oadp 1.4 onboard nac by weshayutin · Pull Request #1957 · openshift/oadp-operator

weshayutin · 2025-09-15T21:55:22Z

Why the changes were made

Building off of @mpryc's draft pr
#1946

Engineering effort to backport self-service into OADP-1.4
Related to: openshift/release#69401 The openshift release updates

How to test the changes made

With my friends :)

openshift-ci · 2025-09-15T21:55:44Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weshayutin
Once this PR has been reviewed and has the lgtm label, please assign jwmatthews for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

weshayutin · 2025-09-15T22:00:33Z

root@fedora:~# oc whoami
nacuser1
root@fedora:~# oc get nonadminbackups
NAME                     REQUEST-PHASE   VELERO-PHASE   AGE
nacuser1-backup-1        Created         Completed      141m
nacuser1-backup-2        Created         Completed      38m
nacuser1-backup-3-data   Created         Completed      35m
root@fedora:~# oc get nonadminrestores.oadp.openshift.io 
NAME                     REQUEST-PHASE   VELERO-PHASE   AGE
mysql-nonadmin-restore   Created         Completed      17m

oc oadp backup describe nacuser1-nacuser1-backup-3-1a3d4da8-0f97-4117-a9c6-19e2c97d978a --details
Name:         nacuser1-nacuser1-backup-3-1a3d4da8-0f97-4117-a9c6-19e2c97d978a
Namespace:    openshift-adp
Labels:       app.kubernetes.io/managed-by=oadp-nac-controller
              openshift.io/oadp=True
              openshift.io/oadp-nab-origin-nacuuid=nacuser1-nacuser1-backup-3-1a3d4da8-0f97-4117-a9c6-19e2c97d978a
              velero.io/storage-location=nacuser1-nacuser1-eb2708a9-d502-4c08-9c7b-e9fe35f89e5b
Annotations:  openshift.io/oadp-nab-origin-name=nacuser1-backup-3-data
              openshift.io/oadp-nab-origin-namespace=nacuser1
              velero.io/resource-timeout=10m0s
              velero.io/source-cluster-k8s-gitversion=v1.31.9
              velero.io/source-cluster-k8s-major-version=1
              velero.io/source-cluster-k8s-minor-version=31

Phase:  Completed


Namespaces:
  Included:  nacuser1
  Excluded:  <none>

Resources:
  Included:        *
  Excluded:        nonadminbackups, nonadminrestores, nonadminbackupstoragelocations, securitycontextconstraints, clusterroles, clusterrolebindings, priorityclasses, customresourcedefinitions, virtualmachineclusterinstancetypes, virtualmachineclusterpreferences
  Cluster-scoped:  auto

Label selector:  <none>

Or label selector:  <none>

Storage Location:  nacuser1-nacuser1-eb2708a9-d502-4c08-9c7b-e9fe35f89e5b

Velero-Native Snapshot PVs:  auto
Snapshot Move Data:          false
Data Mover:                  velero

TTL:  720h0m0s

CSISnapshotTimeout:    10m0s
ItemOperationTimeout:  4h0m0s

Hooks:  <none>

Backup Format Version:  1.1.0

Started:    2025-09-15 15:21:53 -0600 MDT
Completed:  2025-09-15 15:22:59 -0600 MDT

Expiration:  2025-10-15 15:21:53 -0600 MDT

Total items to be backed up:  79
Items backed up:              79

Backup Item Operations:
  Operation for volumesnapshots.snapshot.storage.k8s.io nacuser1/velero-mysql-tsvzp:
    Backup Item Action Plugin:  velero.io/csi-volumesnapshot-backupper
    Operation ID:               nacuser1/velero-mysql-tsvzp/2025-09-15T21:21:59Z
    Items to Update:
              volumesnapshots.snapshot.storage.k8s.io nacuser1/velero-mysql-tsvzp
              volumesnapshotcontents.snapshot.storage.k8s.io /snapcontent-5b837c56-064e-4cf9-bb3e-f1ea1565ddf5
    Phase:    Completed
    Created:  2025-09-15 15:21:59 -0600 MDT
    Started:  2025-09-15 15:21:59 -0600 MDT
    Updated:  2025-09-15 15:22:58 -0600 MDT
Resource List:
  apps.openshift.io/v1/DeploymentConfig:
    - nacuser1/todolist
  apps/v1/Deployment:
    - nacuser1/mysql
  apps/v1/ReplicaSet:
    - nacuser1/mysql-65584f86fc
  authorization.openshift.io/v1/RoleBinding:
    - nacuser1/nacuser1
    - nacuser1/system:deployers
    - nacuser1/system:image-builders
    - nacuser1/system:image-pullers
  discovery.k8s.io/v1/EndpointSlice:
    - nacuser1/mysql-9pcxn
    - nacuser1/todolist-886lc
  rbac.authorization.k8s.io/v1/RoleBinding:
    - nacuser1/nacuser1
    - nacuser1/system:deployers
    - nacuser1/system:image-builders
    - nacuser1/system:image-pullers
  route.openshift.io/v1/Route:
    - nacuser1/todolist-route
  snapshot.storage.k8s.io/v1/VolumeSnapshot:
    - nacuser1/velero-mysql-tsvzp
  snapshot.storage.k8s.io/v1/VolumeSnapshotClass:
    - csi-aws-vsc
  snapshot.storage.k8s.io/v1/VolumeSnapshotContent:
    - snapcontent-5b837c56-064e-4cf9-bb3e-f1ea1565ddf5
  v1/ConfigMap:
    - nacuser1/kube-root-ca.crt
    - nacuser1/openshift-service-ca.crt
  v1/Endpoints:
    - nacuser1/mysql
    - nacuser1/todolist
  v1/Event:
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba5555aa740
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba5e057108c
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba658a58a92
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba65a99c9d1
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba966ff41e2
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba96d01204b
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba96d71759c
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba96d7dd714
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba97000c16d
    - nacuser1/mysql-65584f86fc-lhrz2.18658ba97063fbfb
    - nacuser1/mysql-65584f86fc.18658ba4a0d7b3d9
    - nacuser1/mysql.18658ba492925734
    - nacuser1/mysql.18658ba49c3e46fb
    - nacuser1/mysql.18658ba4a245e5c7
    - nacuser1/mysql.18658ba4a25a2835
    - nacuser1/mysql.18658ba52b023b5a
    - nacuser1/todolist-1-5nk8z.18658ba566e81765
    - nacuser1/todolist-1-5nk8z.18658ba57fee329d
    - nacuser1/todolist-1-5nk8z.18658ba5813dafcc
    - nacuser1/todolist-1-5nk8z.18658ba5dc515a3a
    - nacuser1/todolist-1-5nk8z.18658ba5e314ef08
    - nacuser1/todolist-1-5nk8z.18658ba5e37852d7
    - nacuser1/todolist-1-5nk8z.18658bae4a88acbc
    - nacuser1/todolist-1-5nk8z.18658baf3d50d69f
    - nacuser1/todolist-1-5nk8z.18658baf41803037
    - nacuser1/todolist-1-5nk8z.18658baf41e8102c
    - nacuser1/todolist-1-deploy.18658ba4a9a5ae7a
    - nacuser1/todolist-1-deploy.18658ba4c301b68a
    - nacuser1/todolist-1-deploy.18658ba4c460a197
    - nacuser1/todolist-1-deploy.18658ba558e9b41f
    - nacuser1/todolist-1-deploy.18658ba55e1abf3a
    - nacuser1/todolist-1-deploy.18658ba55e800d96
    - nacuser1/todolist-1.18658ba5665c109b
    - nacuser1/todolist.18658ba4a4f9c28a
    - nacuser1/velero-mysql-kgpxw.186591735faaaad1
    - nacuser1/velero-mysql-kgpxw.186591739b233dc2
    - nacuser1/velero-mysql-kgpxw.186591811d34e142
    - nacuser1/velero-mysql-t8xg5.18658bce187464b6
    - nacuser1/velero-mysql-t8xg5.18658bce51b672aa
    - nacuser1/velero-mysql-t8xg5.18658bdbd3a9638c
  v1/Namespace:
    - nacuser1
  v1/PersistentVolume:
    - pvc-6a0e5c64-ad6e-476d-a9ff-01ef338293a4
  v1/PersistentVolumeClaim:
    - nacuser1/mysql
  v1/Pod:
    - nacuser1/mysql-65584f86fc-lhrz2
    - nacuser1/todolist-1-5nk8z
    - nacuser1/todolist-1-deploy
  v1/ReplicationController:
    - nacuser1/todolist-1
  v1/Secret:
    - nacuser1/builder-dockercfg-bzs7l
    - nacuser1/cloud-credentials
    - nacuser1/default-dockercfg-7v7wn
    - nacuser1/deployer-dockercfg-k74pv
    - nacuser1/nacuser1-sa-dockercfg-mlcb5
  v1/Service:
    - nacuser1/mysql
    - nacuser1/todolist
  v1/ServiceAccount:
    - nacuser1/builder
    - nacuser1/default
    - nacuser1/deployer
    - nacuser1/nacuser1-sa

Backup Volumes:
  Velero-Native Snapshots: <none included>

  CSI Snapshots:
    nacuser1/mysql:
      Snapshot:
        Operation ID: nacuser1/velero-mysql-tsvzp/2025-09-15T21:21:59Z
        Snapshot Content Name: snapcontent-5b837c56-064e-4cf9-bb3e-f1ea1565ddf5
        Storage Snapshot ID: snap-007f4be152abe7556
        Snapshot Size (bytes): 1073741824
        CSI Driver: ebs.csi.aws.com
        Result: 

  Pod Volume Backups: <none included>

HooksAttempted:  0
HooksFailed:     0

 oc get nonadminbackups nacuser1-backup-3-data -o yaml
apiVersion: oadp.openshift.io/v1alpha1
kind: NonAdminBackup
metadata:
  creationTimestamp: "2025-09-15T21:21:53Z"
  finalizers:
  - nonadminbackup.oadp.openshift.io/finalizer
  generation: 2
  name: nacuser1-backup-3-data
  namespace: nacuser1
  resourceVersion: "2321392"
  uid: 161aa7b3-df1a-4aad-b248-82c2d1eec872
spec:
  backupSpec:
    csiSnapshotTimeout: 0s
    hooks: {}
    includedNamespaces:
    - nacuser1
    itemOperationTimeout: 0s
    metadata: {}
    storageLocation: nacuser1
    ttl: 720h0m0s
status:
  conditions:
  - lastTransitionTime: "2025-09-15T21:21:53Z"
    message: backup accepted
    reason: BackupAccepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2025-09-15T21:21:53Z"
    message: Created Velero Backup object
    reason: BackupScheduled
    status: "True"
    type: Queued
  dataMoverDataUploads: {}
  fileSystemPodVolumeBackups: {}
  phase: Created
  queueInfo:
    estimatedQueuePosition: 0
  veleroBackup:
    nacuuid: nacuser1-nacuser1-backup-3-1a3d4da8-0f97-4117-a9c6-19e2c97d978a
    name: nacuser1-nacuser1-backup-3-1a3d4da8-0f97-4117-a9c6-19e2c97d978a
    namespace: openshift-adp
    spec:
      csiSnapshotTimeout: 10m0s
      defaultVolumesToFsBackup: false
      excludedResources:
      - nonadminbackups
      - nonadminrestores
      - nonadminbackupstoragelocations
      - securitycontextconstraints
      - clusterroles
      - clusterrolebindings
      - priorityclasses
      - customresourcedefinitions
      - virtualmachineclusterinstancetypes
      - virtualmachineclusterpreferences
      hooks: {}
      includedNamespaces:
      - nacuser1
      itemOperationTimeout: 4h0m0s
      metadata: {}
      snapshotMoveData: false
      storageLocation: nacuser1-nacuser1-eb2708a9-d502-4c08-9c7b-e9fe35f89e5b
      ttl: 720h0m0s
      volumeSnapshotLocations:
      - dpa-sample-1
    status:
      backupItemOperationsAttempted: 1
      backupItemOperationsCompleted: 1
      completionTimestamp: "2025-09-15T21:22:59Z"
      csiVolumeSnapshotsAttempted: 1
      csiVolumeSnapshotsCompleted: 1
      expiration: "2025-10-15T21:21:53Z"
      formatVersion: 1.1.0
      hookStatus: {}
      phase: Completed
      progress:
        itemsBackedUp: 79
        totalItems: 79
      startTimestamp: "2025-09-15T21:21:53Z"
      version: 1

Still seeing a trace in non-admin-controller but things work..

name":"mysql-nonadmin-restore","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "mysql-nonadmin-restore", "reconcileID": "af7f1165-1ad0-4527-af22-4f16b330f83d", "error": "Operation cannot be fulfilled on nonadminrestores.oadp.openshift.io \"mysql-nonadmin-restore\": the object has been modified; please apply your changes to the latest version and try again"}
github.com/migtools/oadp-non-admin/internal/controller.(*NonAdminRestoreReconciler).createVeleroRestore
	/workspace/internal/controller/nonadminrestore_controller.go:425
github.com/migtools/oadp-non-admin/internal/controller.(*NonAdminRestoreReconciler).Reconcile
	/workspace/internal/controller/nonadminrestore_controller.go:111
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:116
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:303
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224
2025-09-15T21:40:09.436Z	ERROR	Reconciler error	{"controller": "nonadminrestore", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminRestore", "NonAdminRestore": {"name":"mysql-nonadmin-restore","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "mysql-nonadmin-restore", "reconcileID": "af7f1165-1ad0-4527-af22-4f16b330f83d", "error": "Operation cannot be fulfilled on nonadminrestores.oadp.openshift.io \"mysql-nonadmin-restore\": the object has been modified; please apply your changes to the latest version and try again"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224

Signed-off-by: Michal Pryc <mpryc@redhat.com>

weshayutin · 2025-09-17T18:28:29Z

test bsl approval

  logFormat: text
  nonAdmin:
    enable: true
    requireApprovalForBSL: true
  snapshotLocations:
  - velero:
      config:

root@fedora:/home/whayutin/OADP/NAC/TEST# oc create -f nabsl.yaml 
nonadminbackupstoragelocation.oadp.openshift.io/nacuser1 created
root@fedora:/home/whayutin/OADP/NAC/TEST# oc get nonadminbackupstoragelocation
NAME       REQUEST-APPROVED   REQUEST-PHASE   VELERO-PHASE   AGE
nacuser1   False              New                            10s

root@fedora:/home/whayutin/OADP/NAC/TEST# cat nabsl.yaml 
apiVersion: oadp.openshift.io/v1alpha1
kind: NonAdminBackupStorageLocation
metadata:
  name: nacuser1
  namespace: nacuser1
spec: 
  backupStorageLocationSpec:
    config:
#      checksumAlgorithm: ""
#      profile: default
      region: us-west-2
    credential:
      key: cloud
      name: cloud-credentials
    objectStorage:
      bucket: wesoadpnacuser1
      prefix: velero
    provider: aws  
root@fedora:/home/whayutin/OADP/NAC/TEST# oc whoami 
nacuser1
root@fedora:/home/whayutin/OADP/NAC/TEST# oc get nonadminbackupstoragelocation
NAME       REQUEST-APPROVED   REQUEST-PHASE   VELERO-PHASE   AGE
nacuser1   False              New                            95s
root@fedora:/home/whayutin/OADP/NAC/TEST# oc get nonadminbackupstoragelocation nacuser1 -o yaml
apiVersion: oadp.openshift.io/v1alpha1
kind: NonAdminBackupStorageLocation
metadata:
  creationTimestamp: "2025-09-17T18:21:01Z"
  finalizers:
  - nonadminbackupstoragelocation.oadp.openshift.io/finalizer
  generation: 1
  name: nacuser1
  namespace: nacuser1
  resourceVersion: "3034139"
  uid: 1f078a21-77cb-4a24-89a2-833c3b54b88c
spec:
  backupStorageLocationSpec:
    config:
      region: us-west-2
    credential:
      key: cloud
      name: cloud-credentials
    objectStorage:
      bucket: wesoadpnacuser1
      prefix: velero
    provider: aws
status:
  conditions:
  - lastTransitionTime: "2025-09-17T18:21:01Z"
    message: NonAdminBackupStorageLocation spec validation successful
    reason: BslSpecValidation
    status: "True"
    type: Accepted
  - lastTransitionTime: "2025-09-17T18:21:01Z"
    message: NonAdminBackupStorageLocationRequest approval pending
    reason: BslSpecApprovalPending
    status: "False"
    type: ClusterAdminApproved
  phase: New
  veleroBackupStorageLocation:
    nacuuid: nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d
    name: nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d
    namespace: openshift-adp
root@fedora:/home/whayutin/OADP/NAC/TEST#

admin check

whayutin@fedora:~/OPENSHIFT/git/OADP/oadp-operator$ oc get nonadminbackupstoragelocationrequests.oadp.openshift.io 
NAME                                                     REQUEST-PHASE   REQUEST-NAMESPACE   REQUEST-NAME   AGE
nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d   Pending         nacuser1            nacuser1       3m7s
whayutin@fedora:~/OPENSHIFT/git/OADP/oadp-operator$ oc whoami
kube:admin

now approve

2025-09-17T18:26:50.043Z	INFO	Velero BSL Secret with label not found, creating one	{"controller": "nonadminbackupstoragelocation", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackupStorageLocation", "NonAdminBackupStorageLocation": {"name":"nacuser1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1", "reconcileID": "1a4a0a03-b285-46a1-8738-6707bfab3412", "oadpnamespace": "openshift-adp", "UUID": "nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d"}
2025-09-17T18:26:50.058Z	INFO	Velero BSL with label not found, creating one	{"controller": "nonadminbackupstoragelocation", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackupStorageLocation", "NonAdminBackupStorageLocation": {"name":"nacuser1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1", "reconcileID": "1a4a0a03-b285-46a1-8738-6707bfab3412", "oadpnamespace": "openshift-adp", "UUID": "nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d"}

oc get bsl
NAME                                                     PHASE       LAST VALIDATED   AGE   DEFAULT
dpa-sample-1                                             Available   10s              27m   true
nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d   Available   50s              50s   
whayutin@fedora:~/OPENSHIFT/git/OADP/oadp-operator$

Using project "nacuser1".
root@fedora:~# whoami
root
root@fedora:~# oc get nonadminbackupstoragelocation
NAME       REQUEST-APPROVED   REQUEST-PHASE   VELERO-PHASE   AGE
nacuser1   True               Created         Available      7m9s
root@fedora:~#

weshayutin · 2025-09-17T18:39:51Z

test backup spec enformacement

  logFormat: text
  nonAdmin:
    enable: true
    enforceBackupSpec:
      snapshotMoveData: true
    requireApprovalForBSL: true
  snapshotLocations:
  - velero:

 cat backup_nacuser1.yaml 
apiVersion: oadp.openshift.io/v1alpha1
kind: NonAdminBackup
metadata:
  name: nacuser1-backup-enforcement-dm-1
  namespace: nacuser1
spec: 
  backupSpec:
    includedNamespaces:
    - nacuser1
    storageLocation: nacuser1
    ttl: 720h0m0s

oc get nonadminbackups
No resources found in nacuser1 namespace.
root@fedora:/home/whayutin/OADP/NAC/TEST# oc whoami
nacuser1
root@fedora:/home/whayutin/OADP/NAC/TEST# oc create -f backup_nacuser1.yaml 
nonadminbackup.oadp.openshift.io/nacuser1-backup-enforcement-dm-1 created
root@fedora:/home/whayutin/OADP/NAC/TEST# oc get nonadminbackups
NAME                               REQUEST-PHASE   VELERO-PHASE   AGE
nacuser1-backup-enforcement-dm-1   Created         InProgress     5s

 oc get datauploads.velero.io -n openshift-adp
NAME                                                              STATUS       STARTED   BYTES DONE   TOTAL BYTES   STORAGE LOCATION                                         AGE   NODE
nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29rf9md   InProgress   3s        1010                       nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d   44s   ip-10-0-51-71.us-west-2.compute.internal
whayutin@fedora:~/OPENSHIFT/git/OADP/oadp-operator$

apiVersion: oadp.openshift.io/v1alpha1
kind: NonAdminBackup
metadata:
  creationTimestamp: "2025-09-17T18:36:36Z"
  finalizers:
  - nonadminbackup.oadp.openshift.io/finalizer
  generation: 2
  name: nacuser1-backup-enforcement-dm-1
  namespace: nacuser1
  resourceVersion: "3038848"
  uid: 6aa95720-a119-47da-9453-bb99e2eaa3b3
spec:
  backupSpec:
    csiSnapshotTimeout: 0s
    hooks: {}
    includedNamespaces:
    - nacuser1
    itemOperationTimeout: 0s
    metadata: {}
    storageLocation: nacuser1
    ttl: 720h0m0s
status:
  conditions:
  - lastTransitionTime: "2025-09-17T18:36:36Z"
    message: backup accepted
    reason: BackupAccepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2025-09-17T18:36:36Z"
    message: Created Velero Backup object
    reason: BackupScheduled
    status: "True"
    type: Queued
  dataMoverDataUploads:
    completed: 1
    total: 1
  fileSystemPodVolumeBackups: {}
  phase: Created
  queueInfo:
    estimatedQueuePosition: 0
  veleroBackup:
    nacuuid: nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29a1b45
    name: nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29a1b45
    namespace: openshift-adp
    spec:
      csiSnapshotTimeout: 10m0s
      defaultVolumesToFsBackup: false
      excludedResources:
      - nonadminbackups
      - nonadminrestores
      - nonadminbackupstoragelocations
      - securitycontextconstraints
      - clusterroles
      - clusterrolebindings
      - priorityclasses
      - customresourcedefinitions
      - virtualmachineclusterinstancetypes
      - virtualmachineclusterpreferences
      hooks: {}
      includedNamespaces:
      - nacuser1
      itemOperationTimeout: 4h0m0s
      metadata: {}
      snapshotMoveData: true
      storageLocation: nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d
      ttl: 720h0m0s
      volumeSnapshotLocations:
      - dpa-sample-1
    status:
      backupItemOperationsAttempted: 1
      backupItemOperationsCompleted: 1
      completionTimestamp: "2025-09-17T18:37:30Z"
      expiration: "2025-10-17T18:36:36Z"
      formatVersion: 1.1.0
      hookStatus: {}
      phase: Completed
      progress:
        itemsBackedUp: 36
        totalItems: 36
      startTimestamp: "2025-09-17T18:36:36Z"
      version: 1

Name:         nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29a1b45
Namespace:    openshift-adp
Labels:       app.kubernetes.io/managed-by=oadp-nac-controller
              openshift.io/oadp=True
              openshift.io/oadp-nab-origin-nacuuid=nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29a1b45
              velero.io/storage-location=nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d
Annotations:  openshift.io/oadp-nab-origin-name=nacuser1-backup-enforcement-dm-1
              openshift.io/oadp-nab-origin-namespace=nacuser1
              velero.io/resource-timeout=10m0s
              velero.io/source-cluster-k8s-gitversion=v1.31.9
              velero.io/source-cluster-k8s-major-version=1
              velero.io/source-cluster-k8s-minor-version=31

Phase:  Completed


Namespaces:
  Included:  nacuser1
  Excluded:  <none>

Resources:
  Included:        *
  Excluded:        nonadminbackups, nonadminrestores, nonadminbackupstoragelocations, securitycontextconstraints, clusterroles, clusterrolebindings, priorityclasses, customresourcedefinitions, virtualmachineclusterinstancetypes, virtualmachineclusterpreferences
  Cluster-scoped:  auto

Label selector:  <none>

Or label selector:  <none>

Storage Location:  nacuser1-nacuser1-621cb975-ee33-407d-b222-ea4c33ffc66d

Velero-Native Snapshot PVs:  auto
Snapshot Move Data:          true
Data Mover:                  velero

TTL:  720h0m0s

CSISnapshotTimeout:    10m0s
ItemOperationTimeout:  4h0m0s

Hooks:  <none>

Backup Format Version:  1.1.0

Started:    2025-09-17 12:36:36 -0600 MDT
Completed:  2025-09-17 12:37:30 -0600 MDT

Expiration:  2025-10-17 12:36:36 -0600 MDT

Total items to be backed up:  36
Items backed up:              36

Backup Item Operations:
  Operation for persistentvolumeclaims nacuser1/mysql:
    Backup Item Action Plugin:  velero.io/csi-pvc-backupper
    Operation ID:               du-f691b0d0-01c4-49f1-a2a4-cb3936b2f4fb.44bf8df2-5ab0-4be942149
    Items to Update:
                           datauploads.velero.io openshift-adp/nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29rf9md
    Phase:                 Completed
    Progress:              108267998 of 108267998 complete (Bytes)
    Progress description:  Completed
    Created:               2025-09-17 12:36:43 -0600 MDT
    Started:               2025-09-17 12:37:24 -0600 MDT
    Updated:               2025-09-17 12:37:28 -0600 MDT
Resource List:
  apps.openshift.io/v1/DeploymentConfig:
    - nacuser1/todolist
  apps/v1/Deployment:
    - nacuser1/mysql
  apps/v1/ReplicaSet:
    - nacuser1/mysql-65584f86fc
  authorization.openshift.io/v1/RoleBinding:
    - nacuser1/nacuser1
    - nacuser1/system:deployers
    - nacuser1/system:image-builders
    - nacuser1/system:image-pullers
  discovery.k8s.io/v1/EndpointSlice:
    - nacuser1/mysql-rbcwz
    - nacuser1/todolist-zjp5l
  rbac.authorization.k8s.io/v1/RoleBinding:
    - nacuser1/nacuser1
    - nacuser1/system:deployers
    - nacuser1/system:image-builders
    - nacuser1/system:image-pullers
  route.openshift.io/v1/Route:
    - nacuser1/todolist-route
  v1/ConfigMap:
    - nacuser1/kube-root-ca.crt
    - nacuser1/openshift-service-ca.crt
  v1/Endpoints:
    - nacuser1/mysql
    - nacuser1/todolist
  v1/Namespace:
    - nacuser1
  v1/PersistentVolume:
    - pvc-44bf8df2-5ab0-4be8-946b-d67da71f7cc9
  v1/PersistentVolumeClaim:
    - nacuser1/mysql
  v1/Pod:
    - nacuser1/mysql-65584f86fc-lhrz2
    - nacuser1/todolist-1-deploy
    - nacuser1/todolist-1-jdpsw
  v1/ReplicationController:
    - nacuser1/todolist-1
  v1/Secret:
    - nacuser1/builder-dockercfg-bzs7l
    - nacuser1/cloud-credentials
    - nacuser1/default-dockercfg-7v7wn
    - nacuser1/deployer-dockercfg-k74pv
    - nacuser1/nacuser1-sa-dockercfg-mlcb5
  v1/Service:
    - nacuser1/mysql
    - nacuser1/todolist
  v1/ServiceAccount:
    - nacuser1/builder
    - nacuser1/default
    - nacuser1/deployer
    - nacuser1/nacuser1-sa

Backup Volumes:
  Velero-Native Snapshots: <none included>

  CSI Snapshots:
    nacuser1/mysql:
      Data Movement:
        Operation ID: du-f691b0d0-01c4-49f1-a2a4-cb3936b2f4fb.44bf8df2-5ab0-4be942149
        Data Mover: velero
        Uploader Type: kopia
        Moved data Size (bytes): 108267998
        Result: 

  Pod Volume Backups: <none included>

HooksAttempted:  0
HooksFailed:     0

weshayutin · 2025-09-17T19:32:12Z

crd/v1/bases/velero.io_backups.yaml diff 1.4 -> 1.5

diff --git a/velero.io_backups.yaml b/home/whayutin/OPENSHIFT/git/OADP/velero/config/crd/v1/bases/velero.io_backups.yaml
index 1e79dcdea..9a2a88e3f 100644
--- a/velero.io_backups.yaml
+++ b/home/whayutin/OPENSHIFT/git/OADP/velero/config/crd/v1/bases/velero.io_backups.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: backups.velero.io
 spec:
   group: velero.io
@@ -63,7 +63,6 @@ spec:
                   DefaultVolumesToRestic specifies whether restic should be used to take a
                   backup of all pod volumes by default.
 
-
                   Deprecated: this field is no longer used and will be removed entirely in future. Use DefaultVolumesToFsBackup instead.
                 nullable: true
                 type: boolean
@@ -176,11 +175,13 @@ spec:
                                     items:
                                       type: string
                                     type: array
+                                    x-kubernetes-list-type: atomic
                                 required:
                                 - key
                                 - operator
                                 type: object
                               type: array
+                              x-kubernetes-list-type: atomic
                             matchLabels:
                               additionalProperties:
                                 type: string
@@ -364,11 +365,13 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: atomic
                       required:
                       - key
                       - operator
                       type: object
                     type: array
+                    x-kubernetes-list-type: atomic
                   matchLabels:
                     additionalProperties:
                       type: string
@@ -425,11 +428,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                         - key
                         - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string

```

weshayutin · 2025-09-17T19:35:33Z

currently investigating the following:

025-09-17T18:33:29.871Z	INFO	Starting workers	{"controller": "nonadminbackup", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackup", "worker count": 1}
2025-09-17T18:33:29.871Z	INFO	Starting workers	{"controller": "nonadminbackupstoragelocation", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackupStorageLocation", "worker count": 1}
2025-09-17T18:36:36.103Z	INFO	VeleroBackup with label not found, creating one	{"controller": "nonadminbackup", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackup", "NonAdminBackup": {"name":"nacuser1-backup-enforcement-dm-1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1-backup-enforcement-dm-1", "reconcileID": "66a7acd9-2e56-48f2-afce-72cd36a505a6", "UUID": "nacuser1-nacuser1-backup-e-b9a51801-1db9-4e31-af75-201bf29a1b45"}
2025-09-17T18:36:36.110Z	INFO	VeleroBackup successfully created	{"controller": "nonadminbackup", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackup", "NonAdminBackup": {"name":"nacuser1-backup-enforcement-dm-1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1-backup-enforcement-dm-1", "reconcileID": "66a7acd9-2e56-48f2-afce-72cd36a505a6"}
2025-09-17T18:36:43.331Z	ERROR	Failed to update NonAdminBackup Status	{"controller": "nonadminbackup", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackup", "NonAdminBackup": {"name":"nacuser1-backup-enforcement-dm-1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1-backup-enforcement-dm-1", "reconcileID": "9a81bf6f-f365-4ad8-9a54-56ea94a4af8a", "error": "Operation cannot be fulfilled on nonadminbackups.oadp.openshift.io \"nacuser1-backup-enforcement-dm-1\": the object has been modified; please apply your changes to the latest version and try again"}
github.com/migtools/oadp-non-admin/internal/controller.(*NonAdminBackupReconciler).createVeleroBackupAndSyncWithNonAdminBackup
	/workspace/internal/controller/nonadminbackup_controller.go:802
github.com/migtools/oadp-non-admin/internal/controller.(*NonAdminBackupReconciler).Reconcile
	/workspace/internal/controller/nonadminbackup_controller.go:162
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:116
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:303
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224
2025-09-17T18:36:43.331Z	ERROR	Reconciler error	{"controller": "nonadminbackup", "controllerGroup": "oadp.openshift.io", "controllerKind": "NonAdminBackup", "NonAdminBackup": {"name":"nacuser1-backup-enforcement-dm-1","namespace":"nacuser1"}, "namespace": "nacuser1", "name": "nacuser1-backup-enforcement-dm-1", "reconcileID": "9a81bf6f-f365-4ad8-9a54-56ea94a4af8a", "error": "Operation cannot be fulfilled on nonadminbackups.oadp.openshift.io \"nacuser1-backup-enforcement-dm-1\": the object has been modified; please apply your changes to the latest version and try again"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224

Testing w/ migtools/oadp-non-admin#314

mpryc · 2025-09-17T21:22:12Z

> # crd/v1/bases/velero.io_backups.yaml diff 1.4 -> 1.5
> +                                    x-kubernetes-list-type: atomic

This should be backwards and forwards compatible. atomic is for patching - it will cause entire list to be replaced during update/patch. I think it was introduced to this CRD by by kubernetes-sigs/controller-tools#753

weshayutin · 2025-09-26T16:57:29Z

/retest

weshayutin · 2025-09-26T20:06:37Z

additional testing documented here https://hackmd.io/Wk845n48RDeLojOj038VmA

weshayutin · 2025-10-09T17:57:00Z

/retest all

openshift-ci · 2025-10-09T17:57:10Z

@weshayutin: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test 4.18-ci-index

/test 4.18-images

/test images

/test unit-test

The following commands are available to trigger optional jobs:

/test 4.18-e2e-test-aws

/test 4.18-e2e-test-hcp-aws

Use /test all to run all jobs.

Details

In response to this:

/retest all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

weshayutin · 2025-10-09T17:57:26Z

/test all

openshift-ci · 2025-10-09T18:33:56Z

@weshayutin: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.18-e2e-test-aws	`7139994`	link	false	`/test 4.18-e2e-test-aws`
ci/prow/4.18-e2e-test-hcp-aws	`7139994`	link	false	`/test 4.18-e2e-test-hcp-aws`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

weshayutin · 2025-10-16T17:59:46Z

/retest

openshift-merge-robot · 2025-10-16T17:59:55Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot requested review from kaovilai and savitharaghunathan September 15, 2025 21:55

weshayutin added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 15, 2025

weshayutin changed the title ~~Wes oadp 1.4 onboard nac~~ DRAFT oadp 1.4 onboard nac Sep 15, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 17, 2025

mpryc and others added 3 commits September 17, 2025 11:09

Initial Non-Admin onboard to oadp-1.4

cc4ca37

Signed-off-by: Michal Pryc <mpryc@redhat.com>

pod/non-admin-controller-74775c6977-2mncl running

4226e63

more refactor and compare against 1.5

6af3a5f

weshayutin force-pushed the wes-oadp-1.4-onboard-nac branch from 274102d to 6af3a5f Compare September 17, 2025 17:12

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 17, 2025

weshayutin mentioned this pull request Sep 17, 2025

add prow for oadp-non-admin 1.4 openshift/release#69401

Merged

Merge branch 'oadp-1.4' into wes-oadp-1.4-onboard-nac

7139994

weshayutin changed the title ~~DRAFT oadp 1.4 onboard nac~~ oadp 1.4 onboard nac Sep 26, 2025

weshayutin removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 26, 2025

weshayutin added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 16, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 16, 2025

weshayutin closed this Nov 17, 2025

Conversation

weshayutin commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why the changes were made

How to test the changes made

Uh oh!

openshift-ci bot commented Sep 15, 2025

Uh oh!

weshayutin commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

weshayutin commented Sep 17, 2025

test bsl approval

admin check

now approve

Uh oh!

weshayutin commented Sep 17, 2025

test backup spec enformacement

Uh oh!

weshayutin commented Sep 17, 2025

crd/v1/bases/velero.io_backups.yaml diff 1.4 -> 1.5

Uh oh!

weshayutin commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

currently investigating the following:

Uh oh!

mpryc commented Sep 17, 2025

Uh oh!

weshayutin commented Sep 26, 2025

Uh oh!

weshayutin commented Sep 26, 2025

Uh oh!

weshayutin commented Oct 9, 2025

Uh oh!

openshift-ci bot commented Oct 9, 2025

Uh oh!

weshayutin commented Oct 9, 2025

Uh oh!

openshift-ci bot commented Oct 9, 2025

Uh oh!

weshayutin commented Oct 16, 2025

Uh oh!

openshift-merge-robot commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

weshayutin commented Sep 15, 2025 •

edited

Loading

weshayutin commented Sep 15, 2025 •

edited

Loading

weshayutin commented Sep 17, 2025 •

edited

Loading