chore(velero): bump velero to 12.0.3 - #2974
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughUpgrades the Velero Helm chart from version 11.0.0/appVersion 1.17.0 to 12.0.3/appVersion 1.18.1. The change adds CRD schema fields (queuePosition, phase enums, caCertRef, incremental bytes), refactors cleanup-crds and upgrade-crds job templates, introduces ChangesVelero v1.18.1 upgrade
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the Velero package to the latest upstream version to incorporate critical security fixes and maintain compatibility with newer plugin releases. It also formalizes the testing process for the chart to prevent future regressions in deployment configuration. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request adds a new test target to the Velero package Makefile and pins the upstream Velero Helm chart version to 12.0.3. It also updates the backup-plugin initContainer images in values.yaml to newer compatible versions and introduces a new Helm unit test suite to verify key rendering invariants, such as image pinning and the exclusion of the upgrade-crds Job. There are no review comments, and the changes look solid, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/system/velero/tests/velero_test.yaml (1)
6-37: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winAdd regression assertions for the new value knobs introduced in this PR.
The suite currently pins images and
upgradeCRDs: false, but it does not lock behavior forconfiguration.backupStorageLocation[].backupSyncPeriodornodeAgent.disableHostPath. Adding one assertion per knob would prevent silent regressions in the exact areas this upgrade introduces.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/velero/tests/velero_test.yaml` around lines 6 - 37, Add regression test assertions for the two new configuration knobs introduced in this PR. Create or extend test cases in the velero_test.yaml file to add equal assertions that pin the expected values for configuration.backupStorageLocation[].backupSyncPeriod and nodeAgent.disableHostPath, similar to the existing pattern used in the "renders the velero server Deployment on the pinned upstream image" and "pins the backup-plugin initContainers to velero-1.18-compatible releases" test cases. Each assertion should specify the path to the configuration option and its expected value to prevent silent regressions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@packages/system/velero/charts/velero/templates/label-namespace/labelnamespace.yaml`:
- Around line 31-37: The kubectl label command in the args list of the
labelnamespace.yaml template is missing the --overwrite flag, which causes the
hook to fail on subsequent runs when labels already exist on the namespace. Add
the --overwrite flag as an argument in the args list immediately after the label
argument and before the namespace argument to make the label operation
idempotent and upgrade-safe.
---
Nitpick comments:
In `@packages/system/velero/tests/velero_test.yaml`:
- Around line 6-37: Add regression test assertions for the two new configuration
knobs introduced in this PR. Create or extend test cases in the velero_test.yaml
file to add equal assertions that pin the expected values for
configuration.backupStorageLocation[].backupSyncPeriod and
nodeAgent.disableHostPath, similar to the existing pattern used in the "renders
the velero server Deployment on the pinned upstream image" and "pins the
backup-plugin initContainers to velero-1.18-compatible releases" test cases.
Each assertion should specify the path to the configuration option and its
expected value to prevent silent regressions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9efce91e-1431-44fd-8bdd-085ab38b55b1
📒 Files selected for processing (33)
packages/system/velero/Makefilepackages/system/velero/charts/velero/Chart.yamlpackages/system/velero/charts/velero/ci/test-values.yamlpackages/system/velero/charts/velero/crds/backuprepositories.yamlpackages/system/velero/charts/velero/crds/backups.yamlpackages/system/velero/charts/velero/crds/backupstoragelocations.yamlpackages/system/velero/charts/velero/crds/datadownloads.yamlpackages/system/velero/charts/velero/crds/datauploads.yamlpackages/system/velero/charts/velero/crds/deletebackuprequests.yamlpackages/system/velero/charts/velero/crds/downloadrequests.yamlpackages/system/velero/charts/velero/crds/podvolumebackups.yamlpackages/system/velero/charts/velero/crds/podvolumerestores.yamlpackages/system/velero/charts/velero/crds/restores.yamlpackages/system/velero/charts/velero/crds/schedules.yamlpackages/system/velero/charts/velero/crds/serverstatusrequests.yamlpackages/system/velero/charts/velero/crds/volumesnapshotlocations.yamlpackages/system/velero/charts/velero/templates/_helpers.tplpackages/system/velero/charts/velero/templates/backupstoragelocation.yamlpackages/system/velero/charts/velero/templates/cleanup-crds.yamlpackages/system/velero/charts/velero/templates/configmaps.yamlpackages/system/velero/charts/velero/templates/label-namespace/labelnamespace.yamlpackages/system/velero/charts/velero/templates/node-agent-daemonset.yamlpackages/system/velero/charts/velero/templates/podmonitor.yamlpackages/system/velero/charts/velero/templates/prometheusrule.yamlpackages/system/velero/charts/velero/templates/schedule.yamlpackages/system/velero/charts/velero/templates/service.yamlpackages/system/velero/charts/velero/templates/servicemonitor.yamlpackages/system/velero/charts/velero/templates/upgrade-crds/upgrade-crds.yamlpackages/system/velero/charts/velero/templates/volumesnapshotlocation.yamlpackages/system/velero/charts/velero/values.schema.jsonpackages/system/velero/charts/velero/values.yamlpackages/system/velero/tests/velero_test.yamlpackages/system/velero/values.yaml
Re-vendors the velero chart from 11.0.0 to 12.0.3 (app 1.17.0 -> 1.18.1) and
moves the backup-plugin initContainers to the matching releases:
velero-plugin-for-aws v1.12.1 -> v1.14.1 (the release that bumps to velero
1.18.1) and kubevirt-velero-plugin v0.8.0 -> v0.9.0. The chart-major bump's
values-schema changes are backward-compatible (two required fields relaxed,
one optional key added), so all cozystack overrides (upgradeCRDs,
initContainers, configuration.{features,defaultItemOperationTimeout},
deployNodeAgent) stay valid. The 1.18 "PVC selected-node" deprecation needs no
action (velero handles it transparently); the CRD changes are additive.
Adds helm-unittest coverage (the package shipped none): pins the server and
plugin image tags and the upgradeCRDs=false -> no upgrade-crds Job invariant,
which has silently regressed before. Pins the update target's helm pull to an
explicit chart version so re-vendoring is reproducible.
Note: Helm v3 does not update CRDs on `helm upgrade` (upgradeCRDs is disabled);
the 1.18 CRDs must be applied manually on existing clusters.
Adaptations:
- charts/: re-vendored via make update (helm pull velero --version 12.0.3)
- values.yaml: plugin images to velero-1.18-compatible releases
- Makefile: pin update target to --version 12.0.3; add test target
- tests/velero_test.yaml: new helm-unittest coverage
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
676709d to
6da7e91
Compare
The comment justified upgradeCRDs: false by a kubectl-image-compatibility problem in the upgrade-crds Job. That rationale is obsolete in velero 12.x: the Job now runs the velero image natively, not a kubectl image. The real, current reason the Job stays disabled is that CRDs ship via the chart's crds/ directory, making the Job redundant. Correct both the values.yaml override comment and the helm-unittest comment to match. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
myasnikovdaniil
left a comment
There was a problem hiding this comment.
LGTM. Verified end-to-end.
Versions / re-vendoring — all claims check out: chart 12.0.3, appVersion/server 1.18.1, AWS plugin v1.14.1, kubevirt plugin v0.9.0. The vendored charts/velero/ tree is byte-for-byte identical to upstream tanzu/velero 12.0.3 (diff -rq clean) — no local patches; all cozystack overrides correctly live in the package values.yaml. Pinning --version 12.0.3 in the Makefile is a nice reproducibility win.
CRD migration safety — additive only. Confirmed across all 14 CRD diffs: no field removals, no new required fields, no enum values dropped (the backups phase enum gains Queued/ReadyToStart), no validation tightening. Removed lines are all reflowed description: text. New optional fields: caCertRef on BSL (with caCert deprecated-but-retained), queuePosition, and several int64 status fields. No standalone CSI plugin referenced — correctly relies on CSI-in-core (merged 1.14) with features: EnableCSI; the running server registers the built-in csi-* plugins.
Tests — the new helm unittest suite pins meaningful invariants (server + both plugin image tags, and the upgradeCRDs: false → no upgrade-crds Job regression guard). Mutation-checked locally: flipping the AWS plugin tag and flipping upgradeCRDs both correctly fail the suite. 3/3 pass.
dev10 verification — deployed the bumped chart into an isolated namespace: server v1.18.1 1/1, both plugin init-containers exit 0, node-agent 3/3 ready, EnableCSI active. All 1.18 CRDs apply cleanly against the live API server (server-dry-run, --force-conflicts) with no schema conflict against the existing BSL object. Did not exercise a real backup/restore — dev10's BSL is independently Unavailable (stale S3 key), unrelated to this PR.
One informational note on the upgrade path (left inline). Approving.
| # the Job is redundant. (The old kubectl-image-compatibility rationale is | ||
| # obsolete in velero 12.x — the Job now runs the velero image natively, not a | ||
| # kubectl one — but it stays disabled because cozystack manages CRDs via crds/.) | ||
| upgradeCRDs: false |
There was a problem hiding this comment.
Confirmed accurate and worth keeping. On dev10 the velero HelmRelease sets no explicit spec.upgrade.crds policy, so helm-controller's default applies (Skip on upgrade) — combined with upgradeCRDs: false, the new additive 1.18 CRD fields (caCertRef, queuePosition, the Queued/ReadyToStart phase enum values) will NOT auto-apply on existing clusters. The 1.18.1 server runs fine against the old 1.17 CRDs since every addition is optional, so this is not a regression — but the documented manual kubectl apply -f .../crds/ step is the correct operational guidance for operators who want to use the new fields (e.g. caCertRef). No change requested; flagging for release-note visibility.
What this PR does
Bumps velero from 11.0.0 to 12.0.3 (appVersion 1.17.0 → 1.18.1, latest upstream), picking up the published security fixes the issue enumerates across the velero server and its backup plugins.
make update(now pinned to--version 12.0.3for reproducible re-vendoring). The 12.0 major bump's values-schema changes are backward-compatible (two required fields relaxed, one optional key added), so all cozystack overrides (upgradeCRDs,initContainers,configuration.*,deployNodeAgent) stay valid.velero-plugin-for-awsv1.12.1 → v1.14.1 (the release that bumps to velero 1.18.1; also corrects a pre-existing plugin/server skew) andkubevirt-velero-pluginv0.8.0 → v0.9.0.upgradeCRDs: false→ no upgrade-crds Job invariant, which has silently regressed before.The 1.18 "PVC selected-node" deprecation needs no action (velero handles it transparently); CRD changes are additive.
Verified:
helm templaterenders all three images;helm unittest3/3 pass (mutation-checked).Upgrade note: Helm v3 does not update CRDs on
helm upgrade(upgradeCRDs is disabled). On existing clusters the 1.18 CRDs must be applied manually (kubectl apply --filename packages/system/velero/charts/velero/crds/).Closes #2886
Release note
Summary by CodeRabbit
queuePosition) plus newphasestates.caCertRefSecret reference for BackupStorageLocation (withcaCertmarked deprecated).snapshotSizefor PodVolumeRestore.backupSyncPeriodconfiguration andnodeAgent.disableHostPathoption.testtarget (runshelm unittest) and expanded chart rendering invariants checks.