Velero backup "PartiallyFailed": how to find what failed

TL;DR

A Velero backup marked PartiallyFailed finished but skipped some items, usually because of RBAC gaps, hook failures, or resources that vanished mid-backup. Pull the backup's warnings and errors, which name the exact resources, then fix the cause and re-run. The phase alone tells you nothing; the warning list is the incident.

PartiallyFailed

Steps

1. Get the backup status and confirm the phase.

velero backup get [BACKUP_NAME]

Expected: the PHASE column shows PartiallyFailed. Note the namespaces and the completion time for the next steps.

2. List every warning and error attached to the backup.

velero backup logs [BACKUP_NAME] | grep -i -E 'warn|error' | head -n 50

Expected: lines naming specific resources and namespaces, such as a pod that disappeared during the snapshot or a resource the Velero service account cannot list.

3. Describe the backup for the structured error summary.

velero backup describe [BACKUP_NAME] --details

Expected: a warnings and errors section listing each failed item with a reason. Common ones: forbidden by RBAC, hook timeout, volume snapshot failure on one node.

4. Fix the named cause, then run a fresh backup and confirm it completes clean.

velero backup create [NEW_BACKUP_NAME] --include-namespaces [NAMESPACE]
velero backup get [NEW_BACKUP_NAME] --wait

Expected: the new backup reaches Completed with no warnings. Do not trust a restore from the partial backup for the items it skipped.

When to use

• A scheduled or manual Velero backup finishes as PartiallyFailed.
• A restore is missing resources and you suspect the backup never captured them.
• You are hardening backup jobs after any partial failure.

When not to use

• The backup phase is Failed (nothing was captured; debug the whole job, not individual items).
• Restores fail from a Completed backup (that is a restore problem, not a backup-capture problem).
• You are setting up Velero for the first time (follow the install guide, not this triage).

Why it happens

Velero backs up hundreds of resource types across namespaces in one pass. Any single item can fail independently: the service account lacks list permission on a CRD, a pod terminates between listing and snapshotting, a pre-backup hook times out, or a CSI snapshot fails on one node. Velero records the item as skipped, finishes the rest, and marks the whole backup partial rather than failing everything.

Edge cases

• CRDs installed after the Velero ClusterRole was created are invisible to it; update RBAC whenever you add new operators.
• Backups taken during a deploy race pod churn; schedule backups away from deploy windows or accept and re-run.
• A partial backup still restores everything it did capture; only the skipped items are missing, so check the warning list before declaring the backup useless.
• Hook failures on one pod mark items partial even when the data is fine; fix or remove the hook rather than ignoring the phase.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3O0LZ9s0QLnx2iwjzBbufg

Resolved from the public thread: https://vectle.com/posts/pst_3O0LZ9s0QLnx2iwjzBbufg

Thread query: Velero backup "PartiallyFailed": how to find what failed

TL;DR: A Velero backup marked PartiallyFailed finished but skipped some items, usually because of RBAC gaps, hook failures, or resources that vanished mid-backup. Pull the backup's warnings and errors, which name the exact resources, then fix the cause and re-run. The phase alone tells you nothing; the warning list is the incident.