Skip to content

[release-1.16] Add imagePullSecrets inheritage for VGDP pod and maintenance job. #9102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
kaovilai merged 1 commit into from
Jul 24, 2025
Merged

[release-1.16] Add imagePullSecrets inheritage for VGDP pod and maintenance job. #9102

kaovilai merged 1 commit into from
Jul 24, 2025

Conversation

@blackpiglet
Copy link
Contributor

@blackpiglet blackpiglet commented Jul 23, 2025 •
edited
Loading

Thank you for contributing to Velero!

Please add a summary of your change

Does your change fix a particular issue?

Fixes #(issue)

Please indicate you've done the following:

@blackpiglet blackpiglet force-pushed the add_image_pull_secret_1.16 branch from 7af11d3 to d486da4 Compare July 23, 2025 12:03
@codecov
Copy link

codecov bot commented Jul 23, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.62%. Comparing base (8adfd8d) to head (d633cdb).

Additional details and impacted files 
@@              Coverage Diff              @@
##           release-1.16    #9102   +/-   ##
=============================================
  Coverage         59.61%   59.62%           
=============================================
  Files               370      370           
  Lines             40299    40308    +9     
=============================================
+ Hits              24026    24035    +9     
  Misses            14772    14772           
  Partials           1501     1501

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@blackpiglet blackpiglet force-pushed the add_image_pull_secret_1.16 branch from d486da4 to fef06c7 Compare July 23, 2025 15:09
@blackpiglet blackpiglet changed the title Add imagePullSecrets inheritage for VGDP pod and maintenance job. [release-1.16] Add imagePullSecrets inheritage for VGDP pod and maintenance job. Jul 23, 2025
@blackpiglet blackpiglet force-pushed the add_image_pull_secret_1.16 branch 2 times, most recently from 7c35684 to 30767d9 Compare July 23, 2025 15:11
@blackpiglet blackpiglet marked this pull request as ready for review July 24, 2025 02:58
@github-actions github-actions bot requested review from anshulahuja98 and sseago July 24, 2025 02:58
@blackpiglet blackpiglet force-pushed the add_image_pull_secret_1.16 branch from 30767d9 to d633cdb Compare July 24, 2025 02:58
@kaovilai kaovilai merged commit 0fc7e2f into vmware-tanzu:release-1.16 Jul 24, 2025
46 checks passed
openshift-merge-bot bot pushed a commit to openshift/velero that referenced this pull request Aug 7, 2025
@mpryc @blackpiglet
@ywk253100 @theadarshsaxena @kaovilai @sseago @Lyndon-Li @shubham-pampattiwar @reasonerjt @27149chen @allenxu404 @dzaninovic @0x113 @dymurray @rayfordj @weshayutin @openshift-cherrypick-robot @red-hat-konflux
Rebase bot - oadp-1.5 branch against v1.16.2 tag (#431)
f906441 
* Add BSL status check for backup/restore operations.

Signed-off-by: Xun Jiang <[email protected]>

* Bump golang to v1.23.10 to fix CVEs for 1.16.2 release (vmware-tanzu#9058)

* Bump golang to v1.23.10 to fix CVEs

Signed-off-by: Adarsh Saxena <[email protected]>

* Dockerfile restic miss 1.23.10

Signed-off-by: Tiger Kaovilai <[email protected]>

* restic cve go1.23.10

Signed-off-by: Tiger Kaovilai <[email protected]>

---------

Signed-off-by: Adarsh Saxena <[email protected]>
Signed-off-by: Tiger Kaovilai <[email protected]>
Co-authored-by: Tiger Kaovilai <[email protected]>

* Allow for proper tracking of multiple hooks per container

Signed-off-by: Scott Seago <[email protected]>

* Mounted cloud credentials should not be world-readable (vmware-tanzu#8919) (vmware-tanzu#9094)

Signed-off-by: Scott Seago <[email protected]>

* issue 9077: don't block backup deletion on list VS error (vmware-tanzu#9101)

Signed-off-by: Lyndon-Li <[email protected]>

* Fix missing defaultVolumesToFsBackup flag output in Velero describe backup cmd (vmware-tanzu#9056)

add changelog file

Show defaultVolumesToFsBackup in describe only when set by the user

minor ut fix

minor fix

Signed-off-by: Shubham Pampattiwar <[email protected]>
(cherry picked from commit 60a6c73)

update changelog filename

Signed-off-by: Shubham Pampattiwar <[email protected]>

* Update Backup describe string for DefaultVolumesToFSBackup flag (vmware-tanzu#9105)

add changelog file

Signed-off-by: Shubham Pampattiwar <[email protected]>
(cherry picked from commit aa2e09c)

* Add imagePullSecrets inheritance for VGDP pod and maintenance job. (vmware-tanzu#9102)

Signed-off-by: Xun Jiang <[email protected]>

* Bump Golang, Ubuntu, and golang.org/x/oauth2 to fix CVEs. (vmware-tanzu#9104)

Signed-off-by: Xun Jiang <[email protected]>

* 1.16.2 changelog

Signed-off-by: Lyndon-Li <[email protected]>

* Bump the Velero and plugin image versions for the upgrade and migration tests.

Signed-off-by: Xun Jiang <[email protected]>

* skip subresource in resource discovery (vmware-tanzu#6688)

Signed-off-by: lou <[email protected]>
Co-authored-by: lou <[email protected]>

* fix issue 6753

Signed-off-by: Lyndon-Li <[email protected]>

* Update restore controller logic for restore deletion (vmware-tanzu#6761)

1. Skip deleting the restore files from storage if the backup/BSL is not found
2. Allow deleting the restore files from storage even though the BSL is readonly

Signed-off-by: Wenkai Yin(尹文开) <[email protected]>

* Fix vmware-tanzu#6752: add namespace exclude check.

Add PSA audit and warn labels.

Signed-off-by: Xun Jiang <[email protected]>

* add csi snapshot data movement doc

Signed-off-by: Lyndon-Li <[email protected]>

* Modify changelogs for v1.12

Signed-off-by: allenxu404 <[email protected]>

* issue 6786:always delete VSC regardless of the deletion policy

Signed-off-by: Lyndon-Li <[email protected]>

* issue: move plugin depdending podvolume functions to util pkg

Signed-off-by: Lyndon-Li <[email protected]>

* issue 6880: set ParallelUploadAboveSize as MaxInt64

Signed-off-by: Lyndon-Li <[email protected]>

* changelog

Signed-off-by: Tiger Kaovilai <[email protected]>

* Add support for block volumes (vmware-tanzu#6680) (vmware-tanzu#6897)

(cherry picked from commit 8e01d1b)

Signed-off-by: David Zaninovic <[email protected]>

* Replace the base image with paketobuildpacks image

Replace the base image with paketobuildpacks image

Fixes vmware-tanzu#6851

Signed-off-by: Wenkai Yin(尹文开) <[email protected]>

* issue 6734: spread backup pod evenly

Signed-off-by: Lyndon-Li <[email protected]>

* Add doc links for new features to release note

Signed-off-by: allenxu404 <[email protected]>

* fix issue 6647

Signed-off-by: Lyndon-Li <[email protected]>

* Perf improvements for existing resource restore

Use informer cache with dynamic client for Get calls on restore
When enabled, also make the Get call before create.

Add server and install parameter to allow disabling this feature,
but enable by default

Signed-off-by: Scott Seago <[email protected]>

* issue vmware-tanzu#6807: Retry failed create when using generateName

When creating resources with generateName, apimachinery
does not guarantee uniqueness when it appends the random
suffix to the generateName stub, so if it fails with
already exists error, we need to retry.

Signed-off-by: Scott Seago <[email protected]>

* Import auth provider plugins

Signed-off-by: Sebastian Glab <[email protected]>

* Add v1.12.1 changelog

Signed-off-by: allenxu404 <[email protected]>

* Make Windows build skip BlockMode code.

PVC block mode backup and restore introduced some OS specific
system calls. Those calls are not available for Windows, so
add both non Windows version and Windows version code, and
return error for block mode on the Windows platform.

Signed-off-by: Xun Jiang <[email protected]>

* udmrepo use region specified in BSL when s3URL is empty

Signed-off-by: Lyndon-Li <[email protected]>

* Change v1.12.1 changelog

Signed-off-by: allenxu404 <[email protected]>

* Dockerfile.ubi/travis local files

add UBI dockerfiles
Use numeric user for velero-restic-restore-helper
Enable multiarch builds (#135)
Use arm64-graviton2 for arm builds (#137)
Add required keys for arm builds (#139)
Update Travis build job to work w/o changes on new branches
Use a full VM for arm
Use numeric non-root user for nonroot SCC compatibility

* Add BZ + Publish automation to repo (#82)

(cherry picked from commit ccb545f)

Update PR-BZ automation mapping (#84)

(cherry picked from commit aa2b019)

Update PR-BZ automation (#92)

Co-authored-by: Rayford Johnson <[email protected]>
(cherry picked from commit ecc563f)

Add publish workflow (#108)

(cherry picked from commit f87b779)

* remove dependabot config from fork

* Create Makefile.prow

Code-gen no longer required on verify

due to vmware-tanzu#6039

Signed-off-by: Tiger Kaovilai <[email protected]>

oadp-1.2: Update Makefile.prow to velero-restore-helper

* set HOME in velero image for kopia, update controller-gen for CI (#280)

Signed-off-by: Scott Seago <[email protected]>

* build velero-helper binary for datamover pod

* restore: Use warning when Create IsAlreadyExist and Get error

Signed-off-by: Tiger Kaovilai <[email protected]>

* kopia/repository/config/aws.go: Set session.Options profile from config

Signed-off-by: Tiger Kaovilai <[email protected]>

* use ubi9-latest to build

* OADP-4225: add tzdata to Dockerfile.ubi

* fix: CI (#316)

Signed-off-by: Mateus Oliveira <[email protected]>

* fix: ARM images (#332)

* fix: ARM images

Signed-off-by: Mateus Oliveira <[email protected]>

* fixup! fix: ARM images

Signed-off-by: Mateus Oliveira <[email protected]>

---------

Signed-off-by: Mateus Oliveira <[email protected]>

* ubi: BUILDPLATFORM to build stage to enable cross compile. (#336)

Signed-off-by: Tiger Kaovilai <[email protected]>

* OADP-4640: Downstream only to allow override kopia default algorithms (#334) (#338)

add missing unit test for kopia hashing algo (#337)

Introduction of downstream only option to override Kopia default:
 - hashing algorithm
 - splitting algorithm
 - encryption algorithm

With introduction of 3 environment variables it is possible to override
Kopia algorithms used by Velero:

KOPIA_HASHING_ALGORITHM
KOPIA_SPLITTER_ALGORITHM
KOPIA_ENCRYPTION_ALGORITHM

If the env algorithms are not set or they are not within
Kopia SupportedAlgorithms, the default algorithm will be used.
This behavior is consistent with current behavior without this
change.

Signed-off-by: Michal Pryc <[email protected]>
Signed-off-by: Shubham Pampattiwar <[email protected]>

* Downstream only: Rework of Makefile and incusion of lint

The rework of Makefile to make it more readable and
inclusion of lint as a target as well extract
golangci-lint version from the upstream Dockerfile,
so we test in PROW or locally on the same version as upstream.

Signed-off-by: Michal Pryc <[email protected]>

* Downstream only - fix lint error in downtream change (#343)

This fixes the PR #334 where one additional line was
in the code. This was not exposed previously as we
did not had downstream CI Lint jobs.

Signed-off-by: Michal Pryc <[email protected]>

* run oadp-operator e2e test from the velero repo (#353)

* run oadp-operator e2e test from the velero repo

execute openshift/oadp-operator e2e tests directly
against the velero repo locally or via prow ci

Signed-off-by: Wesley Hayutin <[email protected]>

* update variable names, add a cleanup

* make sure env variable overrides default velero_image

Signed-off-by: Wesley Hayutin <[email protected]>

* add options to build, push, and only test

Signed-off-by: Wesley Hayutin <[email protected]>

* add arch to name

Signed-off-by: Wesley Hayutin <[email protected]>

* remove duplicated clean/rm operator checkout

* simplify by dropping export var and use a oneliner

Co-authored-by: Tiger Kaovilai <[email protected]>

* drop export and use oneliner

Co-authored-by: Tiger Kaovilai <[email protected]>

* just in case, allow oadp to be deployed from makefile

Signed-off-by: Wesley Hayutin <[email protected]>

* Update Makefile.prow

Co-authored-by: Tiger Kaovilai <[email protected]>

---------

Signed-off-by: Wesley Hayutin <[email protected]>
Co-authored-by: Tiger Kaovilai <[email protected]>

* DS Owners

* updated controller-gen version

* Include velero-restore-helper binary in velero image (#375)

Co-authored-by: Scott Seago <[email protected]>

* OADP-5952: downstream only, update error message disableFsBackup (#380)

* OADP-5952: clear error for disableFsBackup

This error message can be carried in OADP-1.5
Upstream issue:
vmware-tanzu#8185

Signed-off-by: Wesley Hayutin <[email protected]>

* fix error message and test

---------

Signed-off-by: Wesley Hayutin <[email protected]>

* Summary of Changes: (#381)

Move PVC Request Size Patch to Backup CSI Action
Shifted the logic that patches the PVC request size (to match the corresponding VolumeSnapshot size) from the CSI Restore action to the CSI Backup action.
✅ This enables restoring a PVC independently using label selectors, without requiring the VolumeSnapshot to be restored first.

Include VolumeSnapshot in CSI Additional Items for PVC
Added VolumeSnapshot as an additional item in the PVC CSI backup logic to ensure necessary metadata is available during restore.

Include VolumeSnapshotContent in CSI Restore Additional Items
Added VolumeSnapshotContent to the additional items in the CSI restore action to support a more complete restore workflow.
✅ This to make sure those resources are restored even if filters out by label from the resources list to restore

Author:    Amos Mastbaum <[email protected]>
Signed-off-by: Amos Mastbaum <[email protected]>

fixing-after-michal

wait-for-vsc.Status.RestoreSize

wait-for-vsc.Status.RestoreSize

Update pkg/util/csi/volume_snapshot.go

Update pkg/util/csi/volume_snapshot.go

Update pkg/util/csi/volume_snapshot.go

Co-authored-by: Scott Seago <[email protected]>

* Prep for Konflux (#385)

* Prep for Konflux

* Update git submodule restic commit

---------

Co-authored-by: Rayford Johnson <[email protected]>

* Red Hat Konflux update oadp-velero-oadp-1-5 (#386)

* Red Hat Konflux update oadp-velero-oadp-1-5
Signed-off-by: red-hat-konflux <[email protected]>

* hermetic, prefetch-input

---------

Co-authored-by: red-hat-konflux <[email protected]>
Co-authored-by: Rayford Johnson <[email protected]>

* Konflux: multiarch, tags, labels (#402)

* build-platforms

* generate-labels, LABELS

* ADDITIONAL_TAGS

---------

Co-authored-by: Rayford Johnson <[email protected]>

* Red Hat Konflux update oadp-velero-oadp-1-5 (#411)

* Red Hat Konflux update oadp-velero-oadp-1-5
Signed-off-by: red-hat-konflux <[email protected]>

* Konflux: openshift-preflight: failed: HasLicense

"suggestion": "Create a directory named /licenses and include all
relevant licensing and/or terms and conditions as text file(s) in that
directory."

https://docs.redhat.com/en/documentation/red_hat_software_certification/2025/html-single/red_hat_openshift_software_certification_policy_guide/index#assembly-requirements-for-container-ima

> Container images must contain a “licenses” directory. Use this
> directory to add files containing software terms and conditions for your
> product and any open source software included in the image.
>
> Test name: HasLicense

---------

Co-authored-by: red-hat-konflux <[email protected]>
Co-authored-by: Rayford Johnson <[email protected]>

* chore(deps): update konflux references (#394)

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>

* chore(deps): update konflux references (#413)

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>

* add velero release to the velero container tags (#424)

Signed-off-by: Wesley Hayutin <[email protected]>

* oadp-1.5: Update Konflux references (#430)

* oadp-1.5: Update Konflux references

Update konflux-ci image references

Changes committed via automation for oadp-1-5/velero.

* Use restic's release branch

---------

Co-authored-by: Rayford Johnson <[email protected]>

---------

Signed-off-by: Xun Jiang <[email protected]>
Signed-off-by: Adarsh Saxena <[email protected]>
Signed-off-by: Tiger Kaovilai <[email protected]>
Signed-off-by: Scott Seago <[email protected]>
Signed-off-by: Lyndon-Li <[email protected]>
Signed-off-by: Shubham Pampattiwar <[email protected]>
Signed-off-by: lou <[email protected]>
Signed-off-by: Wenkai Yin(尹文开) <[email protected]>
Signed-off-by: Xun Jiang <[email protected]>
Signed-off-by: allenxu404 <[email protected]>
Signed-off-by: David Zaninovic <[email protected]>
Signed-off-by: Sebastian Glab <[email protected]>
Signed-off-by: Mateus Oliveira <[email protected]>
Signed-off-by: Michal Pryc <[email protected]>
Signed-off-by: Shubham Pampattiwar <[email protected]>
Signed-off-by: Wesley Hayutin <[email protected]>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: Xun Jiang <[email protected]>
Co-authored-by: Wenkai Yin(尹文开) <[email protected]>
Co-authored-by: Adarsh Saxena <[email protected]>
Co-authored-by: Tiger Kaovilai <[email protected]>
Co-authored-by: Scott Seago <[email protected]>
Co-authored-by: lyndon-li <[email protected]>
Co-authored-by: Shubham Pampattiwar <[email protected]>
Co-authored-by: Xun Jiang/Bruce Jiang <[email protected]>
Co-authored-by: Lyndon-Li <[email protected]>
Co-authored-by: Daniel Jiang <[email protected]>
Co-authored-by: lou <[email protected]>
Co-authored-by: Xun Jiang <[email protected]>
Co-authored-by: allenxu404 <[email protected]>
Co-authored-by: David Zaninovic <[email protected]>
Co-authored-by: Sebastian Glab <[email protected]>
Co-authored-by: Dylan Murray <[email protected]>
Co-authored-by: RayfordJ <[email protected]>
Co-authored-by: Mateus Oliveira <[email protected]>
Co-authored-by: Wesley Hayutin <[email protected]>
Co-authored-by: Tiger Kaovilai <[email protected]>
Co-authored-by: OpenShift Cherrypick Robot <[email protected]>
Co-authored-by: RayfordJ <[email protected]>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kaovilai kaovilai kaovilai approved these changes

@Lyndon-Li Lyndon-Li Lyndon-Li approved these changes

@anshulahuja98 anshulahuja98 Awaiting requested review from anshulahuja98

@sseago sseago Awaiting requested review from sseago

@ywk253100 ywk253100 Awaiting requested review from ywk253100

Assignees

@blackpiglet blackpiglet

Labels

has-changelog has-unit-tests target/1.16.2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@blackpiglet @kaovilai @Lyndon-Li