From e4d1fb1c97cfa42a2e555876ebaf362e91c2de38 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <3811295@gmail.com>
Date: Mon, 10 Aug 2026 12:23:16 +0300
Subject: [PATCH]  BACKPORT-CONFLICT

---
 packages/core/platform/sources/velero.yaml    |  1 +
 .../tests/sources_velero_crds_test.yaml       | 22 +++++++++++++++++++
 packages/system/velero/tests/velero_test.yaml |  7 ++++++
 packages/system/velero/values.yaml            |  7 ++++++
 4 files changed, 37 insertions(+)
 create mode 100644 packages/core/platform/tests/sources_velero_crds_test.yaml

diff --git a/packages/core/platform/sources/velero.yaml b/packages/core/platform/sources/velero.yaml
index 2374e8473..acfb4d2bd 100644
--- a/packages/core/platform/sources/velero.yaml
+++ b/packages/core/platform/sources/velero.yaml
@@ -21,3 +21,4 @@ spec:
         privileged: true
         namespace: cozy-velero
         releaseName: velero
+        upgradeCRDs: CreateReplace
diff --git a/packages/core/platform/tests/sources_velero_crds_test.yaml b/packages/core/platform/tests/sources_velero_crds_test.yaml
new file mode 100644
index 000000000..a48ad53c8
--- /dev/null
+++ b/packages/core/platform/tests/sources_velero_crds_test.yaml
@@ -0,0 +1,22 @@
+suite: velero applies CRD updates on upgrade
+# velero evolves its CRD schema between versions (v1.18 adds the Queued and
+# ReadyToStart backup phases). Helm never upgrades CRDs shipped in crds/, and
+# the velero package disables the chart's upgrade-crds Job, so the PackageSource
+# must opt into CreateReplace; without it the server binary upgrades while the
+# live CRDs stay at first-install state, the apiserver rejects the new phases,
+# and backups sit in New while the HelmRelease stays green. Pin the policy so an
+# upgrade cannot silently regress.
+templates:
+  - templates/sources.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: velero PackageSource sets upgradeCRDs to CreateReplace
+    documentSelector:
+      path: metadata.name
+      value: cozystack.velero
+    asserts:
+      - equal:
+          path: spec.variants[0].components[0].install.upgradeCRDs
+          value: CreateReplace
diff --git a/packages/system/velero/tests/velero_test.yaml b/packages/system/velero/tests/velero_test.yaml
index 8a03e1acc..1569a5d0e 100644
--- a/packages/system/velero/tests/velero_test.yaml
+++ b/packages/system/velero/tests/velero_test.yaml
@@ -26,11 +26,18 @@ tests:
           path: spec.template.spec.initContainers[1].image
           value: quay.io/kubevirt/kubevirt-velero-plugin:v0.8.0
 
+<<<<<<< HEAD
   # Cozystack disables the upgrade-crds Job (upgradeCRDs: false) because CRDs
   # ship via the chart's crds/ directory, making the Job redundant, and because
   # on this chart (11.0.0) the Job runs a kubectl image whose tag defaults to the
   # chart's Kubernetes version and need not match the cluster. Pin that
   # invariant — it silently regressed once.
+=======
+  # Cozystack disables the upgrade-crds Job (upgradeCRDs: false): CRD lifecycle
+  # is owned by the generated HelmRelease (upgradeCRDs: CreateReplace on the
+  # velero PackageSource), making the Job redundant. Pin that invariant — it
+  # silently regressed once.
+>>>>>>> f4d812c (fix(velero): apply CRD updates on upgrade via CreateReplace)
   - it: does not emit the upgrade-crds Job when upgradeCRDs is disabled
     template: charts/velero/templates/upgrade-crds/upgrade-crds.yaml
     asserts:
diff --git a/packages/system/velero/values.yaml b/packages/system/velero/values.yaml
index 9bf2200aa..66f0cf109 100644
--- a/packages/system/velero/values.yaml
+++ b/packages/system/velero/values.yaml
@@ -1,6 +1,13 @@
 velero:
+<<<<<<< HEAD
   # Disable CRD upgrade job - CRDs are installed as part of helm chart
   # The upgrade job has issues with kubectl image compatibility
+=======
+  # Disable the upgrade-crds Job: CRD lifecycle is owned by the generated
+  # HelmRelease instead (upgradeCRDs: CreateReplace on the velero PackageSource),
+  # which applies the chart's crds/ directory on install and on every upgrade,
+  # so the Job is redundant.
+>>>>>>> f4d812c (fix(velero): apply CRD updates on upgrade via CreateReplace)
   upgradeCRDs: false
   initContainers:
     - name: velero-plugin-for-aws