fix: copy all labels from node-agent to hosting pods for PVB/PVR

[testsabirweb]

Fixes #9435

Problem

In v1.17.0, Velero introduced a micro-service architecture where pod volume backups/restores run in separate hosting pods instead of directly in node-agent pods. The hosting pods only inherited labels from a hardcoded whitelist (util.ThirdPartyLabels), which caused issues when clusters require additional labels (e.g., proxy labels for mutating webhooks).

Solution

• Added GetAllLabelsFromNodeAgent() function in pkg/nodeagent/node_agent.go that copies all labels from the node-agent DaemonSet
• Updated pod_volume_backup_controller.go and pod_volume_restore_controller.go to use the new function
• Hosting pods now inherit all labels from node-agent (including proxy labels, Helm labels, etc.)

Changes

• pkg/nodeagent/node_agent.go: Added GetAllLabelsFromNodeAgent() function that retrieves all labels from node-agent DaemonSet
• pkg/controller/pod_volume_backup_controller.go: Updated setupExposeParam() to use GetAllLabelsFromNodeAgent() instead of only copying whitelisted labels
• pkg/controller/pod_volume_restore_controller.go: Updated setupExposeParam() to use GetAllLabelsFromNodeAgent() instead of only copying whitelisted labels

Testing

• Verified that hosting pods now inherit all labels from node-agent DaemonSet
• Backward compatibility maintained: still copies util.ThirdPartyLabels as fallback if DaemonSet lookup fails

Impact

This fix ensures that hosting pods inherit all necessary labels from node-agent, enabling:

• Mutating webhooks that match pods by labels (e.g., proxy injection)
• Admission controllers that require specific labels
• Network policies that select pods by labels
• Any cluster policy that depends on labels from node-agent DaemonSet

Thank you for contributing to Velero!

Please add a summary of your change

Does your change fix a particular issue?

Fixes #(issue)

Please indicate you've done the following:

• Accepted the DCO. Commits without the DCO will delay acceptance.
• Created a changelog file (make new-changelog) or comment /kind changelog-not-required on this PR.
• Updated the corresponding documentation in site/content/docs/main.

[kaovilai]

fix DCO by signing off

[codecov]

Codecov Report

❌ Patch coverage is 7.14286% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.97%. Comparing base (d96434c) to head (c951a29).

Files with missing lines	Patch %	Lines
pkg/nodeagent/node_agent.go	0.00%	12 Missing ⚠️
pkg/controller/pod_volume_backup_controller.go	12.50%	4 Missing and 3 partials ⚠️
pkg/controller/pod_volume_restore_controller.go	12.50%	4 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9436      +/-   ##
==========================================
- Coverage   60.01%   59.97%   -0.04%     
==========================================
  Files         384      384              
  Lines       35387    35413      +26     
==========================================
+ Hits        21236    21240       +4     
- Misses      12591    12608      +17     
- Partials     1560     1565       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.