Look for extending the hub backup policy templates with a new one, to check if any of the generated MSA tokens (named auto-import-account and with a label authentication.open-cluster-management.io/is-managed-serviceaccount: "true" ) have no backup label ( meaning they would not be backed up, so the restore will not reimport this managed cluster )

The label is cluster.open-cluster-management.io/backup: msa

kind: Secret

metadata:

  name: auto-import-account

  namespace: vb-managed-1

  annotations:

    expirationTimestamp: "2023-10-13T13:32:58Z"

    lastRefreshTimestamp: "2023-10-03T13:32:59Z"

  creationTimestamp: "2023-10-03T13:32:59Z"

  labels:

    authentication.open-cluster-management.io/is-managed-serviceaccount: "true"

    cluster.open-cluster-management.io/backup: msa