Skip to content

OADP-7829: Add additive extraArgs support for Velero server and node-agent - #2230

Open
Shreyashxredhat wants to merge 3 commits into
openshift:oadp-devfrom
Shreyashxredhat:extraargs-velero-nodeagent
Open

OADP-7829: Add additive extraArgs support for Velero server and node-agent#2230
Shreyashxredhat wants to merge 3 commits into
openshift:oadp-devfrom
Shreyashxredhat:extraargs-velero-nodeagent

Conversation

@Shreyashxredhat

@Shreyashxredhat Shreyashxredhat commented Jun 1, 2026

Copy link
Copy Markdown

Why the changes were made

Closes #2209

Currently, configuring additional Velero server or node-agent arguments requires using full argument overrides, which forces users to replicate the operator-generated defaults. This approach is difficult to maintain and can lead to configuration drift when defaults change in future releases.

This change introduces a new extraArgs field for both VeleroConfig and NodeAgentConfig. The field allows users to add or override specific command-line arguments while preserving the operator-managed defaults.

Key behaviors:

  • extraArgs are merged with the operator-generated arguments.
  • Existing arguments can be overridden by specifying the same flag in extraArgs.
  • Supports both --flag=value and --flag value argument formats.
  • Duplicate flags are deduplicated by flag name.
  • Unsupported-args annotations continue to have the highest precedence.

Precedence order:

Operator defaults / individual DPA fields / Args override
→ extraArgs
→ unsupported-args annotation ConfigMap

How to test the changes made

  1. Deploy the operator with this change.

  2. Create a DPA with extraArgs configured:

spec:
  configuration:
    velero:
      extraArgs:
        resource-timeout: "20m"
        custom-flag: "value"
    nodeAgent:
      uploaderType: kopia
      extraArgs:
        data-mover-prepare-timeout: "45m"
  1. Verify the Velero deployment contains the additional arguments:
oc get deployment velero -n openshift-adp -o json | jq '.spec.template.spec.containers[0].args'
  1. Verify the node-agent daemonset contains the additional arguments:
oc get daemonset node-agent -n openshift-adp -o json | jq '.spec.template.spec.containers[0].args'
  1. Verify that specifying an existing flag in extraArgs overrides the operator-generated value.

  2. Run the test suite:

make test

Expected results:

  • Velero and node-agent include the configured extraArgs.
  • Existing flags are overridden when specified in extraArgs.
  • Operator-managed defaults remain intact.
  • All unit tests pass successfully.

Summary by CodeRabbit

  • New Features

    • Added configuration maps for specifying additional Velero and Node-Agent server command-line arguments.
    • Extra arguments can extend or override existing settings, while unsupported arguments retain highest precedence.
    • Added validation for supported argument-name formats.
  • Testing

    • Added coverage for argument merging, overrides, normalization, and precedence behavior.

@coderabbitai

coderabbitai Bot commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 48b49fdf-00cf-4b7b-bcea-f7d0e8a6cdd4

📥 Commits

Reviewing files that changed from the base of the PR and between edc8434 and 24b9ba7.

📒 Files selected for processing (3)
  • api/v1alpha1/dataprotectionapplication_types.go
  • bundle/manifests/oadp.openshift.io_dataprotectionapplications.yaml
  • config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
  • config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml
  • bundle/manifests/oadp.openshift.io_dataprotectionapplications.yaml
  • api/v1alpha1/dataprotectionapplication_types.go

Walkthrough

This PR adds validated extraArgs maps to Velero and Node-Agent configuration. Controllers merge these flags into generated container arguments, while unsupported server arguments retain highest precedence.

Changes

Additive extraArgs configuration

Layer / File(s) Summary
ExtraArgs API and CRD contracts
api/v1alpha1/dataprotectionapplication_types.go, bundle/manifests/..., config/crd/bases/...
Adds optional string maps for Velero and Node-Agent flags. CRD validation restricts flag names and documents precedence and key normalization.
Argument normalization and merging
pkg/common/common.go, pkg/common/common_test.go
Adds MergeExtraArgs to replace matching flags, remove duplicates, preserve input slices, and append new flags in sorted order. Tests cover equals and space-separated formats.
Controller integration and validation
internal/controller/nodeagent.go, internal/controller/nodeagent_test.go, internal/controller/velero.go, internal/controller/velero_test.go
Applies ExtraArgs to Node-Agent and Velero arguments. Tests cover appending, overrides, composition with Args, and precedence of unsupported server arguments. Debug reconciliation logging is simplified in velero.go.

Estimated code review effort: 2 (Simple) | ~12 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DPA
  participant NodeAgentController
  participant VeleroController
  participant MergeExtraArgs
  participant Workloads
  DPA->>NodeAgentController: provide NodeAgent ExtraArgs
  DPA->>VeleroController: provide Velero ExtraArgs
  NodeAgentController->>MergeExtraArgs: merge Node-Agent arguments
  VeleroController->>MergeExtraArgs: merge Velero arguments
  MergeExtraArgs->>Workloads: update container arguments
Loading

Suggested reviewers: kaovilai

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The Velero reconcile debug logging change is unrelated to the linked extraArgs feature objectives [#2209]. Remove the unrelated debug behavior change or document a separate requirement and issue for it.
Docstring Coverage ⚠️ Warning Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (13 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the additive extraArgs support for Velero server and node-agent.
Description check ✅ Passed The description explains the motivation, behavior, precedence, configuration example, verification steps, and test command.
Linked Issues check ✅ Passed The changes implement the linked issue objectives for API fields, merging, overrides, deduplication, precedence, validation, and tests [#2209].
Stable And Deterministic Test Names ✅ Passed Affected test files use static Ginkgo titles; the extraArgs changes add only table-driven Go tests and no dynamic It, Describe, Context, or When names.
Test Structure And Quality ✅ Passed Added coverage uses isolated table-driven t.Run cases with fake clients and local assertions; it adds no cluster waits or resource creation, and failure messages include expected diffs and values.
Microshift Test Compatibility ✅ Passed The PR adds Go table-driven unit cases and no new Ginkgo e2e declarations or tests/e2e changes; therefore the MicroShift API compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added. ExtraArgs coverage uses plain table-driven Go unit tests in internal/controller and pkg/common, so no SNO multi-node assumption applies.
Topology-Aware Scheduling Compatibility ✅ Passed The feature diff only adds ExtraArgs handling and logging; added-line scans found no affinity, topology spread, toleration, node selector, replica, or scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The PR adds no OTE entry-point or suite setup code and no process-level stdout writes; changed logging uses controller-runtime logger, which defaults to os.Stderr.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The feature range adds no tests/e2e files. New coverage is limited to internal controller and pkg/common unit tests, so this check is not applicable.
No-Weak-Crypto ✅ Passed The feature-range diff adds argument merging and CRD validation only; no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons were added.
Container-Privileges ✅ Passed The feature-range diff adds only CLI argument fields and merging; it adds no privileged, host namespace, SYS_ADMIN, or escalation settings. Existing node-agent root mode is conditional for filesyst...
No-Sensitive-Data-In-Logs ✅ Passed The prior deployment diff dump was removed; current reconciliation logging records only a generic message and operation, with no ExtraArgs, container args, or secret values logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 1, 2026
@openshift-ci
openshift-ci Bot requested a review from kaovilai June 1, 2026 17:03
@openshift-ci

openshift-ci Bot commented Jun 1, 2026

Copy link
Copy Markdown

Hi @Shreyashxredhat. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api/v1alpha1/dataprotectionapplication_types.go`:
- Around line 373-377: Update the comment for the ExtraArgs field(s) to
explicitly document the full precedence order including the unsupported-args
annotation as the final override; specifically, in
dataprotectionapplication_types.go update the comment above the ExtraArgs
map[string]string `json:"extraArgs,omitempty"` (and the similar comment at the
other occurrence) to state that ExtraArgs are applied additively on top of
operator defaults and Args, and then any unsupported-args annotation on the
resource is applied last and overrides conflicting keys.

In `@config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml`:
- Around line 297-304: The extraArgs map currently allows arbitrary keys; add a
propertyNames schema to constrain map keys to valid flag names (no leading "--",
no whitespace or empty strings). Update the extraArgs schema (identifier:
extraArgs in the YAML) to include a propertyNames block with a regex pattern
(e.g. ^[A-Za-z0-9][A-Za-z0-9_.-]*$ or other agreed flag-name pattern) and
optionally minLength: 1 so invalid keys like "--log-level", empty strings or
strings with spaces are rejected at the CRD boundary.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 891c2791-4260-4690-bb85-edc1fc97c193

📥 Commits

Reviewing files that changed from the base of the PR and between 627d54e and ee1c692.

⛔ Files ignored due to path filters (1)
  • api/v1alpha1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
📒 Files selected for processing (9)
  • api/v1alpha1/dataprotectionapplication_types.go
  • bundle/manifests/oadp.openshift.io_dataprotectionapplications.yaml
  • config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml
  • internal/controller/nodeagent.go
  • internal/controller/nodeagent_test.go
  • internal/controller/velero.go
  • internal/controller/velero_test.go
  • pkg/common/common.go
  • pkg/common/common_test.go

Comment thread api/v1alpha1/dataprotectionapplication_types.go
Comment thread config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml
…cument precedence

- Remove fmt.Printf/cmp.Diff debug logging that could expose sensitive
  ExtraArgs values; replace with structured log.Info
- Add normalizeExtraArgKeys() to strip leading dashes and skip
  empty/whitespace keys at runtime
- Document full precedence order in API docs and CRD descriptions:
  operator defaults / Args < ExtraArgs < unsupported-args annotation
- Add test cases for key normalization behavior

Co-authored-by: Cursor <cursoragent@cursor.com>
@weshayutin weshayutin added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 9, 2026
@weshayutin

Copy link
Copy Markdown
Contributor

@shubham-pampattiwar @sseago reviews?

@Shreyashxredhat

Copy link
Copy Markdown
Author

/test 4.22-images

@kaovilai kaovilai changed the title Add additive extraArgs support for Velero server and node-agent OADP-7829: Add additive extraArgs support for Velero server and node-agent Aug 6, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 6, 2026

Copy link
Copy Markdown

@Shreyashxredhat: This pull request references OADP-7829 which is a valid jira issue.

Details

In response to this:

Why the changes were made

Closes #2209

Currently, configuring additional Velero server or node-agent arguments requires using full argument overrides, which forces users to replicate the operator-generated defaults. This approach is difficult to maintain and can lead to configuration drift when defaults change in future releases.

This change introduces a new extraArgs field for both VeleroConfig and NodeAgentConfig. The field allows users to add or override specific command-line arguments while preserving the operator-managed defaults.

Key behaviors:

  • extraArgs are merged with the operator-generated arguments.
  • Existing arguments can be overridden by specifying the same flag in extraArgs.
  • Supports both --flag=value and --flag value argument formats.
  • Duplicate flags are deduplicated by flag name.
  • Unsupported-args annotations continue to have the highest precedence.

Precedence order:

Operator defaults / individual DPA fields / Args override
→ extraArgs
→ unsupported-args annotation ConfigMap

How to test the changes made

  1. Deploy the operator with this change.

  2. Create a DPA with extraArgs configured:

spec:
 configuration:
   velero:
     extraArgs:
       resource-timeout: "20m"
       custom-flag: "value"
   nodeAgent:
     uploaderType: kopia
     extraArgs:
       data-mover-prepare-timeout: "45m"
  1. Verify the Velero deployment contains the additional arguments:
oc get deployment velero -n openshift-adp -o json | jq '.spec.template.spec.containers[0].args'
  1. Verify the node-agent daemonset contains the additional arguments:
oc get daemonset node-agent -n openshift-adp -o json | jq '.spec.template.spec.containers[0].args'
  1. Verify that specifying an existing flag in extraArgs overrides the operator-generated value.

  2. Run the test suite:

make test

Expected results:

  • Velero and node-agent include the configured extraArgs.
  • Existing flags are overridden when specified in extraArgs.
  • Operator-managed defaults remain intact.
  • All unit tests pass successfully.

Summary by CodeRabbit

  • New Features
  • Added new configuration maps to specify additional Velero and Node-Agent server CLI arguments. These extraArgs are merged additively on top of operator defaults and existing args, with unsupported-args taking highest precedence.
  • Testing
  • Added unit and reconciliation tests covering extraArgs composition, overrides, and precedence behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@kaovilai

kaovilai commented Aug 6, 2026

Copy link
Copy Markdown
Member

/cherry-pick oadp-1.4
/cherry-pick oadp-1.5
/cherry-pick oadp-1.6

@openshift-cherrypick-robot

Copy link
Copy Markdown
Contributor

@kaovilai: once the present PR merges, I will cherry-pick it on top of oadp-1.4, oadp-1.5, oadp-1.6 in new PRs and assign them to you.

Details

In response to this:

/cherry-pick oadp-1.4
/cherry-pick oadp-1.5
/cherry-pick oadp-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
CodeRabbit flagged that extraArgs map keys accepted arbitrary strings
(e.g. "--log-level", whitespace, empty) with no rejection at the CRD
boundary. The prior fix only normalized keys at runtime in
common.MergeExtraArgs, which silently massages bad input instead of
rejecting it.

Add a kubebuilder XValidation CEL rule to VeleroConfig.ExtraArgs and
NodeAgentConfig.ExtraArgs so malformed keys are rejected at admission
time. Runtime normalization stays in place as a defensive fallback for
CRs persisted before this validation existed.

Regenerated config/crd/bases and bundle/manifests via make manifests/generate/bundle.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
@openshift-ci openshift-ci Bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
@kaovilai

kaovilai commented Aug 6, 2026

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 5b6f637 and 2 for PR HEAD 24b9ba7 in total

@Shreyashxredhat

Copy link
Copy Markdown
Author

/retest

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown

@Shreyashxredhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/5.1-ci-index 24b9ba7 link true /test 5.1-ci-index
ci/prow/5.1-images 24b9ba7 link true /test 5.1-images
ci/prow/5.1-e2e-test-cli-aws 24b9ba7 link true /test 5.1-e2e-test-cli-aws
ci/prow/5.1-e2e-test-aws 24b9ba7 link true /test 5.1-e2e-test-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, Shreyashxredhat, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature request: Additive extraArgs for Velero server and node-agent

7 participants