItemActions now set
`restore.velero.io/must-include-additional-items` so bound snapshot
dependencies are restored only when their parent is restored.
Fixes: #9957
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
(cherry picked from commit ef100da89b)
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* add tests to cover pvc and vsc ria
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
(cherry picked from commit 63cfddd18d)
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* fix change logs
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* add documentation for backup filters (#9967)
* add documentation for backup filters
Add user guide for fine grained backup filters with examples
from easy to advanced.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address review comments
- enhanced example 3, explain how each item got excluded
- enhanced example 8, explain the exact match rule, and how the
ordering affecting namespace that has multiple match patterns
- cross link to restore side design
- fix the error msg to be consistent with implemenation
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* update backup filters example 14
update the excludeNames to match example 3 for better consistency.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Support set-based filter label selectors (#10064)
* Support set-based filter label selectors
Use matchLabels/matchExpressions in fine-grained filters.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* omit the details of resource policy for cli
The reason to not resolve and display CLI is because it may go
out of sync, we want to avoid display it to mislead users.
We may consider to cpature those information and display it
in later release.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* update change log
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Prioritize exact namespace match in restore
Align restore pipeline with backup pipeline by
evaluating exact namespace matches before glob
patterns in namespacedFilterPolicies. This ensures
specific overrides always win regardless of list
order.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* improve test cases
add test cases for exact listed first, and excat listed last to
ensure the behavior that the order does not matter for exact
listed namespace, the rule will be always honored.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Added CLI for creating restore resource policies, and view
the resource policies associated with resource if present.
Only list the name of the configmap for now.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* restore filter enhancement
enhance restore filter with resource policies, introduce resource
policies with fine-grained control for resources in restore, both
cluster scoped resources and namespace scoped resources, with
labels, names include/exclude support with glob patterns.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address review comments
- Add introductory sentence linking to the Phase 1 backup filters PR.
- Add clarification that a backup's ConfigMap may not exist on the
target cluster because it might be on a different Velero instance.
- Remove redundant explanations about backup-specific concepts
(volume policies, include/exclude policies).
- Remove the non-goal regarding restore-side `includeExcludePolicy`.
- Remove the "Interaction with Backup-Side Filters" section.
- Remove "Step 5" from the design, as additional items requested by
plugins should intentionally bypass fine-grained filter checks
(consistent with backup side Stage 2).
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* address more review comments
- remove confusion rows regarding per-namespace kind list
- simplified CLI output to configmap name only
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---------
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
Xun Jiang/Bruce JiangandGitHub
Joseph Antony VaikathandGitHub
lyndon-liandGitHub
Lyndon-LiandJoseph
Xun JiangandXun Jiang/Bruce Jiang
Chlins ZhangandGitHub
Adam ZhangandGitHub