apps/base/jellyfin/cnpg_cluster.yaml

@@ -10,6 +10,13 @@ metadata:
   name: jellyfin-postgres
   namespace: jellyfin
 spec:
+  # Exclude the operator-managed data PVCs (jellyfin-postgres-N) from the
+  # jellyfin-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
+  # so unannotated PVCs are swept in). Postgres has its own barmanObjectStore
+  # backup below; restic must not touch the raw RWO data volumes.
+  inheritedMetadata:
+    annotations:
+      k8up.io/backup: "false"
   affinity:
     podAntiAffinityType: preferred
   backup:

apps/base/jellyfin/pvc-media-movies.yaml

@@ -7,6 +7,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-media-movies
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/pvc-media-tv.yaml

@@ -7,6 +7,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-media-tv
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/pvc-transcode.yaml

@@ -8,6 +8,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-transcode
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Transcode is RWX
+    # scratch — nothing to back up.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/redis-pvc.yaml

@@ -4,6 +4,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-redis-data
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Redis holds only
+    # ephemeral transcode-lease state; RWO would also fail to mount while in use.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteOnce

apps/base/jellyfin/statefulset.yaml

@@ -230,6 +230,11 @@ spec:
     # Per-pod scratch cache — RWO, disposable, one PVC per replica.
     - metadata:
         name: cache
+        annotations:
+          # Exclude the per-pod cache PVCs from the jellyfin-config k8up Schedule
+          # (skipWithoutAnnotation is false cluster-wide). Cache is disposable and
+          # RWO — it would also fail to mount into the backup pod while in use.
+          k8up.io/backup: "false"
       spec:
         accessModes:
           - ReadWriteOnce