From 8b39c30dd6e43689a6bd8f3e512d7638e7cf2237 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Frimberger?= <andre@intellisoft.de>
Date: Thu, 9 May 2024 10:27:14 +0200
Subject: [PATCH 1/9] feat(chart:k8up) add security context for cleanup hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: André Frimberger <andre@intellisoft.de>
---
 charts/k8up/Chart.yaml                  | 2 +-
 charts/k8up/templates/cleanup-hook.yaml | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/k8up/Chart.yaml b/charts/k8up/Chart.yaml
index 98fea299f..abbd68303 100644
--- a/charts/k8up/Chart.yaml
+++ b/charts/k8up/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
   - backup
   - operator
   - restic
-version: 4.7.0
+version: 4.8.0
 sources:
   - https://github.com/k8up-io/k8up
 maintainers:
diff --git a/charts/k8up/templates/cleanup-hook.yaml b/charts/k8up/templates/cleanup-hook.yaml
index 7133feb4e..3d752843a 100644
--- a/charts/k8up/templates/cleanup-hook.yaml
+++ b/charts/k8up/templates/cleanup-hook.yaml
@@ -81,6 +81,8 @@ spec:
     spec:
       restartPolicy: Never
       serviceAccountName: cleanup-service-account
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
       - name: "{{ .Release.Name }}-cleanup"
         image: "{{ include "cleanupImage" . }}"
@@ -99,3 +101,5 @@ spec:
               kubectl -n "$ns" delete rolebinding pod-executor-namespaced --ignore-not-found=true
               kubectl -n "$ns" delete role pod-executor --ignore-not-found=true
             done
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 12 }}

From 2a23a993fc18c88185a0c3dc2b01cf16b956f152 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Frimberger?= <andre@intellisoft.de>
Date: Sun, 2 Jun 2024 19:37:53 +0200
Subject: [PATCH 2/9] fix(chart:k8up) labels for Dashboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: André Frimberger <andre@intellisoft.de>
---
 charts/k8up/templates/grafana-dashboard.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/k8up/templates/grafana-dashboard.yaml b/charts/k8up/templates/grafana-dashboard.yaml
index 75c8a8d14..587c4fa3b 100644
--- a/charts/k8up/templates/grafana-dashboard.yaml
+++ b/charts/k8up/templates/grafana-dashboard.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: {{ default .Release.Namespace .Values.metrics.grafanaDashboard.namespace }}
   labels:
     {{- include "k8up.labels" . | nindent 4 }}
-    {{- with .Values.metrics.prometheusRule.additionalLabels }}
+    {{- with .Values.metrics.grafanaDashboard.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
 data:

From 77180bf4f291341442f62ba27e4780b7960b3cfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Frimberger?= <andre@intellisoft.de>
Date: Wed, 5 Jun 2024 08:35:25 +0200
Subject: [PATCH 3/9] doc(chart:k8up) update README.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: André Frimberger <andre@intellisoft.de>
---
 charts/k8up/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/k8up/README.md b/charts/k8up/README.md
index 7f89a9b7a..711c75c4a 100644
--- a/charts/k8up/README.md
+++ b/charts/k8up/README.md
@@ -1,6 +1,6 @@
 # k8up
 
-![Version: 4.7.0](https://img.shields.io/badge/Version-4.7.0-informational?style=flat-square)
+![Version: 4.8.0](https://img.shields.io/badge/Version-4.8.0-informational?style=flat-square)
 
 Kubernetes and OpenShift Backup Operator based on restic
 
@@ -13,7 +13,7 @@ helm repo add k8up-io https://k8up-io.github.io/k8up
 helm install k8up k8up-io/k8up
 ```
 ```bash
-kubectl apply -f https://github.com/k8up-io/k8up/releases/download/k8up-4.7.0/k8up-crd.yaml
+kubectl apply -f https://github.com/k8up-io/k8up/releases/download/k8up-4.8.0/k8up-crd.yaml
 ```
 
 <!---

From 34c91041cedafb0c3ee5d77ce49ef1caf6d0c8ef Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Fri, 7 Jun 2024 01:31:16 +0200
Subject: [PATCH 4/9] Ignore terminated Pods in mapping of PVCs to Pods

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 operator/backupcontroller/executor.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/operator/backupcontroller/executor.go b/operator/backupcontroller/executor.go
index 46cf8aa9c..6eaab8885 100644
--- a/operator/backupcontroller/executor.go
+++ b/operator/backupcontroller/executor.go
@@ -69,6 +69,10 @@ func (b *BackupExecutor) listAndFilterPVCs(ctx context.Context, annotation strin
 		return nil, fmt.Errorf("list pods: %w", err)
 	}
 	for _, pod := range pods.Items {
+		if pod.Status.Phase == corev1.PodSucceeded || pod.Status.Phase == corev1.PodFailed {
+			log.V(1).Info("Ignoring terminated Pod", "pod", pod.GetName())
+			continue
+		}
 		for _, volume := range pod.Spec.Volumes {
 			if volume.PersistentVolumeClaim != nil {
 				pvcPodMap[volume.PersistentVolumeClaim.ClaimName] = pod

From a7fb8f521a895aa4b0d575bdfa25044d43ed65f2 Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Fri, 7 Jun 2024 14:40:36 +0200
Subject: [PATCH 5/9] Add integration test to verify that succeeded Pods are
 ignored

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 .../controller_integration_test.go            | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/operator/backupcontroller/controller_integration_test.go b/operator/backupcontroller/controller_integration_test.go
index 7bf7ce6f0..5fa2a583b 100644
--- a/operator/backupcontroller/controller_integration_test.go
+++ b/operator/backupcontroller/controller_integration_test.go
@@ -451,6 +451,35 @@ func (ts *BackupTestSuite) Test_GivenBackupAndUnmountedRWOPVCOnTwoNodes_ExpectBa
 	ts.assertJobSpecs(&job2, nodeNamePv2, []corev1.Volume{volumePvc2}, nil, []string{})
 }
 
+func (ts *BackupTestSuite) Test_GivenBackupAndRWOPVCWithFinishedPod_ExpectFinishedPodToBeIgnored() {
+	pvc1 := ts.newPvc("test-pvc1", corev1.ReadWriteOnce)
+	nodeNamePod1 := "worker"
+	nodeNamePod2 := "control-plane"
+	volumePvc1 := corev1.Volume{
+		Name: "test-pvc1",
+		VolumeSource: corev1.VolumeSource{
+			PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+				ClaimName: pvc1.Name,
+			},
+		},
+	}
+	tolerations := make([]corev1.Toleration, 0)
+	pod1 := ts.newPod("test-pod1", nodeNamePod1, tolerations, []corev1.Volume{volumePvc1})
+	pod2 := ts.newPod("test-pod2", nodeNamePod2, tolerations, []corev1.Volume{volumePvc1})
+
+	ts.EnsureResources(ts.BackupResource, pvc1, pod1, pod2)
+
+	pvc1.Status.Phase = corev1.ClaimBound
+	pod1.Status.Phase = corev1.PodRunning
+	pod2.Status.Phase = corev1.PodSucceeded
+	ts.UpdateStatus(pvc1, pod1, pod2)
+
+	ts.whenReconciling(ts.BackupResource)
+	job := ts.expectABackupJob()
+
+	ts.assertJobSpecs(job, nodeNamePod1, []corev1.Volume{volumePvc1}, tolerations, []string{pod1.Name})
+}
+
 func (ts *BackupTestSuite) assertCondition(conditions []metav1.Condition, condType k8upv1.ConditionType, reason k8upv1.ConditionReason, status metav1.ConditionStatus) {
 	cond := meta.FindStatusCondition(conditions, condType.String())
 	ts.Require().NotNil(cond, "condition of type %s missing", condType)

From 7bae8171172cc1ba2f59835bd4f822a92bf20de2 Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Fri, 7 Jun 2024 15:20:07 +0200
Subject: [PATCH 6/9] Refactor logic to exclude all Pod which are not in the
 phase "Running"

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 .../backupcontroller/controller_integration_test.go  | 12 +++++++++---
 operator/backupcontroller/executor.go                |  4 ++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/operator/backupcontroller/controller_integration_test.go b/operator/backupcontroller/controller_integration_test.go
index 5fa2a583b..755f88b39 100644
--- a/operator/backupcontroller/controller_integration_test.go
+++ b/operator/backupcontroller/controller_integration_test.go
@@ -312,7 +312,9 @@ func (ts *BackupTestSuite) Test_GivenBackupAndMountedRWOPVCOnOneNode_ExpectBacku
 
 	pvc1.Status.Phase = corev1.ClaimBound
 	pvc2.Status.Phase = corev1.ClaimBound
-	ts.UpdateStatus(pvc1, pvc2)
+	pod1.Status.Phase = corev1.PodRunning
+	pod2.Status.Phase = corev1.PodRunning
+	ts.UpdateStatus(pvc1, pvc2, pod1, pod2)
 
 	result := ts.whenReconciling(ts.BackupResource)
 	ts.Assert().GreaterOrEqual(result.RequeueAfter, 30*time.Second)
@@ -359,7 +361,9 @@ func (ts *BackupTestSuite) Test_GivenBackupAndMountedRWOPVCOnTwoNodes_ExpectBack
 
 	pvc1.Status.Phase = corev1.ClaimBound
 	pvc2.Status.Phase = corev1.ClaimBound
-	ts.UpdateStatus(pvc1, pvc2)
+	pod1.Status.Phase = corev1.PodRunning
+	pod2.Status.Phase = corev1.PodRunning
+	ts.UpdateStatus(pvc1, pvc2, pod1, pod2)
 
 	result := ts.whenReconciling(ts.BackupResource)
 	ts.Assert().GreaterOrEqual(result.RequeueAfter, 30*time.Second)
@@ -395,7 +399,9 @@ func (ts *BackupTestSuite) Test_GivenBackupAndMountedRWOPVCOnOneNodeWithFinished
 	ts.EnsureResources(ts.BackupResource, pvc1, pod1, pod2)
 
 	pvc1.Status.Phase = corev1.ClaimBound
-	ts.UpdateStatus(pvc1)
+	pod1.Status.Phase = corev1.PodRunning
+	pod2.Status.Phase = corev1.PodRunning
+	ts.UpdateStatus(pvc1, pod1, pod2)
 
 	result := ts.whenReconciling(ts.BackupResource)
 	ts.Assert().GreaterOrEqual(result.RequeueAfter, 30*time.Second)
diff --git a/operator/backupcontroller/executor.go b/operator/backupcontroller/executor.go
index 6eaab8885..3744e58f3 100644
--- a/operator/backupcontroller/executor.go
+++ b/operator/backupcontroller/executor.go
@@ -69,8 +69,8 @@ func (b *BackupExecutor) listAndFilterPVCs(ctx context.Context, annotation strin
 		return nil, fmt.Errorf("list pods: %w", err)
 	}
 	for _, pod := range pods.Items {
-		if pod.Status.Phase == corev1.PodSucceeded || pod.Status.Phase == corev1.PodFailed {
-			log.V(1).Info("Ignoring terminated Pod", "pod", pod.GetName())
+		if pod.Status.Phase != corev1.PodRunning {
+			log.V(1).Info("Ignoring Pod which is not running", "pod", pod.GetName())
 			continue
 		}
 		for _, volume := range pod.Spec.Volumes {

From 7be70a0391dc1e3cac723a33b48a59159e798d2c Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Thu, 13 Jun 2024 21:33:06 +0200
Subject: [PATCH 7/9] Make log messages more explicit

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 operator/backupcontroller/executor.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/operator/backupcontroller/executor.go b/operator/backupcontroller/executor.go
index 3744e58f3..d6371403b 100644
--- a/operator/backupcontroller/executor.go
+++ b/operator/backupcontroller/executor.go
@@ -91,7 +91,7 @@ func (b *BackupExecutor) listAndFilterPVCs(ctx context.Context, annotation strin
 
 	for _, pvc := range claimlist.Items {
 		if pvc.Status.Phase != corev1.ClaimBound {
-			log.Info("PVC is not bound", "pvc", pvc.GetName())
+			log.Info("PVC is not bound, skipping PVC", "pvc", pvc.GetName())
 			continue
 		}
 
@@ -99,7 +99,7 @@ func (b *BackupExecutor) listAndFilterPVCs(ctx context.Context, annotation strin
 
 		isRWO := containsAccessMode(pvc.Spec.AccessModes, corev1.ReadWriteOnce)
 		if !containsAccessMode(pvc.Spec.AccessModes, corev1.ReadWriteMany) && !isRWO && !hasBackupAnnotation {
-			log.Info("PVC is neither RWX nor RWO and has no backup annotation", "pvc", pvc.GetName())
+			log.Info("PVC is neither RWX nor RWO and has no backup annotation, skipping PVC", "pvc", pvc.GetName())
 			continue
 		}
 

From 18e11b81220a46a1982c1869565b05295d767fa7 Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Thu, 13 Jun 2024 22:20:02 +0200
Subject: [PATCH 8/9] Add integration test for RWO PVC without NodeAffinity

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 .../controller_integration_test.go            | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/operator/backupcontroller/controller_integration_test.go b/operator/backupcontroller/controller_integration_test.go
index 755f88b39..1aaaad1c3 100644
--- a/operator/backupcontroller/controller_integration_test.go
+++ b/operator/backupcontroller/controller_integration_test.go
@@ -14,6 +14,7 @@ import (
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
@@ -457,6 +458,42 @@ func (ts *BackupTestSuite) Test_GivenBackupAndUnmountedRWOPVCOnTwoNodes_ExpectBa
 	ts.assertJobSpecs(&job2, nodeNamePv2, []corev1.Volume{volumePvc2}, nil, []string{})
 }
 
+func (ts *BackupTestSuite) Test_GivenBackupAndUnmountedRWOPVC_ExpectBackup() {
+	pvc1 := ts.newPvc("test-pvc-without-node-affinity", corev1.ReadWriteOnce)
+	pv1 := &corev1.PersistentVolume{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-pvc-without-node-affinity",
+		},
+		Spec: corev1.PersistentVolumeSpec{
+			AccessModes: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
+			Capacity: map[corev1.ResourceName]resource.Quantity{
+				corev1.ResourceStorage: resource.MustParse("1Mi"),
+			},
+			PersistentVolumeSource: corev1.PersistentVolumeSource{
+				HostPath: &corev1.HostPathVolumeSource{Path: "/tmp/integration-tests"},
+			},
+		},
+	}
+	volumePvc1 := corev1.Volume{
+		Name: "test-pvc-without-node-affinity",
+		VolumeSource: corev1.VolumeSource{
+			PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+				ClaimName: pvc1.Name,
+			},
+		},
+	}
+	ts.EnsureResources(ts.BackupResource, pvc1, pv1)
+
+	pvc1.Status.Phase = corev1.ClaimBound
+	ts.UpdateStatus(pvc1)
+
+	ts.whenReconciling(ts.BackupResource)
+	job := ts.expectABackupJob()
+
+	ts.Assert().Nil(job.Spec.Template.Spec.NodeSelector)
+	ts.Assert().Equal(volumePvc1.VolumeSource.PersistentVolumeClaim.ClaimName, job.Spec.Template.Spec.Volumes[0].VolumeSource.PersistentVolumeClaim.ClaimName)
+}
+
 func (ts *BackupTestSuite) Test_GivenBackupAndRWOPVCWithFinishedPod_ExpectFinishedPodToBeIgnored() {
 	pvc1 := ts.newPvc("test-pvc1", corev1.ReadWriteOnce)
 	nodeNamePod1 := "worker"

From fa178ece8221e4b904c8dd18ed265c1eb176bdfd Mon Sep 17 00:00:00 2001
From: Johannes Bornhold <johannes@bornhold.name>
Date: Thu, 13 Jun 2024 22:22:28 +0200
Subject: [PATCH 9/9] Also add RWO PVC without NodeAffinity from its PV

Signed-off-by: Johannes Bornhold <johannes@bornhold.name>
---
 operator/backupcontroller/executor.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/operator/backupcontroller/executor.go b/operator/backupcontroller/executor.go
index d6371403b..c89553e53 100644
--- a/operator/backupcontroller/executor.go
+++ b/operator/backupcontroller/executor.go
@@ -143,8 +143,7 @@ func (b *BackupExecutor) listAndFilterPVCs(ctx context.Context, annotation strin
 
 			bi.node = findNode(pv, pvc)
 			if bi.node == "" {
-				log.Info("RWO PVC not bound and no PV node affinity set, skipping", "pvc", pvc.GetName(), "affinity", pv.Spec.NodeAffinity)
-				continue
+				log.Info("RWO PVC not bound and no PV node affinity set, adding", "pvc", pvc.GetName(), "affinity", pv.Spec.NodeAffinity)
 			}
 			log.V(1).Info("node found in PV or PVC", "pvc", pvc.GetName(), "node", bi.node)
 		} else {