fix(snapshots): don't decide minio availability from the image repository

The kURL minio add-on ships from kurlsh/minio now, which the previous
minio/minio match missed, so IsFileSystemMinioDisabled reported minio as
disabled and put NFS/host path snapshots into LVP mode.

Split the two uses of the add-on lookup, which want opposite biases:

  - MinioAvailable answers whether minio can be run at all and looks only
    for the add-on workload, so it no longer breaks when the add-on moves
    to another repository.
  - GetMinioImage keeps choosing which image to run and now accepts both
    repositories the add-on has shipped from, with an optional registry
    prefix. On kURL installs in the default namespace that image is run
    as-is, with no registry rewrite or pull secret, so an image from any
    other repository is left alone and the bundled image is used instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sgalsaleh

pkg/image/minio.go

@@ -11,10 +11,11 @@ import (
 	"k8s.io/client-go/kubernetes"
 )
 
-// minioReleaseImageRegexp matches any repository whose image name is "minio" with an
-// upstream RELEASE tag, e.g. "minio/minio:RELEASE.2025-10-15T17-29-55Z" and
-// "kurlsh/minio:RELEASE.2025-10-15T17-29-55Z".
-var minioReleaseImageRegexp = regexp.MustCompile(`(^|/)minio:RELEASE\.`)
+// minioAddonImageRegexp matches the repositories the kURL minio add-on has shipped
+// from, with an upstream RELEASE tag and an optional registry prefix, e.g.
+// "minio/minio:RELEASE.2025-10-15T17-29-55Z", "kurlsh/minio:RELEASE.2025-10-15T17-29-55Z"
+// and "registry.example.com/kurlsh/minio:RELEASE.2025-10-15T17-29-55Z".
+var minioAddonImageRegexp = regexp.MustCompile(`(^|/)(minio|kurlsh)/minio:RELEASE\.`)
 
 // MinioImage looks through the nodes in the cluster and finds nodes that have already pulled Minio, and then finds the latest image tag listed
 func GetMinioImage(clientset kubernetes.Interface, kotsadmNamespace string) (string, error) {
@@ -35,7 +36,7 @@ func GetMinioImage(clientset kubernetes.Interface, kotsadmNamespace string) (str
 	}
 	if err == nil {
 		for _, container := range deployment.Spec.Template.Spec.Containers {
-			if isMinioReleaseImage(container.Image) {
+			if isMinioAddonImage(container.Image) {
 				return container.Image, nil
 			}
 		}
@@ -49,7 +50,7 @@ func GetMinioImage(clientset kubernetes.Interface, kotsadmNamespace string) (str
 	}
 	if err == nil {
 		for _, container := range statefulset.Spec.Template.Spec.Containers {
-			if isMinioReleaseImage(container.Image) {
+			if isMinioAddonImage(container.Image) {
 				return container.Image, nil
 			}
 		}
@@ -58,10 +59,39 @@ func GetMinioImage(clientset kubernetes.Interface, kotsadmNamespace string) (str
 	return "", nil
 }
 
-// isMinioReleaseImage returns true if the image is a minio image with an upstream
-// RELEASE tag, regardless of which repository it was published to. The add-on has
-// shipped from more than one repository (minio/minio, kurlsh/minio), so only the
-// image name and tag are matched, not the registry or organization.
-func isMinioReleaseImage(image string) bool {
-	return minioReleaseImageRegexp.MatchString(image)
+// isMinioAddonImage returns true if the image is one the kURL minio add-on has
+// shipped. On kURL installs in the default namespace this image is run as-is, without
+// a registry rewrite or pull secret, so images from other repositories are not
+// adopted: the bundled image is used instead.
+func isMinioAddonImage(image string) bool {
+	return minioAddonImageRegexp.MatchString(image)
+}
+
+// MinioAvailable reports whether a minio image is available to run for this
+// installation. Outside kURL installs in the default namespace kots uses the image it
+// bundles; there, minio is only available if the kURL add-on provides it.
+func MinioAvailable(clientset kubernetes.Interface, kotsadmNamespace string) (bool, error) {
+	// expected to fail for minimal rbac
+	isKurl, _ := kurl.IsKurl(clientset)
+	if !isKurl || kotsadmNamespace != metav1.NamespaceDefault {
+		return true, nil
+	}
+
+	_, err := clientset.AppsV1().Deployments("minio").Get(context.TODO(), "minio", metav1.GetOptions{})
+	if err == nil {
+		return true, nil
+	}
+	if !kuberneteserrors.IsNotFound(err) {
+		return false, errors.Wrap(err, "failed to get minio deployment")
+	}
+
+	_, err = clientset.AppsV1().StatefulSets("minio").Get(context.TODO(), "ha-minio", metav1.GetOptions{})
+	if err == nil {
+		return true, nil
+	}
+	if !kuberneteserrors.IsNotFound(err) {
+		return false, errors.Wrap(err, "failed to get ha-minio statefulset")
+	}
+
+	return false, nil
 }

pkg/image/minio_test.go

@@ -135,6 +135,38 @@ func Test_GetMinioImage(t *testing.T) {
 			wantImage:        "registry.example.com:5000/kurlsh/minio:RELEASE.2025-10-15T17-29-55Z",
 			wantErr:          false,
 		},
+		{
+			name: "should ignore a minio image from a repository the add-on does not ship from",
+			clientset: fake.NewSimpleClientset(
+				&corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      kurl.ConfigMapName,
+						Namespace: kurl.ConfigMapNamespace,
+					},
+				},
+				&appsv1.Deployment{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "minio",
+						Namespace: "minio",
+					},
+					Spec: appsv1.DeploymentSpec{
+						Template: corev1.PodTemplateSpec{
+							Spec: corev1.PodSpec{
+								Containers: []corev1.Container{
+									{
+										Name:  "minio",
+										Image: "registry.acme.com/acme/minio:RELEASE.2025-10-15T17-29-55Z",
+									},
+								},
+							},
+						},
+					},
+				},
+			),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			wantImage:        "",
+			wantErr:          false,
+		},
 		{
 			name: "should return empty image when the minio container is not a RELEASE build",
 			clientset: fake.NewSimpleClientset(
@@ -225,3 +257,79 @@ func Test_GetMinioImage(t *testing.T) {
 		})
 	}
 }
+
+func Test_MinioAvailable(t *testing.T) {
+	kurlConfigMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      kurl.ConfigMapName,
+			Namespace: kurl.ConfigMapNamespace,
+		},
+	}
+	minioDeployment := func(image string) *appsv1.Deployment {
+		return &appsv1.Deployment{
+			ObjectMeta: metav1.ObjectMeta{Name: "minio", Namespace: "minio"},
+			Spec: appsv1.DeploymentSpec{
+				Template: corev1.PodTemplateSpec{
+					Spec: corev1.PodSpec{
+						Containers: []corev1.Container{{Name: "minio", Image: image}},
+					},
+				},
+			},
+		}
+	}
+
+	tests := []struct {
+		name             string
+		clientset        kubernetes.Interface
+		kotsadmNamespace string
+		want             bool
+	}{
+		{
+			name:             "kots bundles an image for non-kurl instances",
+			clientset:        fake.NewSimpleClientset(),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			want:             true,
+		},
+		{
+			name:             "kots bundles an image for kurl instances outside the default namespace",
+			clientset:        fake.NewSimpleClientset(kurlConfigMap),
+			kotsadmNamespace: "custom-namespace",
+			want:             true,
+		},
+		{
+			name:             "kurl add-on deployment is present",
+			clientset:        fake.NewSimpleClientset(kurlConfigMap, minioDeployment("kurlsh/minio:RELEASE.2025-10-15T17-29-55Z")),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			want:             true,
+		},
+		{
+			name:             "add-on image from an unrecognized repository still counts as available",
+			clientset:        fake.NewSimpleClientset(kurlConfigMap, minioDeployment("kurlsh/minio:0.20250101.0")),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			want:             true,
+		},
+		{
+			name: "kurl add-on statefulset is present",
+			clientset: fake.NewSimpleClientset(kurlConfigMap, &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "ha-minio", Namespace: "minio"},
+			}),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			want:             true,
+		},
+		{
+			name:             "kurl instance without the add-on",
+			clientset:        fake.NewSimpleClientset(kurlConfigMap),
+			kotsadmNamespace: metav1.NamespaceDefault,
+			want:             false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := require.New(t)
+			got, err := MinioAvailable(test.clientset, test.kotsadmNamespace)
+			req.NoError(err)
+			req.Equal(test.want, got)
+		})
+	}
+}

pkg/snapshot/filesystem_lvp.go

@@ -301,13 +301,13 @@ func IsFileSystemMinioDisabled(kotsadmNamespace string) (bool, error) {
 	}
 
 	//Minio disabled is detected based on two cases
-	// 1. minio image is not present in the cluster
+	// 1. minio is not available in the cluster
 	// 2. disableS3 flag is enabled
-	minioImage, err := image.GetMinioImage(clientset, kotsadmNamespace)
+	minioAvailable, err := image.MinioAvailable(clientset, kotsadmNamespace)
 	if err != nil {
-		return false, errors.Wrap(err, "failed to check minio image")
+		return false, errors.Wrap(err, "failed to check if minio is available")
 	}
-	if minioImage == "" {
+	if !minioAvailable {
 		return true, nil
 	}