Fix truncated stdin backups by closing pipe before signaling done

Application-aware backups (stdin backups from pod exec) were being
truncated because the pipe writer was closed after signaling done
to the backup trigger. This created a race condition:

1. StreamWithContext finishes writing data to the pipe
2. done <- true signals the backup trigger to call cmd.Wait()
3. defer stdoutWriter.Close() hasn't executed yet
4. restic finishes before all data flows through the pipe

Fix: close the pipe writer before signaling done, ensuring restic's
stdin receives all data and EOF before the backup command exits.

Also improved error handling: use CloseWithError on stream failure
instead of os.Exit(1), propagating the error through the pipe to
the reader.

Fixes #1109

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Aarno Aukia <aarno.aukia@vshn.ch>

Author: arska

restic/kubernetes/pod_exec.go

@@ -62,22 +62,28 @@ func PodExec(pod BackupPod, log logr.Logger) (*ExecData, error) {
 	var stdoutReader, stdoutWriter = io.Pipe()
 	done := make(chan bool, 1)
 	go func() {
-		err = exec.StreamWithContext(context.Background(), remotecommand.StreamOptions{
+		streamErr := exec.StreamWithContext(context.Background(), remotecommand.StreamOptions{
 			Stdin:  nil,
 			Stdout: stdoutWriter,
 			Stderr: logging.NewErrorWriter(log.WithName(pod.PodName)),
 			Tty:    false,
 		})
 
-		defer stdoutWriter.Close()
-		done <- true
-
-		if err != nil {
-			execLogger.Error(err, "streaming data failed", "namespace", pod.Namespace, "pod", pod.PodName)
-			// we just completely hard fail the whole backup pod
+		// Close the writer before signaling done so that the pipe reader
+		// (restic's stdin) receives all data and an EOF before the backup
+		// command is waited on. Previously, done was signaled before close,
+		// causing a race where restic could finish before all data was
+		// flushed through the pipe, resulting in truncated backups.
+		if streamErr != nil {
+			execLogger.Error(streamErr, "streaming data failed", "namespace", pod.Namespace, "pod", pod.PodName)
+			stdoutWriter.CloseWithError(streamErr)
+			done <- true
+			// Hard fail the backup pod so the Kubernetes Job is marked as failed
 			os.Exit(1)
 			return
 		}
+		stdoutWriter.Close()
+		done <- true
 	}()
 
 	data := &ExecData{