Per review feedback, these workflows are useful on forks:
- e2e-test-kind: tests pass on downstream forks
- pr-linter-check: keeps lint up to date for upstream-bound features
- nightly-trivy-scan: wanted in downstream forks
Also remove changelog file per reviewer request.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add repository guard (github.repository == 'velero-io/velero') to
workflows that should only run on the upstream repo. This prevents
unnecessary CI runs on forks like openshift/velero where these
workflows either fail due to missing secrets/config or duplicate
fork-specific CI.
Guarded workflows: auto_assign_prs, auto_label_prs,
auto_request_review, e2e-test-kind, nightly-trivy-scan,
pr-changelog-check, pr-codespell, pr-filepath-check,
pr-linter-check, prow-action, rebase, stale-issues.
Intentionally left unguarded: pr-ci-check (useful for contributors
on forks), get-go-version (reusable workflow_call only).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix PodVolumeBackup metadata loss on fs-backup timeout
When a backup hits the fs-backup timeout, WaitAllPodVolumesProcessed
returned nil because PVBs were only collected from the indexer in the
done branch of the select. This discarded all PVB metadata including
already-completed PVBs, making their data unrestorable.
Move the PVB collection loop to run after the select so tracked PVBs
are always persisted regardless of timeout.
Fixes#9986
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #9995
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Filter non-completed PVBs in hasPodVolumeBackup
After preserving tracked PVBs on timeout, non-completed PVBs (in-progress
or with no snapshot ID) would cause hasPodVolumeBackup to return true,
leading the restore to skip the original PV and dynamically re-provision
it without any data to restore from.
Only match PVBs that are Completed with a valid SnapshotID.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add unit tests for hasPodVolumeBackup phase filtering
Verify that hasPodVolumeBackup only matches PVBs that are Completed
with a valid SnapshotID, and rejects in-progress, failed, or
empty-snapshot PVBs.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
curl api.github.com is subject to rate limit(60 requests per hour),
provide GitHub token increase the rate limits.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Validate user-provided labels and annotations in maintenance job
User-provided labels and annotations from maintenance JobConfigs
are now validated before being applied to the maintenance Job pod
template. Invalid label keys, label values, and annotation keys
are skipped with a warning log. This prevents the Kubernetes API
from rejecting the entire Job when a user provides labels or
annotations that violate naming rules.
Additionally, user-provided labels can no longer overwrite the
internal RepositoryNameLabel used for job tracking.
Fixes velero-io/velero#9981
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add tests for label and annotation validation in maintenance job
Add test cases to TestBuildJob covering:
- Invalid label key is skipped
- Invalid label value is skipped
- Label value exceeding 63 characters is skipped
- User-provided label cannot overwrite RepositoryNameLabel
- Invalid annotation key is skipped
Also fix a latent test issue where param.BackupRepo was not reset
between test cases, and add the missing assertion for
expectedPodAnnotation which was defined but never checked.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix gofmt formatting in maintenance test file
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Add changelog for PR #9982
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---------
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Added CLI for creating restore resource policies, and view
the resource policies associated with resource if present.
Only list the name of the configmap for now.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
- normalized the input to lower case for consistency
- added validations for kind collision
- add flag for unresolved kinds, and defer skip decision base on that
- move peek-and-map test cases to restore_policies_test.go
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
The Kubernetes image volume type (GA in k8s 1.31) was not recognized by
Velero's volume type detection logic, causing volume policies with
volumeTypes condition set to "image" to be silently ignored. This led
to failed fs-backups when defaultVolumesToFsBackup was enabled, since
image volumes have no host path for the node agent to back up.
Add the "image" SupportedVolume constant and detection in
getVolumeTypeFromVolume() so that volume policies can properly match
and skip image volumes.
Fixesvelero-io/velero#9977
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
When a user specifies a Custom Resource Kind in a restore filter
policy (e.g., kinds: [MyCustomKind]), the discovery helper fails
to resolve it if the CRD hasn't been restored yet.
This adds a peek-and-map fallback: if a resource type in the
backup tarball doesn't match the resolved filters, Velero peeks
at the actual Kind of the first item in the tarball and matches
it against the user's original policy strings.
Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
* Add change-id and volume-id retrieve logic for both vks and vanilla k8s environment.
* Add change-id and volume-id support code in exposer.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Xun Jiang
Daniel Jiang
Shubham Pampattiwar
Chlins Zhang
dependabot[bot]
Xun Jiang/Bruce Jiang
Adam Zhang
James Hewitt
lyndon-li
Wenkai Yin(尹文开)
Lyndon-Li
copilot-swe-agent[bot]
Scott Seago