OADP-7955: Hides --namespace flag from nonadmin commands

[NicholasYancey]

Why the changes were made

The --namespace flag was appearing in the help section for all nonadmin commands, but was silently ignored. If the user tried to use the -n, --namespace under a NAB, the flag was ignored. The user should not be able to see flags that they cannot use in that context which is why I chose to hide the flag from the user.

How to test the changes made

Verify the namespace flag is hidden from nonadmin commands:

# Check nonadmin backup commands - should NOT show -n, --namespace flag
oc oadp nonadmin backup get --help

# Check nonadmin restore commands - should NOT show -n, --namespace flag
oc oadp nonadmin restore get --help

Before this fix:
The Global Flags section showed:
-n, --namespace string    The namespace in which Velero should operate (default "openshift-adp")

After this fix:
That flag line is no longer visible in nonadmin command help.

Verify nonadmin commands still work correctly:
# Switch to a test namespace
oc project test-namespace

# Create a backup - uses current context namespace
oc oadp nonadmin backup create test-backup --storage-location <your-nabsl>

# Verify backup created in current namespace
oc get nab test-backup -n test-namespace


<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **Bug Fixes**
* The --namespace flag is hidden from help for non-admin subcommands to reduce confusion.
* Passing -n/--namespace to non-admin subcommands now returns a clear runtime error instead of being accepted silently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: NicholasYancey
Once this PR has been reviewed and has the lgtm label, please assign joeavaikath for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a local nonadminCmd in NewVeleroRootCommand, registers it on the root, rejects runtime -n/--namespace for that subtree, and adds a helper that wraps each command's HelpFunc to hide the inherited --namespace flag while help is rendered.

Changes

Nonadmin namespace flag hiding

Layer / File(s)	Summary
Register nonadmin subtree and forbid runtime namespace cmd/root.go	NewVeleroRootCommand stores the nonadmin command in a local nonadminCmd, adds it to the root, calls the hide helper, and sets nonadminCmd.PersistentPreRunE to return an error when -n/--namespace is used at runtime.
Help rendering wrapper to hide inherited flag cmd/root.go	Adds hideNamespaceFlagFromCommand, which recursively wraps each command's HelpFunc so the inherited namespace flag is temporarily marked hidden during help output and then restored.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• migtools/oadp-cli#134: Also modifies cmd/root.go and nonadmin command wiring; related to nonadmin command behavior changes.
• migtools/oadp-cli#182: Touches cmd/root.go's namespace handling and default namespace behavior that interacts with help output.

Suggested reviewers

• weshayutin
• Joeavaikath

Poem

I’m a rabbit in the CLI wood,
I hop the subcommands like I should,
I tuck --namespace out of sight,
Wrap HelpFunc soft and light,
🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes both required sections: 'Why the changes were made' with clear context about the problem, and 'How to test the changes made' with specific testing instructions including commands and expected outcomes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: hiding the --namespace flag from nonadmin commands, which directly matches the implementation in cmd/root.go.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/root.go`:
- Around line 517-519: The code currently unconditionally restores flag.Hidden
to false in the defer, which can expose a flag that was originally hidden;
capture the original state before mutating (e.g., save originalHidden :=
flag.Hidden after Lookup("namespace")), set flag.Hidden = true, and in the defer
restore flag.Hidden = originalHidden so the flag's prior visibility (from the
flag returned by c.InheritedFlags().Lookup("namespace")) is preserved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4909b24-cee6-42bc-acf3-9b8d6d1ce95f

📥 Commits

Reviewing files that changed from the base of the PR and between bd29af5 and 11cb0ce.

📒 Files selected for processing (1)

• cmd/root.go

[mpryc]

This PR is not wrong, but it does just hide the command and not prevent non-admin user to pass the --namespace, a much better fix would be to reject it with an error in a PersistentPreRunE on the nonadmin command, e.g.:

  nonadminCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {                                                                                                            
      if cmd.Flags().Changed("namespace") {                                                                                                                                                  
          return fmt.Errorf("--namespace is not supported for nonadmin commands; namespace is determined by your current context")                                                           
      }                                                                                                                                                                                      
      return nil                                                                                                                                                                             
  } 

[weshayutin]

This PR is not wrong, but it does just hide the command and not prevent non-admin user to pass the --namespace, a much better fix would be to reject it with an error in a PersistentPreRunE on the nonadmin command, e.g.:

  nonadminCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {                                                                                                            
      if cmd.Flags().Changed("namespace") {                                                                                                                                                  
          return fmt.Errorf("--namespace is not supported for nonadmin commands; namespace is determined by your current context")                                                           
      }                                                                                                                                                                                      
      return nil                                                                                                                                                                             
  } 

I agree w/ @mpryc
let's try to either remove or block the namespace option if hidden. worse comes to worse overwrite the namespace with the current project namespace lolz.. that will get em lolz

[weshayutin]

https://redhat.atlassian.net/browse/OADP-7955

[openshift-ci-robot]

@NicholasYancey: This pull request references OADP-7955 which is a valid jira issue.

Details

In response to this:

Why the changes were made

The --namespace flag was appearing in the help section for all nonadmin commands, but was silently ignored. If the user tried to use the -n, --namespace under a NAB, the flag was ignored. The user should not be able to see flags that they cannot use in that context which is why I chose to hide the flag from the user.

How to test the changes made

Verify the namespace flag is hidden from nonadmin commands:

# Check nonadmin backup commands - should NOT show -n, --namespace flag
oc oadp nonadmin backup get --help

# Check nonadmin restore commands - should NOT show -n, --namespace flag
oc oadp nonadmin restore get --help

Before this fix:
The Global Flags section showed:
-n, --namespace string    The namespace in which Velero should operate (default "openshift-adp")

After this fix:
That flag line is no longer visible in nonadmin command help.

Verify nonadmin commands still work correctly:
# Switch to a test namespace
oc project test-namespace

# Create a backup - uses current context namespace
oc oadp nonadmin backup create test-backup --storage-location <your-nabsl>

# Verify backup created in current namespace
oc get nab test-backup -n test-namespace


<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **Bug Fixes**
* The --namespace flag is hidden from help for non-admin subcommands to reduce confusion.
* Passing -n/--namespace to non-admin subcommands now returns a clear runtime error instead of being accepted silently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[weshayutin]

@NicholasYancey note, to link pr's to jira if there is a jira :) .. Per branch