velero

* Design: namespace selection by label in resource policy

Extends includeExcludePolicy in the ResourcePolicy ConfigMap with
includedNamespacesByLabel and excludedNamespacesByLabel, letting users
dynamically include/exclude namespaces by Kubernetes label selector
without touching BackupSpec or schedule specs.

Covers precedence rules against BackupSpec.IncludedNamespaces/
ExcludedNamespaces (including the empty-IncludedNamespaces "all
namespaces" baseline and a configured selector matching zero
namespaces), observability via logging (backup.status.includedNamespaces
is deferred, see Open Issues), and rejected alternatives (extending
BackupSpec.LabelSelector, a new CRD field, a standalone ConfigMap,
matching the fine-grained filters' map[string]string selector shape).

resolveNamespacesByLabel resolves included/excluded selectors
independently and returns both sets uncombined; the caller merges them
against BackupSpec.IncludedNamespaces/ExcludedNamespaces via an
explicit labelIncludeActive flag, so exclude-only policies and
zero-match include selectors both behave correctly instead of
collapsing to "all namespaces".

Cross-checked against the fine-grained backup/restore filter policies
merged from issue #9448 (clusterScopedFilterPolicy, namespacedFilterPolicies
in internal/resourcepolicies/resource_policies.go): confirms no field/key
collisions, documents that a ConfigMap using these fields can't be reused
for Restore (ValidateForRestore rejects any non-nil IncludeExcludePolicy)
or the global backup volume policies ConfigMap (volumePolicies-only).

Fixes #9771

> [!Note]
> Responses generated with Claude

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Design: address review feedback from adam-jian-zhang

- Add markdown hard-line-break trailing spaces to Glossary entries so
  each term renders on its own line.
- Add labelSelectorLogic ("OR" default | "AND") to IncludeExcludePolicy
  instead of deferring AND-vs-OR to a future enhancement, per review
  comment. AND combines entries within includedNamespacesByLabel (and
  independently within excludedNamespacesByLabel) via intersection
  instead of union. Threaded through resolveNamespacesByLabel,
  validation, and a new worked example.
- Change observability logging from "log the full resolved namespace
  list at info" to "log the count at info, full list at debug" to
  avoid spamming backup logs on clusters with large namespace counts
  where a selector matches a large fraction of them.

> [!Note]
> Responses generated with Claude

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Design: clarify LabelSelector interaction with label-resolved namespaces

Non-Goals previously asserted BackupSpec.LabelSelector/OrLabelSelectors
are unaffected by this design without qualification. Add the missing
trade-off: a namespace resolved into the effective set via
includedNamespacesByLabel still gets its Namespace object written even
if it doesn't separately match LabelSelector/OrLabelSelectors, mirroring
existing behavior for namespaces named explicitly in
BackupSpec.IncludedNamespaces (the nsTracker guard in
pkg/backup/item_collector.go only suppresses the Namespace object when
the namespace filter is at its default, per #7105).

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

---------

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

2026-09-16 22:44:46 -04:00

backup-filter-enhancement

Support set-based filter label selectors (#10064 )

2026-07-24 16:03:51 -04:00

block-data-mover

block data mover design

2026-04-14 14:39:56 +08:00

CLI/PoC

Add support for block volumes (#6680 )

2023-09-28 09:44:46 -04:00

Implemented

move implemented design for 1.18