BACKPORT-CONFLICT

packages/core/platform/sources/velero.yaml

@@ -21,3 +21,4 @@ spec:
         privileged: true
         namespace: cozy-velero
         releaseName: velero
+        upgradeCRDs: CreateReplace

packages/core/platform/tests/sources_velero_crds_test.yaml

@@ -0,0 +1,22 @@
+suite: velero applies CRD updates on upgrade
+# velero evolves its CRD schema between versions (v1.18 adds the Queued and
+# ReadyToStart backup phases). Helm never upgrades CRDs shipped in crds/, and
+# the velero package disables the chart's upgrade-crds Job, so the PackageSource
+# must opt into CreateReplace; without it the server binary upgrades while the
+# live CRDs stay at first-install state, the apiserver rejects the new phases,
+# and backups sit in New while the HelmRelease stays green. Pin the policy so an
+# upgrade cannot silently regress.
+templates:
+  - templates/sources.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: velero PackageSource sets upgradeCRDs to CreateReplace
+    documentSelector:
+      path: metadata.name
+      value: cozystack.velero
+    asserts:
+      - equal:
+          path: spec.variants[0].components[0].install.upgradeCRDs
+          value: CreateReplace

packages/system/velero/tests/velero_test.yaml

@@ -26,11 +26,18 @@ tests:
           path: spec.template.spec.initContainers[1].image
           value: quay.io/kubevirt/kubevirt-velero-plugin:v0.8.0
 
+<<<<<<< HEAD
   # Cozystack disables the upgrade-crds Job (upgradeCRDs: false) because CRDs
   # ship via the chart's crds/ directory, making the Job redundant, and because
   # on this chart (11.0.0) the Job runs a kubectl image whose tag defaults to the
   # chart's Kubernetes version and need not match the cluster. Pin that
   # invariant — it silently regressed once.
+=======
+  # Cozystack disables the upgrade-crds Job (upgradeCRDs: false): CRD lifecycle
+  # is owned by the generated HelmRelease (upgradeCRDs: CreateReplace on the
+  # velero PackageSource), making the Job redundant. Pin that invariant — it
+  # silently regressed once.
+>>>>>>> f4d812c (fix(velero): apply CRD updates on upgrade via CreateReplace)
   - it: does not emit the upgrade-crds Job when upgradeCRDs is disabled
     template: charts/velero/templates/upgrade-crds/upgrade-crds.yaml
     asserts:

packages/system/velero/values.yaml

@@ -1,6 +1,13 @@
 velero:
+<<<<<<< HEAD
   # Disable CRD upgrade job - CRDs are installed as part of helm chart
   # The upgrade job has issues with kubectl image compatibility
+=======
+  # Disable the upgrade-crds Job: CRD lifecycle is owned by the generated
+  # HelmRelease instead (upgradeCRDs: CreateReplace on the velero PackageSource),
+  # which applies the chart's crds/ directory on install and on every upgrade,
+  # so the Job is redundant.
+>>>>>>> f4d812c (fix(velero): apply CRD updates on upgrade via CreateReplace)
   upgradeCRDs: false
   initContainers:
     - name: velero-plugin-for-aws