Skip to content

Restore workspace from backup #1572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Allda wants to merge 16 commits into
base: main
Choose a base branch
from
+2,391 −155
Open

Restore workspace from backup #1572

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
9a876c1
Add init container for workspace restoration
Allda Jan 14, 2026
214b762
test: Add integration tests for restore feature
Allda Jan 16, 2026
728f107
Move restore container condition to controller level
Allda Jan 16, 2026
5480c1c
Add resources configuration to restore container
Allda Jan 16, 2026
9db9b7c
Update a restore feature based on code review
Allda Jan 21, 2026
dcbc7b3
Move handleRegistryAuthSecret to separate module
Allda Jan 22, 2026
1c706fe
feat: Add registry auth to workspace restore process
Allda Jan 23, 2026
83e8ac8
Remove controller reference for imageStream
Allda Jan 23, 2026
8fcc091
Don't restore workspace if not empty
Allda Jan 23, 2026
3b4676a
Use testing image for restore feature test
Allda Jan 28, 2026
da714b3
Replace hardcoded strings with constatns
Allda Jan 28, 2026
15346d3
Fix github action permissions
Allda Jan 28, 2026
72dc09e
Separate function for getting restore registry auth secret.
Allda Jan 30, 2026
1dbe84b
fix: null pointer condition
Allda Jan 30, 2026
500c993
fix: Check for empty project root right before copying
Allda Jan 30, 2026
27ee785
Use SyncObjectWithCluster instead of copying secrets
Allda Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions .github/workflows/project-backup-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
#
# Copyright (c) 2019-2026 Red Hat, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Devtools backup build

on:
push:
branches: [ main ]
workflow_dispatch:

permissions:
contents: read

jobs:

build-project-backup-imgs:

runs-on: ubuntu-latest

outputs:
git-sha: ${{ steps.git-sha.outputs.sha }}

steps:
- name: Checkout devworkspace-operator source code
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

- name: Set output for Git short SHA
id: git-sha
run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

- name: Login to quay.io
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc #v2.2.0
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io

- uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 #v1.2.4
- run: |
cd project-backup/test-data
make run
oras push quay.io/devfile/project-backup-test:latest \
--artifact-type application/vnd.devworkspace.backup.artifact.v1+json \
--annotation devworkspace.name="sample" \
--annotation devworkspace.namespace="sample" \
--disable-path-validation \
devworkspace-backup.tar.gz
15 changes: 15 additions & 0 deletions apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,9 @@ type WorkspaceConfig struct {
// ProjectCloneConfig defines configuration related to the project clone init container
// that is used to clone git projects into the DevWorkspace.
ProjectCloneConfig *ProjectCloneConfig `json:"projectClone,omitempty"`
// RestoreConfig defines configuration related to the workspace restore init container
// that is used to restore workspace data from a backup image.
RestoreConfig *RestoreConfig `json:"restore,omitempty"`
// ImagePullPolicy defines the imagePullPolicy used for containers in a DevWorkspace
// For additional information, see Kubernetes documentation for imagePullPolicy. If
// not specified, the default value of "Always" is used.
Expand Down Expand Up @@ -376,6 +379,18 @@ type ProjectCloneConfig struct {
Env []corev1.EnvVar `json:"env,omitempty"`
}

type RestoreConfig struct {
// ImagePullPolicy configures the imagePullPolicy for the restore container.
// If undefined, the general setting .config.workspace.imagePullPolicy is used instead.
ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
// Resources defines the resource (cpu, memory) limits and requests for the restore
// container. To explicitly not specify a limit or request, define the resource
// quantity as zero ('0')
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
// Env allows defining additional environment variables for the restore container.
Env []corev1.EnvVar `json:"env,omitempty"`
}

type ConfigmapReference struct {
// Name is the name of the configmap
Name string `json:"name"`
Expand Down
32 changes: 32 additions & 0 deletions apis/controller/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

81 changes: 4 additions & 77 deletions controllers/backupcronjob/backupcronjob_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ import (
"github.com/devfile/devworkspace-operator/pkg/constants"
"github.com/devfile/devworkspace-operator/pkg/infrastructure"
"github.com/devfile/devworkspace-operator/pkg/library/storage"
"github.com/devfile/devworkspace-operator/pkg/secrets"
"github.com/go-logr/logr"
"github.com/robfig/cron/v3"
batchv1 "k8s.io/api/batch/v1"
Expand Down Expand Up @@ -344,7 +345,7 @@ func (r *BackupCronJobReconciler) createBackupJob(
dwID := workspace.Status.DevWorkspaceId
backUpConfig := dwOperatorConfig.Config.Workspace.BackupCronJob

registryAuthSecret, err := r.handleRegistryAuthSecret(ctx, workspace, dwOperatorConfig, log)
registryAuthSecret, err := secrets.HandleRegistryAuthSecret(ctx, r.Client, workspace, dwOperatorConfig.Config, dwOperatorConfig.Namespace, r.Scheme, log)
if err != nil {
log.Error(err, "Failed to handle registry auth secret for DevWorkspace", "devworkspace", workspace.Name)
return err
Expand Down Expand Up @@ -451,15 +452,15 @@ func (r *BackupCronJobReconciler) createBackupJob(
}
if registryAuthSecret != nil {
job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
Name: "registry-auth-secret",
Name: constants.RegistryAuthVolumeName,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: registryAuthSecret.Name,
},
},
})
job.Spec.Template.Spec.Containers[0].VolumeMounts = append(job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
Name: "registry-auth-secret",
Name: constants.RegistryAuthVolumeName,
MountPath: "/tmp/.docker",
ReadOnly: true,
})
Expand All @@ -480,77 +481,3 @@ func (r *BackupCronJobReconciler) createBackupJob(
log.Info("Created backup Job for DevWorkspace", "jobName", job.Name, "devworkspace", workspace.Name)
return nil
}

func (r *BackupCronJobReconciler) handleRegistryAuthSecret(ctx context.Context, workspace *dw.DevWorkspace,
dwOperatorConfig *controllerv1alpha1.DevWorkspaceOperatorConfig, log logr.Logger,
) (*corev1.Secret, error) {
secretName := dwOperatorConfig.Config.Workspace.BackupCronJob.Registry.AuthSecret
if secretName == "" {
// No auth secret configured - anonymous access to registry
return nil, nil
}

// First check the workspace namespace for the secret
registryAuthSecret := &corev1.Secret{}
err := r.Get(ctx, client.ObjectKey{
Name: secretName,
Namespace: workspace.Namespace}, registryAuthSecret)
if err == nil {
log.Info("Successfully retrieved registry auth secret for backup from workspace namespace", "secretName", secretName)
return registryAuthSecret, nil
}
if client.IgnoreNotFound(err) != nil {
return nil, err
}

log.Info("Registry auth secret not found in workspace namespace, checking operator namespace", "secretName", secretName)

// If the secret is not found in the workspace namespace, check the operator namespace as fallback
err = r.Get(ctx, client.ObjectKey{
Name: secretName,
Namespace: dwOperatorConfig.Namespace}, registryAuthSecret)
if err != nil {
log.Error(err, "Failed to get registry auth secret for backup job", "secretName", secretName)
return nil, err
}
log.Info("Successfully retrieved registry auth secret for backup job", "secretName", secretName)
return r.copySecret(ctx, workspace, registryAuthSecret, log)
}

// copySecret copies the given secret from the operator namespace to the workspace namespace.
func (r *BackupCronJobReconciler) copySecret(ctx context.Context, workspace *dw.DevWorkspace, sourceSecret *corev1.Secret, log logr.Logger) (namespaceSecret *corev1.Secret, err error) {
existingNamespaceSecret := &corev1.Secret{}
err = r.Get(ctx, client.ObjectKey{
Name: constants.DevWorkspaceBackupAuthSecretName,
Namespace: workspace.Namespace}, existingNamespaceSecret)
if client.IgnoreNotFound(err) != nil {
log.Error(err, "Failed to check for existing registry auth secret in workspace namespace", "namespace", workspace.Namespace)
return nil, err
}
if err == nil {
err = r.Delete(ctx, existingNamespaceSecret)
if err != nil {
return nil, err
}
}
namespaceSecret = &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: constants.DevWorkspaceBackupAuthSecretName,
Namespace: workspace.Namespace,
Labels: map[string]string{
constants.DevWorkspaceIDLabel: workspace.Status.DevWorkspaceId,
constants.DevWorkspaceWatchSecretLabel: "true",
},
},
Data: sourceSecret.Data,
Type: sourceSecret.Type,
}
if err := controllerutil.SetControllerReference(workspace, namespaceSecret, r.Scheme); err != nil {
return nil, err
}
err = r.Create(ctx, namespaceSecret)
if err == nil {
log.Info("Successfully created secret", "name", namespaceSecret.Name, "namespace", workspace.Namespace)
}
return namespaceSecret, err
}
8 changes: 3 additions & 5 deletions controllers/backupcronjob/rbac.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (
"fmt"

dw "github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2"
"github.com/devfile/devworkspace-operator/pkg/common"
"github.com/devfile/devworkspace-operator/pkg/constants"
"github.com/devfile/devworkspace-operator/pkg/infrastructure"
"github.com/devfile/devworkspace-operator/pkg/provision/sync"
Expand Down Expand Up @@ -97,8 +98,8 @@ func (r *BackupCronJobReconciler) ensureImagePushRoleBinding(ctx context.Context
},
},
RoleRef: rbacv1.RoleRef{
Kind: "ClusterRole",
Name: "system:image-builder",
Kind: constants.ClusterRole,
Name: common.RegistryImagePullerRoleName(),
APIGroup: "rbac.authorization.k8s.io",
},
}
Expand Down Expand Up @@ -135,9 +136,6 @@ func (r *BackupCronJobReconciler) ensureImageStreamForBackup(ctx context.Context
},
},
}
if err := controllerutil.SetControllerReference(workspace, imageStream, r.Scheme); err != nil {
return err
}

imageStream.SetGroupVersionKind(schema.GroupVersionKind{
Group: "image.openshift.io",
Expand Down
59 changes: 45 additions & 14 deletions controllers/workspace/devworkspace_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ import (
"github.com/devfile/devworkspace-operator/pkg/library/home"
kubesync "github.com/devfile/devworkspace-operator/pkg/library/kubernetes"
"github.com/devfile/devworkspace-operator/pkg/library/projects"
"github.com/devfile/devworkspace-operator/pkg/library/restore"
"github.com/devfile/devworkspace-operator/pkg/library/status"
"github.com/devfile/devworkspace-operator/pkg/provision/automount"
"github.com/devfile/devworkspace-operator/pkg/provision/metadata"
Expand Down Expand Up @@ -353,21 +354,51 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
if err := projects.ValidateAllProjects(&workspace.Spec.Template); err != nil {
return r.failWorkspace(workspace, fmt.Sprintf("Invalid devfile: %s", err), metrics.ReasonBadRequest, reqLogger, &reconcileStatus), nil
}
// Add init container to clone projects
projectCloneOptions := projects.Options{
Image: workspace.Config.Workspace.ProjectCloneConfig.Image,
Env: env.GetEnvironmentVariablesForProjectClone(workspace),
Resources: workspace.Config.Workspace.ProjectCloneConfig.Resources,
}
if workspace.Config.Workspace.ProjectCloneConfig.ImagePullPolicy != "" {
projectCloneOptions.PullPolicy = config.Workspace.ProjectCloneConfig.ImagePullPolicy
if restore.IsWorkspaceRestoreRequested(&workspace.Spec.Template) {
Copy link
Member

@rohanKanojia rohanKanojia Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see every reconcile checks IsWorkspaceRestoreRequested(), I think this would keep adding restore init container, and the workspace would never reach Running phase.

The restore attribute should be automatically removed after successful completion.

// Add init container to restore workspace from backup if requested
restoreOptions := restore.Options{
Env: env.GetEnvironmentVariablesForProjectRestore(workspace),
Resources: workspace.Config.Workspace.RestoreConfig.Resources,
}
if config.Workspace.ImagePullPolicy != "" {
restoreOptions.PullPolicy = corev1.PullPolicy(config.Workspace.ImagePullPolicy)
} else {
restoreOptions.PullPolicy = corev1.PullIfNotPresent
}
if workspaceRestore, registryAuthSecret, err := restore.GetWorkspaceRestoreInitContainer(ctx, workspace, r.Client, restoreOptions, r.Scheme, reqLogger); err != nil {
return r.failWorkspace(workspace, fmt.Sprintf("Failed to set up workspace-restore init container: %s", err), metrics.ReasonInfrastructureFailure, reqLogger, &reconcileStatus), nil
} else if workspaceRestore != nil {
devfilePodAdditions.InitContainers = append([]corev1.Container{*workspaceRestore}, devfilePodAdditions.InitContainers...)
if registryAuthSecret != nil {
// Add the registry auth secret volume
devfilePodAdditions.Volumes = append(devfilePodAdditions.Volumes, corev1.Volume{
Name: constants.RegistryAuthVolumeName,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: registryAuthSecret.Name, // You may want to make this configurable
},
},
})
}

}
} else {
projectCloneOptions.PullPolicy = corev1.PullPolicy(config.Workspace.ImagePullPolicy)
}
if projectClone, err := projects.GetProjectCloneInitContainer(&workspace.Spec.Template, projectCloneOptions, workspace.Config.Routing.ProxyConfig); err != nil {
return r.failWorkspace(workspace, fmt.Sprintf("Failed to set up project-clone init container: %s", err), metrics.ReasonInfrastructureFailure, reqLogger, &reconcileStatus), nil
} else if projectClone != nil {
devfilePodAdditions.InitContainers = append([]corev1.Container{*projectClone}, devfilePodAdditions.InitContainers...)
// Add init container to clone projects only if restore container wasn't created
projectCloneOptions := projects.Options{
Image: workspace.Config.Workspace.ProjectCloneConfig.Image,
Env: env.GetEnvironmentVariablesForProjectClone(workspace),
Resources: workspace.Config.Workspace.ProjectCloneConfig.Resources,
}
if workspace.Config.Workspace.ProjectCloneConfig.ImagePullPolicy != "" {
projectCloneOptions.PullPolicy = config.Workspace.ProjectCloneConfig.ImagePullPolicy
} else {
projectCloneOptions.PullPolicy = corev1.PullPolicy(config.Workspace.ImagePullPolicy)
}
if projectClone, err := projects.GetProjectCloneInitContainer(&workspace.Spec.Template, projectCloneOptions, workspace.Config.Routing.ProxyConfig); err != nil {
return r.failWorkspace(workspace, fmt.Sprintf("Failed to set up project-clone init container: %s", err), metrics.ReasonInfrastructureFailure, reqLogger, &reconcileStatus), nil
} else if projectClone != nil {
devfilePodAdditions.InitContainers = append([]corev1.Container{*projectClone}, devfilePodAdditions.InitContainers...)
}
}

// Inject operator-configured init containers
Expand Down
Loading
Loading