[mattlord]

Summary

Backport of #818 (fixes #817) to release-2.17.

Fix backup-schedule create/delete loops caused by stale cron timestamps and lost Job history. The controller now uses persisted per-strategy status as its scheduling cursor and measures timeouts from the actual Job start time.

This prevents completed or timed-out Jobs from resetting scheduling state, including when successfulJobsHistoryLimit: 0 or the operator catches up a missed cron slot after downtime.

This also backports the following CI changes as we could not otherwise merge anything in the release-2.17 branch:

• Pin Actions SHAs #789
• Migrate end-to-end tests to GitHub Actions #805
  • This required updating the branch protection rules to match main as well

Changes

• Use status.lastScheduledTimes as the durable scheduling cursor.
• Repair stale status from newer Job annotations before cleaning up Job history.
• Measure jobTimeoutMinute from Job.status.startTime; Jobs that have not started cannot time out.
• Support jobTimeoutMinute: -1 to disable timeout cleanup. The default remains 10 minutes.
• Delete timed-out Jobs with foreground propagation. Under concurrencyPolicy: Forbid, a terminating Job remains active until Kubernetes removes its Pods, blocking a replacement.
• Preserve vtbackup PVCs when Job deletion fails.
• Skip repeated timeout cleanup for Jobs already being deleted.
• Update VitessBackupSchedule status only when it changes.

The cherry-pick of 168d0fd applied cleanly with no conflicts.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Timeout cleanup can skip PVC deletion retries once a timed-out Job has a DeletionTimestamp, potentially leaking vtbackup PVCs after transient PVC cleanup errors.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Backports the fix for VitessBackupSchedule reconcile loops by making scheduling state durable (status-based cursor) and by measuring timeouts from the Kubernetes Job’s actual status.startTime rather than the cron slot timestamp.

Changes:

• Switch scheduling cursor behavior to rely on persisted status.lastScheduledTimes, with repair from newer Job annotations before history cleanup.
• Rework timeout cleanup to use Job.status.startTime, support jobTimeoutMinute: -1, and delete timed-out Jobs with foreground propagation.
• Update CRD/OpenAPI schema + generated API docs and add regression tests to prevent reintroduction.

File summaries

File	Description
test/endtoend/operator/operator-latest.yaml	Updates OpenAPI schema minimum to allow jobTimeoutMinute: -1.
pkg/controller/vitessbackupschedule/vtctldclient_backup_test.go	Adjusts timeout test to set Job.status.startTime and pass a deterministic now.
pkg/controller/vitessbackupschedule/vitessbackupschedule_controller.go	Core controller changes: durable scheduling cursor, startTime-based timeout cleanup, conditional status updates.
pkg/controller/vitessbackupschedule/scheduling_regression_test.go	Adds targeted regression coverage for scheduling cursor + timeout semantics + deletion behavior.
pkg/apis/planetscale/v2/vitessbackupschedule_types.go	Updates API docs/validation for JobTimeoutMinutes and allows -1.
docs/api/index.html	Regenerates HTML API docs to reflect updated timeout semantics.
docs/api.md	Regenerates Markdown API docs to reflect updated timeout semantics.
deploy/crds/planetscale.com_vitessclusters.yaml	Updates CRD schema minimum for jobTimeoutMinute to -1.
deploy/crds/planetscale.com_vitessbackupschedules.yaml	Updates CRD schema minimum for jobTimeoutMinute to -1.

Review details

• Files reviewed: 13/13 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.