Control Backup Scope

Backup scope determines what can be restored later. Too broad increases cost and time. Too narrow causes missing resources during restore.

Recommended Order

1. Define the application boundary by namespace.
2. Use labels to narrow resources.
3. Use include and exclude resource filters for special cases.

Namespace Scope

includedNamespaces:
  - demo-bookinfo
  - demo-bookinfo-data

Avoid backing up every namespace in production unless system namespaces and noisy resources are explicitly excluded.

Label Selector

labelSelector:
  matchLabels:
    app: bookinfo

Make sure workloads, services, PVCs, ConfigMaps, and Secrets carry consistent labels.

Console

During application backup creation, use cluster and namespace selection to define the application boundary first. Then use Advanced options / Resource Policies to control resource types.

Key Resource Policies options:

Option	Purpose
All Resources	Includes all cluster-scoped resources. Use when global objects such as CRDs or ClusterRoles must be protected.
Scoped Resources	Includes only resources related to selected namespaces. This is suitable for most application backups.
Included Namespace Scoped Resources	Includes only selected namespace-scoped resource types.
Excluded Namespace Scoped Resources	Excludes selected namespace-scoped resource types. Exclude has higher priority than include.
Included Cluster Scoped Resources	Includes only selected cluster-scoped resource types.
Excluded Cluster Scoped Resources	Excludes selected cluster-scoped resource types to avoid affecting target cluster global configuration during restore.

Resource Policies Request Format

When creating or updating an application backup through the server API, pass these four fields as string arrays at the top level of the request body. Do not pass multiple resource types as one comma-separated string.

{
  "includedNamespaceScopedResources": [
    "deployments.apps",
    "statefulsets.apps",
    "services",
    "configmaps",
    "secrets",
    "persistentvolumeclaims",
    "ingresses.networking.k8s.io"
  ],
  "excludedNamespaceScopedResources": [
    "events",
    "pods",
    "replicasets.apps"
  ],
  "includedClusterScopedResources": [
    "storageclasses.storage.k8s.io"
  ],
  "excludedClusterScopedResources": [
    "ingressclasses.networking.k8s.io",
    "clusterroles.rbac.authorization.k8s.io",
    "clusterrolebindings.rbac.authorization.k8s.io"
  ]
}

Full create example:

POST /apis/appbackups.testudo.softcdata.com/v1/appbackups
Content-Type: application/json

{
  "name": "bookinfo-daily",
  "cluster": "prod-a",
  "schedule": "@daily",
  "storageLocation": "minio-dr",
  "includedNamespaces": ["demo-bookinfo"],
  "includedNamespaceScopedResources": [
    "deployments.apps",
    "statefulsets.apps",
    "services",
    "configmaps",
    "secrets",
    "persistentvolumeclaims"
  ],
  "excludedNamespaceScopedResources": ["events", "pods", "replicasets.apps"],
  "includedClusterScopedResources": [],
  "excludedClusterScopedResources": [
    "storageclasses.storage.k8s.io",
    "ingressclasses.networking.k8s.io"
  ]
}

Use Kubernetes API resource names, preferably the NAME column from kubectl api-resources. Add the API group when needed, such as deployments.apps, ingresses.networking.k8s.io, or storageclasses.storage.k8s.io. Do not put the same resource type in both include and exclude lists of the same group. If scoped fields are used, do not mix them with legacy fields includedResources, excludedResources, or includeClusterResources.

If you need to narrow the scope by labels, switch to Labels Selector Configuration and enable the selector.

Verify

velero backup describe <backup-name> --details

GET /apis/appbackups.testudo.softcdata.com/v1/velero/backups/:backupName/includes?cluster=prod-a