How to properly restore a NS resource while using HNC (Hierarchical Namespaces) ?

[penoux]

Hello,

We are struggling on an incompatibility between Velero and HNC controller while restoring a namespace resource.

On any namespace or subnamespace, HNC controller adds dedicated labels, example:

apiVersion: v1
kind: Namespace
metadata:
  labels:
    hnc.x-k8s.io/included-namespace: "true"
    kubernetes.io/metadata.name: pen-velero
    pen-velero.tree.hnc.x-k8s.io/depth: "0"
  name: pen-velero

Velero backup works fine, but the restore fails:

Error from server (Forbidden): error when creating "pen-velero.yaml": admission webhook "namespaces.hnc.x-k8s.io" denied the request: namespaces "pen-velero" is forbidden: cannot set or modify tree label "pen-velero.tree.hnc.x-k8s.io/depth" in namespace "pen-velero"; these can only be managed by HNC

The only workaround we have atm is, with bash scripts, to:

1. save any labels or annotations we want to further restore in a dedicated file, outside of Velero
2. backup the namespace
3. create the target namespace
4. re-apply the labels saved at step 1
5. restore with Velero (which will not try to restore the namespace resource as it already exists

This is a lot of boilerplate for such a simple requirement, and we have data saved in a separate place.

We have tried to use resource-modifiers configmap at restore time to remove HNC labels on the fly. Thing is that some HNC labels include the namespace name, so we would have to generate and deploy a dedicated configmap before each restore...
Is there any way to proceed? To capture the namespace name into a regex and reuse it in a label patch/remove?