Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev #468

oadp-rebasebot-app · 2025-12-11T02:07:26Z

No description provided.

Azure storage errors include verbose HTTP response details and XML in error messages, making the BSL status.message field cluttered and hard to read. This change adds sanitization to extract only the error code and meaningful message. Before: BackupStorageLocation "test" is unavailable: rpc error: code = Unknown desc = GET https://... RESPONSE 404: 404 The specified container does not exist. ERROR CODE: ContainerNotFound <?xml version="1.0"...> After: BackupStorageLocation "test" is unavailable: rpc error: code = Unknown desc = ContainerNotFound: The specified container does not exist. AWS and GCP error messages are preserved as-is since they don't contain verbose HTTP responses. Fixes vmware-tanzu#8368 Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

@ywk253100

This commit addresses three review comments on PR vmware-tanzu#9321: 1. Keep sanitization in controller (response to @ywk253100) - Maintaining centralized error handling for easier extension - Azure-specific patterns detected and others passed through unchanged 2. Sanitize unavailableErrors array (@priyansh17) - Now using sanitizeStorageError() for both unavailableErrors array and location.Status.Message for consistency 3. Add SAS token scrubbing (@anshulahuja98) - Scrubs Azure SAS token parameters to prevent credential leakage - Redacts: sig, se, st, sp, spr, sv, sr, sip, srt, ss - Example: ?sig=secret becomes ?sig=***REDACTED*** Added comprehensive test coverage for SAS token scrubbing with 4 new test cases covering various scenarios. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Signed-off-by: Micah Nagel <micah.nagel@defenseunicorns.com>

Bumps [actions/stale](https://github.com/actions/stale) from 10.1.0 to 10.1.1. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v10.1.0...v10.1.1) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

…hub_actions/actions/stale-10.1.1 Bump actions/stale from 10.1.0 to 10.1.1

feat: add apply flag to install command

coderabbitai · 2025-12-11T02:07:32Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2025-12-11T02:08:04Z

Hi @oadp-rebasebot-app[bot]. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Remove VolumeSnapshotClass from backup sync process. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

Remove VolumeSnapshotClass from CSI B/R process.

…re-bsl-status-message-8368 Sanitize Azure HTTP responses in BSL status messages

…support - Introduced `CACertRef` field in `ObjectStorageLocation` to reference a Secret containing the CA certificate, replacing the deprecated `CACert` field. - Implemented validation logic to ensure mutual exclusivity between `CACert` and `CACertRef`. - Updated BSL controller and repository provider to handle the new certificate resolution logic. - Enhanced CLI to support automatic certificate discovery from BSL configurations. - Added unit and integration tests to validate new functionality and ensure backward compatibility. - Documented migration strategy for users transitioning from inline certificates to Secret-based management. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

This change enables BSL validation to work when using caCertRef (Secret-based CA certificate) by resolving the certificate from the Secret in velero core before passing it to the object store plugin as 'caCert' in the config map. This approach requires no changes to provider plugins since they already understand the 'caCert' config key. Changes: - Add SecretStore to objectBackupStoreGetter struct - Add NewObjectBackupStoreGetterWithSecretStore constructor - Update Get method to resolve caCertRef from Secret - Update server.go to use new constructor with SecretStore - Add CACertRef builder method and unit tests 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

…ersion (vmware-tanzu#9451) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

openshift-ci · 2025-12-15T19:24:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: oadp-rebasebot-app[bot], sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

The GetPodsUsingPVC function had O(N*M) complexity - for each PVC, it listed ALL pods in the namespace and iterated through each pod. With many PVCs and pods, this caused significant performance degradation (2+ seconds per PV in some cases). This change introduces a PVC-to-Pod cache that is built once per backup and reused for all PVC lookups, reducing complexity from O(N*M) to O(N+M). Changes: - Add PVCPodCache struct with thread-safe caching in podvolume pkg - Add NewVolumeHelperImplWithCache constructor for cache support - Build cache before backup item processing in backup.go - Add comprehensive unit tests for cache functionality - Graceful fallback to direct lookups if cache fails Fixes vmware-tanzu#9179 Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Add TestVolumeHelperImplWithCache_ShouldPerformSnapshot to verify: - Volume policy match with cache returns correct snapshot decision - fs-backup via opt-out with cache properly skips snapshot - Fallback to direct lookup when cache is not built These tests verify the cache-enabled code path added in the previous commit for improved volume policy performance. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Add TestVolumeHelperImplWithCache_ShouldPerformFSBackup to verify: - Volume policy match with cache returns correct fs-backup decision - Volume policy match with snapshot action skips fs-backup - Fallback to direct lookup when cache is not built Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Signed-off-by: Lyndon-Li <lyonghui@vmware.com>

Signed-off-by: allenxu404 <qix2@vmware.com>

add UBI dockerfiles Use numeric user for velero-restic-restore-helper Enable multiarch builds (openshift#135) Use arm64-graviton2 for arm builds (openshift#137) Add required keys for arm builds (openshift#139) Update Travis build job to work w/o changes on new branches Use a full VM for arm Use numeric non-root user for nonroot SCC compatibility

(cherry picked from commit ccb545f) Update PR-BZ automation mapping (openshift#84) (cherry picked from commit aa2b019) Update PR-BZ automation (openshift#92) Co-authored-by: Rayford Johnson <rjohnson@redhat.com> (cherry picked from commit ecc563f) Add publish workflow (openshift#108) (cherry picked from commit f87b779)

Code-gen no longer required on verify due to vmware-tanzu#6039 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> oadp-1.2: Update Makefile.prow to velero-restore-helper

…nshift#280) Signed-off-by: Scott Seago <sseago@redhat.com>

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Signed-off-by: Mateus Oliveira <msouzaol@redhat.com>

* fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> * fixup! fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> --------- Signed-off-by: Mateus Oliveira <msouzaol@redhat.com>

…#336) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

…openshift#334) (openshift#338) add missing unit test for kopia hashing algo (openshift#337) Introduction of downstream only option to override Kopia default: - hashing algorithm - splitting algorithm - encryption algorithm With introduction of 3 environment variables it is possible to override Kopia algorithms used by Velero: KOPIA_HASHING_ALGORITHM KOPIA_SPLITTER_ALGORITHM KOPIA_ENCRYPTION_ALGORITHM If the env algorithms are not set or they are not within Kopia SupportedAlgorithms, the default algorithm will be used. This behavior is consistent with current behavior without this change. Signed-off-by: Michal Pryc <mpryc@redhat.com> Signed-off-by: Shubham Pampattiwar <shubhampampattiwar7@gmail.com>

The rework of Makefile to make it more readable and inclusion of lint as a target as well extract golangci-lint version from the upstream Dockerfile, so we test in PROW or locally on the same version as upstream. Signed-off-by: Michal Pryc <mpryc@redhat.com>

This fixes the PR openshift#334 where one additional line was in the code. This was not exposed previously as we did not had downstream CI Lint jobs. Signed-off-by: Michal Pryc <mpryc@redhat.com>

* run oadp-operator e2e test from the velero repo execute openshift/oadp-operator e2e tests directly against the velero repo locally or via prow ci Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * update variable names, add a cleanup * make sure env variable overrides default velero_image Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * add options to build, push, and only test Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * add arch to name Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * remove duplicated clean/rm operator checkout * simplify by dropping export var and use a oneliner Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> * drop export and use oneliner Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> * just in case, allow oadp to be deployed from makefile Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * Update Makefile.prow Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> --------- Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>

…t#436) Signed-off-by: Scott Seago <sseago@redhat.com>

Fixes linting error. Signed-off-by: oadp-team-rebase-bot <oadp-maintainers@redhat.com>

openshift-ci · 2026-01-06T02:28:20Z

@oadp-rebasebot-app[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/lint	`b0be863`	link	true	`/test lint`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

shubham-pampattiwar and others added 9 commits December 2, 2025 11:37

Add changelog for PR vmware-tanzu#9321

60dd3dc

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

feat: add apply flag to install command

3244cc6

Signed-off-by: Micah Nagel <micah.nagel@defenseunicorns.com>

Add the node-agent ConfigMap document. (vmware-tanzu#9434)

fdcfed8

Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

Merge branch 'main' into dependabot/github_actions/actions/stale-10.1.1

4677689

Merge pull request vmware-tanzu#9446 from vmware-tanzu/dependabot/git…

c594026

…hub_actions/actions/stale-10.1.1 Bump actions/stale from 10.1.0 to 10.1.1

Merge pull request vmware-tanzu#9132 from mjnagel/crd-upgrade

554b04e

feat: add apply flag to install command

openshift-ci bot requested review from savitharaghunathan and shubham-pampattiwar December 11, 2025 02:08

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 11, 2025

blackpiglet and others added 7 commits December 11, 2025 17:56

Remove VolumeSnapshotClass from CSI restore and deletion process.

0964365

Remove VolumeSnapshotClass from backup sync process. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>

Merge pull request vmware-tanzu#9431 from vmware-tanzu/9033_fix

add66ea

Remove VolumeSnapshotClass from CSI B/R process.

Merge pull request vmware-tanzu#9321 from shubham-pampattiwar/fix-azu…

14b34f0

…re-bsl-status-message-8368 Sanitize Azure HTTP responses in BSL status messages

add comment for restic exec function

f30b9f9

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Update golangci-lint installation script URL to use HEAD for latest v…

a1026cb

…ersion (vmware-tanzu#9451) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

oadp-rebasebot-app bot changed the title ~~Merge https://github.com/vmware-tanzu/velero:main (554b04e) into oadp-dev~~ Merge https://github.com/vmware-tanzu/velero:main (a1026cb) into oadp-dev Dec 13, 2025

oadp-rebasebot-cloner bot force-pushed the rebase-bot-oadp-dev branch from 3f2fc43 to eaee76c Compare December 13, 2025 02:07

sseago approved these changes Dec 15, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 15, 2025

shubham-pampattiwar added 4 commits December 15, 2025 14:18

Add changelog for PR vmware-tanzu#9441

60203ad

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

Lyndon-Li and others added 27 commits January 6, 2026 02:06

udmrepo use region specified in BSL when s3URL is empty

dff5391

Signed-off-by: Lyndon-Li <lyonghui@vmware.com>

Change v1.12.1 changelog

0e42a9a

Signed-off-by: allenxu404 <qix2@vmware.com>

remove dependabot config from fork

14f528b

Create Makefile.prow

6ebe85a

Code-gen no longer required on verify due to vmware-tanzu#6039 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> oadp-1.2: Update Makefile.prow to velero-restore-helper

set HOME in velero image for kopia, update controller-gen for CI (ope…

eb917f8

…nshift#280) Signed-off-by: Scott Seago <sseago@redhat.com>

build velero-helper binary for datamover pod

026dd74

restore: Use warning when Create IsAlreadyExist and Get error

6a147cd

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

kopia/repository/config/aws.go: Set session.Options profile from config

a8b01f0

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

use ubi9-latest to build

2344b9c

OADP-4225: add tzdata to Dockerfile.ubi

e8f9f1e

fix: CI (openshift#316)

27c632f

Signed-off-by: Mateus Oliveira <msouzaol@redhat.com>

fix: ARM images (openshift#332)

00a9fac

* fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> * fixup! fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> --------- Signed-off-by: Mateus Oliveira <msouzaol@redhat.com>

ubi: BUILDPLATFORM to build stage to enable cross compile. (openshift…

15c31e7

…#336) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Downstream only - fix lint error in downtream change (openshift#343)

6ae71b2

This fixes the PR openshift#334 where one additional line was in the code. This was not exposed previously as we did not had downstream CI Lint jobs. Signed-off-by: Michal Pryc <mpryc@redhat.com>

DS Owners

a2e8d5c

updated controller-gen version

d393e94

Include velero-restore-helper binary in velero image (openshift#374)

a75fced

Fix restic checkout in Dockerfile.ubi to get default branch (openshif…

662a29c

…t#436) Signed-off-by: Scott Seago <sseago@redhat.com>

UPSTREAM: <drop>: Updating go modules

4cfc496

UPSTREAM: <drop>: update restic @ 8c4c3fbfe (branch oadp-dev)

9d03bcb

UPSTREAM: <carry> Use context from test for the kopia algorithms

60c8423

Fixes linting error. Signed-off-by: oadp-team-rebase-bot <oadp-maintainers@redhat.com>

UPSTREAM: <drop>: Updating go modules

b0be863

oadp-rebasebot-app bot changed the title ~~Merge https://github.com/vmware-tanzu/velero:main (3b5118b) into oadp-dev~~ Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev Jan 6, 2026

oadp-rebasebot-cloner bot force-pushed the rebase-bot-oadp-dev branch from 6f6f020 to b0be863 Compare January 6, 2026 02:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev #468

Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev #468

oadp-rebasebot-app bot commented Dec 11, 2025

Uh oh!

coderabbitai bot commented Dec 11, 2025 •

edited

Loading

Review skipped

Uh oh!

openshift-ci bot commented Dec 11, 2025

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

openshift-ci bot commented Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev #468

Are you sure you want to change the base?

Merge https://github.com/vmware-tanzu/velero:main (8f8367b) into oadp-dev #468

Conversation

oadp-rebasebot-app bot commented Dec 11, 2025

Uh oh!

coderabbitai bot commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci bot commented Dec 11, 2025

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

openshift-ci bot commented Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

coderabbitai bot commented Dec 11, 2025 •

edited

Loading