This issue tracks the upstream Velero GitHub issue #9201 which is part of the Velero v1.18 milestone.

Description

It is currently not possible to set labels for maintenance-job. I know this is by design, but in out cluster everything is locked up by strict firewall rules. Some firewall rules are set by labels and global network policies for example to access the kube-api. Other network-policies are set in the namespace itself via k8s-native network-policies.

With consistent labels at the maintenance-jobs it is currently not possible to give network-permissions to these maintenance-jobs.

The expectation is to be able to set additional maintenance-jobs labels for maintenance-jobs in order to keep network policies tight.

Upstream Details

• GitHub Issue: https://github.com/vmware-tanzu/velero/issues/9201
• Status: Open
• Assignee: blackpiglet
• Labels: backup-repo/Maintenance
• Created: 2025-08-22T07:46:44Z
• Updated: 2025-09-19T10:32:35Z

This is a feature request to support additional labels on maintenance jobs for network policy configuration.