The adopt guard in the backup strategy controllers compares the application kind and name of an existing Backup and nothing else. artifactURITemplate is not part of the comparison.
The window: two runs share a BackupJob name, and the artifact URI template changed between them. The controller adopts the existing Backup, which keeps the status.artifact.uri and client image recorded on the earlier run, while the Job it launches writes to the new key. Every consumer then reads the stale record. A restore fetches the old object, cleanup deletes the old object, and the object the Job actually wrote stays in the bucket with nothing referencing it.
The same guard shape sits in internal/backupcontroller/rabbitmqstrategy_controller.go around lines 507-518, so this is on main today rather than something a pending PR introduces. It came up while reviewing #4000, whose Kafka driver copies that guard line for line, and the review carries it as a non-blocking note for that reason.
Fix shape: compare the StrategyRef and the recorded artifact URI before adopting, or treat a mismatch as a name collision and fail the job. Both drivers want the same change in one pass, since the second is a copy of the first.
The adopt guard in the backup strategy controllers compares the application kind and name of an existing Backup and nothing else.
artifactURITemplateis not part of the comparison.The window: two runs share a BackupJob name, and the artifact URI template changed between them. The controller adopts the existing Backup, which keeps the
status.artifact.uriand client image recorded on the earlier run, while the Job it launches writes to the new key. Every consumer then reads the stale record. A restore fetches the old object, cleanup deletes the old object, and the object the Job actually wrote stays in the bucket with nothing referencing it.The same guard shape sits in
internal/backupcontroller/rabbitmqstrategy_controller.goaround lines 507-518, so this is on main today rather than something a pending PR introduces. It came up while reviewing #4000, whose Kafka driver copies that guard line for line, and the review carries it as a non-blocking note for that reason.Fix shape: compare the StrategyRef and the recorded artifact URI before adopting, or treat a mismatch as a name collision and fail the job. Both drivers want the same change in one pass, since the second is a copy of the first.