Merge https://github.com/velero-io/velero:v1.18.3-rc.1 (6e8f61c) into oadp-1.6

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# maintainers are the overall code owners
+* @velero-io/Maintainer

.github/workflows/auto_assign_prs.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   # Automatically assigns reviewers and owner
   add-reviews:
+    if: github.repository == 'velero-io/velero' && github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
       - name: Set the author of a PR as the assignee

.github/workflows/auto_label_prs.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   # Automatically labels PRs based on file globs in the change.
   triage:
+    if: github.repository == 'velero-io/velero'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@v5

.github/workflows/e2e-test-kind.yaml

@@ -87,12 +87,41 @@ jobs:
         id: set-matrix
         # everything excluding older tags. limits needs to be high enough to cover all latest versions
         # and test labels
-        # grep -E "v[1-9]\.(2[5-9]|[3-9][0-9])" filters for v1.25 to v9.99
+        # grep -E "^v[1-9]\.(2[5-9]|[3-9][0-9])\.[0-9]+$" filters for well-formed v1.25.x to v9.99.x
+        # GA releases only, so a pre-release tag like v1.37.0-rc.1 can't reach the
+        # awk step below and be misparsed as a patch release (e.g. "1.37.1")
         # and removes older patches of the same minor version
         # awk -F. '{if(!a[$1"."$2]++)print $1"."$2"."$NF}'
         run: |
+          set -euo pipefail
+          candidates=$(wget -q -O - "https://hub.docker.com/v2/namespaces/kindest/repositories/node/tags?page_size=50" | grep -o '"name": *"[^"]*' | grep -o '[^"]*$' | grep -E "^v[1-9]\.(2[5-9]|[3-9][0-9])\.[0-9]+$" | awk -F. '{if(!a[$1"."$2]++)print $1"."$2"."$NF}' | sort -r | sed s/v//g)
+
+          # Docker Hub's tag listing can include tags whose manifest was never
+          # published or has since been removed (e.g. kindest/node:v1.37.1). If such
+          # a tag reaches the matrix, its job is guaranteed to fail with
+          # "manifest unknown" once helm/kind-action tries to pull it, which clogs
+          # up the e2e queue on every PR with a red job unrelated to the change
+          # under test. Test-pull each candidate's manifest here and drop any tag
+          # that isn't actually available before building the matrix.
+          valid=()
+          while IFS= read -r v; do
+            [ -z "$v" ] && continue
+            echo "Verifying kindest/node:v${v} image is available..."
+            if docker manifest inspect "kindest/node:v${v}" > /dev/null 2>&1; then
+              valid+=("$v")
+            else
+              echo "::warning::kindest/node:v${v} manifest not found on Docker Hub; excluding from e2e test matrix"
+            fi
+          done <<< "$candidates"
+
+          if [ ${#valid[@]} -eq 0 ]; then
+            echo "::warning::No kindest/node tags passed the manifest availability check; the e2e test matrix will have no Kubernetes versions to test"
+          fi
+
+          k8s_json=$(printf '%s\n' "${valid[@]+"${valid[@]}"}" | jq -R -c -s 'split("\n") | map(select(length > 0))')
+
           echo "matrix={\
-            \"k8s\":$(wget -q -O - "https://hub.docker.com/v2/namespaces/kindest/repositories/node/tags?page_size=50" | grep -o '"name": *"[^"]*' | grep -o '[^"]*$' | grep -v -E "alpha|beta" | grep -E "v[1-9]\.(2[5-9]|[3-9][0-9])" | awk -F. '{if(!a[$1"."$2]++)print $1"."$2"."$NF}' | sort -r | sed s/v//g | jq -R -c -s 'split("\n")[:-1]'),\
+            \"k8s\":${k8s_json},\
             \"labels\":[\
               \"Basic && (ClusterResource || NodePort || StorageClass)\", \
               \"ResourceFiltering && !Restic\", \

.github/workflows/pr-changelog-check.yml

@@ -7,6 +7,7 @@ on:
 jobs:
 
   build:
+    if: github.repository == 'velero-io/velero'
     name: Run Changelog Check
     runs-on: ubuntu-latest
     steps:

.github/workflows/pr-ci-check.yml

@@ -2,11 +2,13 @@ name: Pull Request CI Check
 on: [pull_request]
 jobs:
   get-go-version:
+    if: github.repository == 'velero-io/velero' && github.base_ref == 'main'
     uses: ./.github/workflows/get-go-version.yaml
     with:
       ref: ${{ github.event.pull_request.base.ref }}
 
   build:
+    if: github.repository == 'velero-io/velero' && github.base_ref == 'main'
     name: Run CI
     needs: get-go-version
     runs-on: ubuntu-latest

.github/workflows/pr-codespell.yml

@@ -3,6 +3,7 @@ on: [pull_request]
 jobs:
 
   codespell:
+    if: github.repository == 'velero-io/velero'
     name: Run Codespell
     runs-on: ubuntu-latest
     steps:

.github/workflows/pr-linter-check.yml

@@ -28,5 +28,5 @@ jobs:
       - name: Linter check
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.5.0
+          version: v2.13.1
           args: --verbose

.github/workflows/prow-action.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   execute:
+    if: github.repository == 'velero-io/velero'
     runs-on: ubuntu-latest
     steps:
       - uses: jpmcb/prow-github-actions@v1.1.3

.github/workflows/rebase.yml

@@ -5,7 +5,7 @@ name: Automatic Rebase
 jobs:
   rebase:
     name: Rebase
-    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
+    if: github.repository == 'velero-io/velero' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the latest code

.github/workflows/stale-issues.yml

@@ -5,6 +5,7 @@ on:
 
 jobs:
   stale:
+    if: github.repository == 'velero-io/velero'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@v10.1.1

Dockerfile

@@ -73,7 +73,7 @@ RUN mkdir -p /output/usr/bin && \
     go clean -modcache -cache
 
 # Velero image packing section
-FROM paketobuildpacks/run-jammy-tiny:0.2.139
+FROM paketobuildpacks/run-jammy-tiny:0.2.165
 
 LABEL maintainer="Xun Jiang <jxun@vmware.com>"
 

Tiltfile

@@ -52,7 +52,7 @@ git_sha = str(local("git rev-parse HEAD", quiet = True, echo_off = True)).strip(
 
 tilt_helper_dockerfile_header = """
 # Tilt image
-FROM golang:1.25.11 as tilt-helper
+FROM golang:1.26.7 as tilt-helper
 
 # Support live reloading with Tilt
 RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com/windmilleng/rerun-process-wrapper/master/restart.sh  && \

changelogs/CHANGELOG-1.18.md

@@ -1,3 +1,40 @@
+## v1.18.3
+
+### Download
+https://github.com/vmware-tanzu/velero/releases/tag/v1.18.3
+
+### Container Image
+`velero/velero:v1.18.3`
+
+### Documentation
+https://velero.io/docs/v1.18/
+
+### Upgrading
+https://velero.io/docs/v1.18/upgrade-to-1.18/
+
+### All Changes
+  * Avoid duplicated InitContainer names generated in velero install CLI. (#10396, @blackpiglet)
+  * Bound WaitRestoreExecHook polling with resourceTimeout to avoid an infinite wait when restore exec hooks never complete. (#10394, @nitishmalang)
+  * fix log format string mismatches that produce wrong or mangled output (#10392, @samay43)
+  * Skip DeleteSnapshot when ProviderSnapshotID is empty (#10381, @kaovilai)
+  * Fail backup validation when built-in data mover is requested but no node-agent pods are running (#10360, @Joeavaikath)
+  * Fix issue #10341, avoid mutating the cached node-agent LoadAffinity so the OS node selector term is not appended repeatedly to data mover pods (#10348, @shubham-pampattiwar)
+  * Fix PodVolumeBackup metadata loss on fs-backup timeout, which caused all fs-backup volumes to become unrestorable (#9999, @shubham-pampattiwar)
+  * Fix repo connection contest of the two repositories with the same storage type (#10377, @Lyndon-Li)
+  * Only sync finished backups from object storage (#10347, @chlins)
+  * Support copying namespace-scoped secrets and configmaps for backup and restore PVC provisioning to enable datamover backup/restore of encrypted CSI volumes (#10335, @shubham-pampattiwar)
+  * Remove PVC and PV inclusion check during creating PVR. (#10319, @blackpiglet)
+  * Fix a potential deadlock when resultsLock is held by the informer but blocked on resChan because the early quit of RestorePodVolumes (#10263, @Lyndon-Li)
+  * Fix restore-wait init container ignoring pod-level securityContext, falling back to hardcoded runAsUser 1000 instead of the workload's own uid/gid, causing fs-backup restores to deadlock at Init:0/1 on owner-restricted volumes (#10224, @kaovilai)
+  * Add use guide for restore fine-grained filters via resource policy (#10164, @adam-jian-zhang)
+  * Add restore.velero.io/must-include-additional-items so RestoreItemActions can opt in to bypassing global restore filters for AdditionalItems (mirrors the backup-side must-include annotation; no default behavior change for existing restores/plugins). Stop force-including VolumeSnapshotContents via resourceMustHave on every restore; CSI VolumeSnapshot/PVC RestoreItemActions now set restore.velero.io/must-include-additional-items so bound snapshot dependencies are restored only when their parent is restored (fixes #9957) (#10101, @adam-jian-zhang)
+  * User guide for backup fine-grained filters via resource policy, and add set based label selectors for fine-grained filters (#10072, @adam-jian-zhang)
+  * Fix issue #10032, prioritize exact namespace match in restore (#10052, @adam-jian-zhang)
+  * Fix issue #9997, cancel ongoing PVB on timeout and wait for all PVBs to terminal state (#10039, @Lyndon-Li)
+  * Add fine-grained filters for restore via resource policy, introduced resourcePolicy field for restoreSpec, which contains ClusterScopedFilterPolicy and NamespacedFilterPolicy section (#10015, @adam-jian-zhang)
+  * Add support for matching PVCs by volume mode and access mode in resource policies, and introduce the `--global-backup-volume-policies-configmap` server flag to merge cluster-wide backup volume policies into every backup. (#10012, @chlins)
+  * Add fine-grained filters for backup via resource policy, introduced ClusterScopedFilterPolicy and NamespacedFilterPolicy section for resource policy (#10011, @adam-jian-zhang)
+
 ## v1.18.2
 
 ### Download

config/crd/v1/bases/velero.io_restores.yaml

@@ -404,6 +404,33 @@ spec:
                 - name
                 type: object
                 x-kubernetes-map-type: atomic
+              resourcePolicy:
+                description: |-
+                  ResourcePolicy specifies the reference to a ConfigMap containing resource
+                  filter policies for this restore. The ConfigMap can contain a
+                  namespacedFilterPolicies section that specifies per-namespace resource type
+                  filters, label selectors, and resource name patterns, and a
+                  clusterScopedFilterPolicy section for per-kind filtering of cluster-scoped
+                  resources. The ConfigMap format is the same as for BackupSpec.ResourcePolicy.
+                nullable: true
+                properties:
+                  apiGroup:
+                    description: |-
+                      APIGroup is the group for the resource being referenced.
+                      If APIGroup is not specified, the specified Kind must be in the core API group.
+                      For any other third-party types, APIGroup is required.
+                    type: string
+                  kind:
+                    description: Kind is the type of resource being referenced
+                    type: string
+                  name:
+                    description: Name is the name of resource being referenced
+                    type: string
+                required:
+                - kind
+                - name
+                type: object
+                x-kubernetes-map-type: atomic
               restorePVs:
                 description: |-
                   RestorePVs specifies whether to restore all included