Describe the solution you'd like
Trident already auto-detects the temporary snapshot-clone PVCs created by Veeam
Kasten, Trilio, and Cohesity backup workflows (IsEphemeralPVC in
frontend/csi/controller_helpers/kubernetes/helper.go) and defaults
skipRecoveryQueue=true on them, so the resulting ONTAP FlexClones don't pile up
in the ONTAP Volume Recovery Queue. Commvault backups create equivalent
temporary clone PVCs but are not recognized, so their clones accumulate in the
recovery queue.
Please add Commvault to that detection. Commvault stamps the label
cv-backup-admin (with an intentionally empty value) on the temporary
snapshot-clone PVCs it creates during a backup job. Adding an
IsCommvaultEphemeralPVC check — matching on key existence, since the value is
empty — and wiring it into IsEphemeralPVC would make Commvault behave like the
other backup vendors: SkipRecoveryQueue defaults to true at PVC CREATE, while
an explicit trident.netapp.io/skipRecoveryQueue annotation is still honored.
Describe alternatives you've considered
- OPA Gatekeeper
AssignMetadata (via ACM policy) to inject the skip annotation
on matching PVCs at admission — works, but adds an external, per-cluster
mutating-webhook dependency.
- A dedicated Trident virtual pool + StorageClass with
skipRecoveryQueue=true
for Commvault clones — only viable if Commvault can be pointed at that
StorageClass.
- Native detection in Trident (this request) is the most robust option and is
consistent with how Kasten, Trilio, and Cohesity are already handled.
Additional context
- Observed on OpenShift with Trident on an ONTAP backend. Commvault takes a CSI
snapshot of the source PVC, creates a clone PVC from that snapshot, attaches it
to an access node, reads it, then deletes the clone and snapshot. The deleted
clone (an ONTAP FlexClone) lands in the ONTAP Volume Recovery Queue.
skipRecoveryQueue must be set at PVC CREATE because it is recorded in the
volume config that the delete path later reads — which is why admission-time
detection is required.- Unlike Kasten/Trilio/Cohesity (which match on a non-empty label value), the
Commvault cv-backup-admin label value is intentionally empty, so detection
must be by key existence only.
- I have a working implementation ready (adds
LabelCommvaultBackupAdminKey,
IsCommvaultEphemeralPVC, unit tests, and a CHANGELOG entry) and would like to
open a PR for it per CONTRIBUTING.md.
Describe the solution you'd like
Trident already auto-detects the temporary snapshot-clone PVCs created by Veeam
Kasten, Trilio, and Cohesity backup workflows (
IsEphemeralPVCinfrontend/csi/controller_helpers/kubernetes/helper.go) and defaultsskipRecoveryQueue=trueon them, so the resulting ONTAP FlexClones don't pile upin the ONTAP Volume Recovery Queue. Commvault backups create equivalent
temporary clone PVCs but are not recognized, so their clones accumulate in the
recovery queue.
Please add Commvault to that detection. Commvault stamps the label
cv-backup-admin(with an intentionally empty value) on the temporarysnapshot-clone PVCs it creates during a backup job. Adding an
IsCommvaultEphemeralPVCcheck — matching on key existence, since the value isempty — and wiring it into
IsEphemeralPVCwould make Commvault behave like theother backup vendors:
SkipRecoveryQueuedefaults totrueat PVC CREATE, whilean explicit
trident.netapp.io/skipRecoveryQueueannotation is still honored.Describe alternatives you've considered
AssignMetadata(via ACM policy) to inject the skip annotationon matching PVCs at admission — works, but adds an external, per-cluster
mutating-webhook dependency.
skipRecoveryQueue=truefor Commvault clones — only viable if Commvault can be pointed at that
StorageClass.
consistent with how Kasten, Trilio, and Cohesity are already handled.
Additional context
snapshot of the source PVC, creates a clone PVC from that snapshot, attaches it
to an access node, reads it, then deletes the clone and snapshot. The deleted
clone (an ONTAP FlexClone) lands in the ONTAP Volume Recovery Queue.
skipRecoveryQueuemust be set at PVC CREATE because it is recorded in thevolume config that the delete path later reads — which is why admission-time
detection is required.
Commvault
cv-backup-adminlabel value is intentionally empty, so detectionmust be by key existence only.
LabelCommvaultBackupAdminKey,IsCommvaultEphemeralPVC, unit tests, and a CHANGELOG entry) and would like toopen a PR for it per CONTRIBUTING.md.