Fix wildcard expansion when includes is empty and excludes has wildcards

changelogs/unreleased/9684-Joeavaikath

@@ -0,0 +1 @@
+Fix wildcard expansion when includes is empty and excludes has wildcards

pkg/util/collections/includes_excludes.go

@@ -164,6 +164,16 @@ func (nie *NamespaceIncludesExcludes) ExpandIncludesExcludes() error {
 			return err
 		}
 
+		// Empty includes means "include all", so normalize to "*" to
+		// prevent the wildcardExpanded+empty guard from excluding
+		// everything, and to match the CLI path's behavior.
+		// Note: Namespace CRs for excluded namespaces will still be
+		// backed up — this is intentional Velero behavior (see
+		// item_backupper.go itemInclusionChecks).
+		if len(includes) == 0 {
+			expandedIncludes = []string{"*"}
+		}
+
 		nie.SetIncludes(expandedIncludes)
 		nie.SetExcludes(expandedExcludes)
 		nie.wildcardExpanded = true

pkg/util/collections/includes_excludes_test.go

@@ -1380,6 +1380,22 @@ func TestNamespaceIncludesExcludesShouldIncludeAfterWildcardExpansion(t *testing
 			testNamespace:    "default",
 			expectedResult:   true,
 		},
+		{
+			name:             "empty includes with wildcard excludes - should include non-matching namespace",
+			includes:         []string{},
+			excludes:         []string{"test-backup*"},
+			activeNamespaces: []string{"default", "kube-system", "test-backup-ns1", "test-backup-ns2"},
+			testNamespace:    "default",
+			expectedResult:   true,
+		},
+		{
+			name:             "empty includes with wildcard excludes - should exclude matching namespace",
+			includes:         []string{},
+			excludes:         []string{"test-backup*"},
+			activeNamespaces: []string{"default", "kube-system", "test-backup-ns1", "test-backup-ns2"},
+			testNamespace:    "test-backup-ns1",
+			expectedResult:   false,
+		},
 	}
 
 	for _, tc := range tests {