Error "Not satisfy the criteria for VolumePolicy or the legacy snapshot way" while taking Velero backups

Products

• VMware Tanzu Kubernetes Grid Management

Issue/Introduction

• The backup failed with following error 

time="2026-04-08T06:06:23Z" level=info msg="Summary for skipped PVs: [{\"name\":\"fin-xxx-xxxxx-pv\",\"reasons\":[{\"approach\":\"podvolume\",\"reason\":\"opted out due to annotation in pod balserv-xxxxxxx-xxxx\"},{\"approach\":\"volumeSnapshot\",\"reason\":\"not satisfy the criteria for VolumePolicy or the legacy snapshot way\"}]},{\"name\":\"fps-xxxxx-pymt-pv\",\"reasons\":[{\"approach\":\"podvolume\",\"reason\":\"opted out due to annotation in pod fwatch-app-xxxxxxxx-xxxxx\"},{\"approach\":\"volumeSnapshot\",\"reason\":\"not satisfy the criteria for VolumePolicy or the legacy snapshot way\"}]}]" backup=velero/tkg-xxxx-syd-prod-xxxx-xxx-backup-xxx-xx logSource="pkg/backup/backup.go:543"

Environment

• VMware Tanzu Kubernetes Grid Management 2.x
• Velero version 1.xx.xx

Cause

• This issue is caused by a configuration mismatch between the StorageClass used by the Persistent Volume (PV) and the allowed policies defined in Velero's 'resource-policy' ConfigMap.
• Velero requires explicit rules to determine how to back up specific storage classes (e.g., via volume snapshots or filesystem backups).
• If a PV uses a StorageClass (like fps-xxxxxx-storageclass) that is not explicitly defined in the 'resource-policy ConfigMap, Velero cannot recognize the storage policy, resulting in the PV data being skipped during the backup.

Resolution

To resolve this issue, you must update the 'resource-policy' ConfigMap in the 'velero' namespace to include the missing StorageClass.

   1. Identify the StorageClass used by the failing PV.

# kubectl get pv <pv-name> 

   2. Describe the skipped PV to verify the StorageClass it is bound to.

[root@xxxxx-xxxx-xx-BOOTSTRAP appadmin]# kubectl describe pv fps-xxxxxx-pymt-pv

Name:            fps-xxxxxx-pymt-pv
Labels:          <none>
Annotations:     pv.kubernetes.io/bound-by-controller: yes
Finalizers:      [kubernetes.io/pv-protection]
StorageClass:    fps-xxxxxx-storageclass
Status:          Bound
Claim:           fps-xxxxxx/pymtfiles-volume-claim
Reclaim Policy:  Retain
Access Modes:    RWX
VolumeMode:      Filesystem
Capacity:        6Gi
Node Affinity:   <none>
Message:
Source:
    Type:      NFS (an NFS mount that lasts the lifetime of a pod)
    Server:    xxx.xx.xx.xx
    Path:      /nfsxxxxxx/FPSxxxxxx/fps-xxxxxx/PYMT/
    ReadOnly:  false
Events:        <none> 

3. Inspect the current Velero resource policy,check the existing rules in the Velero ConfigMap.

[root@xxxxx-xxxx-xx-BOOTSTRAP appadmin]# kubectl describe cm -n velero resource-policy

Name:         resource-policy
Namespace:    velero
Labels:       <none>
Annotations:  <none>

Data
====
resource-policy.yaml:
----
version: v1
volumePolicies:
# each policy consists of a list of conditions and an action
# we could have lots of policies, but if the resource matched the first policy, the latter will be ignored
# each key in the object is one condition, and one policy will apply to resources that meet ALL conditions
# NOTE: capacity or storageClass is suited for [Persistent Volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes), and pod [Volume](https://kubernetes.io/docs/concepts/storage/volumes) not support it.
- conditions:
    # pv matches one of the storage class list
    storageClass:
      - default
  action:
    type: snapshot
- conditions:
    # pv matches one of the storage class list
    storageClass:
      - nfs-client-xxxxxx
  action:
    type: fs-backup 

        4. Update the ConfigMap by editing the ConfigMap to add the appropriate rules for your production storage.

        5. Modify the volumePolicies section to include your target StorageClass. Depending on your backup strategy for this volume type, set the action type accordingly (e.g., fs-backup).                

- conditions:
    # pv matches one of the storage class list
    storageClass:
      - default
  action:
    type: snapshot
- conditions:
    # pv matches one of the storage class list
    storageClass:
      - fps-xxxxxx-storageclass
   action:
    type: fs-backup

6.Once the ConfigMap is saved and applied, subsequent Velero backups will successfully identify the policy for this StorageClass and back up the volume data.

 

 

 

 

Additional Information

Note : 

To prevent future backup failures, ensure you maintain a standard configuration template that covers all approved storage policies whenever a new StorageClass is introduced to the cluster.
Velero doesn't recommend using fs-backup to back up volume data, however recommends using CSI snapshot data mover.