Even after applying the annotation velero.io/exclude-from-backup=true on the PVCs and PVs velero is still backing up those PVs

[ayushrockzzz]

I have applied the velero.io/exclude-from-backup=true annotation on both PVCs and PVs to exclude them from Velero backups. However, Velero continues to back up the associated PVs, which is not the expected behavior.

Steps to reproduce:

1. Add the annotation velero.io/exclude-from-backup=true to the PVCs and PVs.
2. Trigger a Velero backup.
3. Check the backup contents and observe that the PVs are still being backed up.

Expected behavior:
PVs and PVCs with the annotation velero.io/exclude-from-backup=true should be excluded from the Velero backup.

Is there any additional configuration or step required to ensure that Velero honors this annotation?

Environment:

• Velero version: 1.15
• Kubernetes version: 1.30
• Cloud Provider: AWS

Any guidance on resolving this would be appreciated. Thank you!

[kaovilai]

paste your backup yaml and velero deployment yaml

[ayushrockzzz]

Below is my velero deployment yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: velero
  namespace: velero
  uid: 86ff49fb-2d23-4c04-8eb9-755699579277
  resourceVersion: '14529929'
  generation: 2
  creationTimestamp: '2025-01-17T14:10:35Z'
  labels:
    app.kubernetes.io/instance: velero
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: velero
    app.kubernetes.io/version: 1.15.2
    component: velero
    helm.sh/chart: velero-8.2.0
  annotations:
    deployment.kubernetes.io/revision: '2'
    meta.helm.sh/release-name: velero
    meta.helm.sh/release-namespace: velero
    - manager: kubectl-set
      operation: Update
      apiVersion: apps/v1
      time: '2025-01-17T15:56:02Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:spec:
          f:template:
            f:spec:
              f:containers:
                k:{"name":"velero"}:
                  f:image: {}
    - manager: kube-controller-manager
      operation: Update
      apiVersion: apps/v1
      time: '2025-01-17T15:56:33Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:deployment.kubernetes.io/revision: {}
        f:status:
          f:availableReplicas: {}
          f:conditions:
            .: {}
            k:{"type":"Available"}:
              .: {}
              f:lastTransitionTime: {}
              f:lastUpdateTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
            k:{"type":"Progressing"}:
              .: {}
              f:lastTransitionTime: {}
              f:lastUpdateTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
          f:updatedReplicas: {}
      subresource: status
  selfLink: /apis/apps/v1/namespaces/velero/deployments/velero
status:
  observedGeneration: 2
  replicas: 1
  updatedReplicas: 1
  readyReplicas: 1
  availableReplicas: 1
  conditions:
    - type: Available
      status: 'True'
      lastUpdateTime: '2025-01-17T15:56:33Z'
      lastTransitionTime: '2025-01-17T15:56:33Z'
      reason: MinimumReplicasAvailable
      message: Deployment has minimum availability.
    - type: Progressing
      status: 'True'
      lastUpdateTime: '2025-01-17T15:56:33Z'
      lastTransitionTime: '2025-01-17T14:10:35Z'
      reason: NewReplicaSetAvailable
      message: ReplicaSet "velero-58cbf6bf4b" has successfully progressed.
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: velero
      app.kubernetes.io/name: velero
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/instance: velero
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: velero
        app.kubernetes.io/version: 1.15.1
        helm.sh/chart: velero-8.2.0
        name: velero
      annotations:
        prometheus.io/path: /metrics
        prometheus.io/port: '8085'
        prometheus.io/scrape: 'true'
    spec:
      volumes:
        - name: plugins
          emptyDir: {}
        - name: scratch
          emptyDir: {}
      initContainers:
        - name: velero-plugin-for-aws
          image: velero/velero-plugin-for-aws:v1.11.0
          resources: {}
          volumeMounts:
            - name: plugins
              mountPath: /target
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
      containers:
        - name: velero
          image: velero/velero:v1.15.2
          command:
            - /velero
          args:
            - server
            - '--uploader-type=kopia'
            - '--keep-latest-maintenance-jobs=3'
          ports:
            - name: http-monitoring
              containerPort: 8085
              protocol: TCP
          env:
            - name: VELERO_SCRATCH_DIR
              value: /scratch
            - name: VELERO_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: LD_LIBRARY_PATH
              value: /plugins
          resources: {}
          volumeMounts:
            - name: plugins
              mountPath: /plugins
            - name: scratch
              mountPath: /scratch
          livenessProbe:
            httpGet:
              path: /metrics
              port: http-monitoring
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /metrics
              port: http-monitoring
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 5
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
      restartPolicy: Always
      terminationGracePeriodSeconds: 3600
      dnsPolicy: ClusterFirst
      serviceAccountName: velero-server
      serviceAccount: velero-server
      securityContext: {}
      schedulerName: default-scheduler
  strategy:
    type: Recreate
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

and I am creating the backup using the below command:-

velero backup create <backup_name> \ --include-namespaces <namespace_name>

[sseago]

You may be hitting this bug: #8510
It's a regression in 1.15, fixed here: #8572
Fix will be in 1.15.2.

[ayushrockzzz]

If I switch back to the older version like 1.14, then it should work as expected for me ?

[ayushrockzzz]

This is not working for me in 1.15.2 as well.

[sseago]

Hmm. Looking back at the initial description:
"I have applied the velero.io/exclude-from-backup=true annotation on both PVCs and PVs to exclude them from Velero backups. However, Velero continues to back up the associated PVs, which is not the expected behavior."
I'm noticing two things:

1. The bug fix was to fix a regression in 1.15.0 where if exclude-from-backup was only on PVCs and not PVs, the PVs still got backed up -- there was no regression if it was on both PVs and PVCs
2. exclude-from-backup should be a label, not an annotation: https://velero.io/docs/v1.4/resource-filtering/#veleroioexclude-from-backuptrue

[ayushrockzzz]

Thanks @sseago.