Using custom plugin to change name of cluster role fails, incorrectly reports resource already exists

What steps did you take and what happened:

Attempting to change the name of a cluster role that contains a namespace value using a custom plugin triggered by the namespaceMapping field in a restore object. For example, using mapping plugin-op: diff-op, restore cluster role postgresql-operator-controller-manager-plugin-op as postgresql-operator-controller-manager-diff-op.

Example plugin flow:

time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] Begin Plugin Execute" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:57" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] baseStr postgresql-operator-controller-manager-" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:90" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] srcValue plugin-op" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:95" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] changing name of cluster role postgresql-operator-controller-manager-plugin-op to postgresql-operator-controller-manager-diff-op" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:101" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] new name of cluster role postgresql-operator-controller-manager-diff-op" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:110" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="[cpfs.no-olm-cluster-role-restore] End Plugin Execute" cmd=/plugins/cpfs-oadp-plugins logSource="/workspace/plugins/noolmclusterrole/restore.go:123" pluginName=cpfs-oadp-plugins restore=velero/plugin-test-3-12-3
time="2025-03-13T19:36:32Z" level=info msg="Attempting to restore ClusterRole: postgresql-operator-controller-manager-plugin-op" logSource="/remote-source/velero/app/pkg/restore/restore.go:1487" restore=velero/plugin-test-3-12-3
...
time="2025-03-13T19:36:32Z" level=warning msg="Cluster resource restore warning: could not restore, ClusterRole \"postgresql-operator-controller-manager-diff-op\" already exists. Warning: the in-cluster version is different than the backed-up version" logSource="/remote-source/velero/app/pkg/controller/restore_controller.go:618" restore=velero/plugin-test-3-12-3

The warning states the diff-op cluster role already exists but it is not present, only the plugin-op cluster role exists. When I try to restore after deleting the original, only the original is restored.

I have similar problems with similar logic for updating cluster rolebindings and mutating/validating webhook configurations but with different outcomes. For the rolebindings, if I delete the original rolebinding, both the original and the new are restored but only if the original is not already present. If it is present then nothing is restored. For the webhooks, if the original is not present, only the new is restored but only if the original is not present. If the original is present, nothing is restored.

What did you expect to happen: I expect to see a second cluster role alongside the original. Using the above example, I would expect to see the original postgresql-operator-controller-manager-plugin-op and postgresql-operator-controller-manager-diff-op. Same goes for the rolebindings and webhooks.

The following information will help us better understand what's going on: I am using a custom go plugin that checks the resource's name string against specified strings then checks the substring containing the namespace against the mapped namespaces. From the logs sent above, you can see that these values are being found and substituted properly up until the point of attempting to restore. From the strange "successes" where the new resource was created with rolebindings and webhooks, I can tell that the plugin is accurately change the string value of the resource name.

If you are using velero v1.7.0+:
Please use velero debug --backup <backupname> --restore <restorename> to generate the support bundle, and attach to this issue, more options please refer to velero debug --help

bundle-2025-03-13-16-18-29.tar.gz

If you are using earlier versions:
Please provide the output of the following commands (Pasting long output into a GitHub gist or other pastebin is fine.)

• kubectl logs deployment/velero -n velero
• velero backup describe <backupname> or kubectl get backup/<backupname> -n velero -o yaml
• velero backup logs <backupname>
• velero restore describe <restorename> or kubectl get restore/<restorename> -n velero -o yaml
• velero restore logs <restorename>

Anything else you would like to add:

Environment:

• Velero version (use velero version): 1.14.1-OADP
• Velero features (use velero client config get features):
• Kubernetes version (use kubectl version): 1.29.10
• Kubernetes installer & version: Openshift 4.16.23
• Cloud provider or hardware configuration: x86_64
• OS (e.g. from /etc/os-release): RHEL 9

Vote on this issue!

This is an invitation to the Velero community to vote on issues, you can see the project's top voted issues listed here.
Use the "reaction smiley face" up to the right of this comment to vote.

• :+1: for "I would like to see this bug fixed as soon as possible"
• :-1: for "There are more important bugs to focus on right now"