Namespace with label velero.io/exclude-from-backup=true should exclude all resources within from backing up

[iblackman]

Describe the problem/challenge you have
I want to have an option to exclude a namespace (all resources) without needing to edit velero config every time I create a new namespace. The actual option of --exclude-namespaces isn't enough because I don't want to create a naming pattern because of velero and since it already accept the label velero.io/exclude-from-backup=true to exclude resources dynamically why not treat everything from a namespace with that label as if all have that label? It just doesn't make sense for me to only skip the resource namespace backup but backup all the resources within it.

Describe the solution you'd like
A namespace with label velero.io/exclude-from-backup=true should be enough to exclude all resources in that namespace from velero backup without the need to add that label to all of them.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

• Velero version (use velero version):

Client:
	Version: v1.3.1
	Git commit: -
Server:
	Version: v1.3.1

• Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.5", GitCommit:"20c265fef0741dd71a66480e35bd69f18351daea", GitTreeState:"clean", BuildDate:"2019-10-15T19:16:51Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.5", GitCommit:"20c265fef0741dd71a66480e35bd69f18351daea", GitTreeState:"clean", BuildDate:"2019-10-15T19:07:57Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}

• Kubernetes installer & version:

kubeadm version: &version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.5", GitCommit:"20c265fef0741dd71a66480e35bd69f18351daea", GitTreeState:"clean", BuildDate:"2019-10-15T19:14:19Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}

• Cloud provider or hardware configuration:
• OS (e.g. from /etc/os-release):

NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.4 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

[skriss]

@iblackman I think that could be reasonable behavior for when the velero.io/exclude-from-backup=true is applied to a Namespace resource. Right now, it results in just the Namespace resource itself being excluded, but any other resources in that namespace would still be backed up.

Let's see what other maintainers think (cc @nrb @carlisia @ashish-amarnath).

Do you have any interest in working on a PR for this, if we decide it makes sense to implement?

[nrb]

👍 I think this is reasonable, too, since annotating everything in a namespace could be pretty tedious.

[iblackman]

@skriss

Do you have any interest in working on a PR for this, if we decide it makes sense to implement?

I can try to if you decide it makes sense, even though I don't have much experience with Go.

[ashish-amarnath]

👍 from me. Excluding namespace resources when the namespace is excluded is very intuitive.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[ggilley]

This would be great! We have transient namespaces in our environment.

[davidkarlsen]

velero/pkg/backup/item_backupper.go

Line 79 in e9c9978

if metadata.GetLabels()["velero.io/exclude-from-backup"] == "true" {

[euclidsun]

in the doc: https://velero.io/docs/v1.9/resource-filtering/#veleroioexclude-from-backuptrue

Resources with the label velero.io/exclude-from-backup=true are not included in backup, even if it contains a matching selector label.

Is this label a generic way to exclude some k8s resources from backup?

[sseago]

@euclidsun Yes -- this label is applied at the resource level, and any resource with it won't be included, whether it's a pod, a secret, etc.

The feature request in this issue is to treat this label on a namespace as a special case -- if a namespace has exclude-from-backup=true, then exclude everything in the namespace. Essentially, adding this label to a namespace would be equivalent to setting spec.ExcludedNamespaces on the backup.