Merge pull request #9479 from blackpiglet/add_role_rolebinding_in_resotre_sequence_1.17

[cherry-pick][release-1.17] Add Role, RoleBinding, ClusterRole, and ClusterRoleBinding in restore sequence.
Add Role, RoleBinding, ClusterRole, and ClusterRoleBinding in restore sequence.
2026-03-27 12:05:05 +00:00 · 2026-01-09 11:17:35 +08:00 · 2026-01-08 15:23:19 +08:00
2 changed files with 5 additions and 0 deletions
--- a/changelogs/CHANGELOG-1.17.md
+++ b/changelogs/CHANGELOG-1.17.md
@@ -16,6 +16,7 @@ https://velero.io/docs/v1.17/upgrade-to-1.17/
  * Track actual resource names for GenerateName in restore status (#9409, @shubham-pampattiwar)
  * Fix managed fields patch for resources using GenerateName (#9408, @shubham-pampattiwar)
  * don't copy securitycontext from first container if configmap found (#9394, @sseago)
+  * Add Role, RoleBinding, ClusterRole, and ClusterRoleBinding in restore sequence. (#9479, @blackpiglet)
  

 ## v1.17.1
--- a/pkg/cmd/server/config/config.go
+++ b/pkg/cmd/server/config/config.go
@@ -113,7 +113,11 @@ var (
 			"datauploads.velero.io",
 			"persistentvolumes",
 			"persistentvolumeclaims",
+			"clusterroles",
+			"roles",
 			"serviceaccounts",
+			"clusterrolebindings",
+			"rolebindings",
 			"secrets",
 			"configmaps",
 			"limitranges",
Author	SHA1	Message	Date
Xun Jiang/Bruce Jiang	7013a4097f	Merge pull request #9479 from blackpiglet/add_role_rolebinding_in_resotre_sequence_1.17 Some checks failed Run the E2E test on kind / build (push) Failing after 13m48s Details Run the E2E test on kind / setup-test-matrix (push) Successful in 4s Details Run the E2E test on kind / run-e2e-test (push) Has been skipped Details Main CI / Build (push) Failing after 53s Details [cherry-pick][release-1.17] Add Role, RoleBinding, ClusterRole, and ClusterRoleBinding in restore sequence.	2026-01-09 11:17:35 +08:00
Xun Jiang	b188701862	Add Role, RoleBinding, ClusterRole, and ClusterRoleBinding in restore sequence. Ensure the RBAC resources are restored before pods. The change help to avoid pod starting error when pod depends on the RBAC resources, e.g., prometheus operator check whether it has enough permission before launching controller, if prometheus operator pod starts before RBAC resources created, it will not launch controllers, and it will not retry. `f7f07bcdfb/cmd/operator/main.go (L392-L400)` Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>	2026-01-08 15:23:19 +08:00