mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-08-25 00:26:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Clarify tenant token guidance for encrypted volumes

Browse Source 
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
This commit is contained in:
Shubham Pampattiwar
2026-08-19 14:22:31 -07:00
parent 1e1c9e2648
commit 32fdc9591a
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/content/docs/main/data-movement-backup-pvc-configuration.md
+4 -3
View File
@@ -80,9 +80,10 @@ A sample of `backupPVC` config as part of the ConfigMap would look like:
```
**Note on encrypted volumes:** the copied secrets/configmaps are labeled `velero.io/backup-pvc-secret=<DataUpload UID>` and
deleted when the DataUpload completes (or on failure). If concurrent DataUploads from different namespaces need a secret with the
same name but different content in the Velero namespace, they conflict; for ceph-csi this can be avoided by configuring a
per-namespace `tenantTokenName` so each namespace uses a unique secret name.
deleted when the DataUpload completes (or on failure). If concurrent DataUploads from different namespaces need a secret with the same
name but different content in the Velero namespace, they conflict. For ceph-csi,
this can be avoided by configuring a unique
[`tenantTokenName` per tenant](https://github.com/ceph/ceph-csi/blob/devel/docs/design/proposals/encryption-with-vault-tokens.md#example-of-the-kms-configuration-file-for-vault-tokens).
**Note:**
- Users should make sure that the storage class specified in `backupPVC` config should exist in the cluster and can be used by the
site/content/docs/v1.18/data-movement-backup-pvc-configuration.md
+4 -3
View File
@@ -80,9 +80,10 @@ A sample of `backupPVC` config as part of the ConfigMap would look like:
```
**Note on encrypted volumes:** the copied secrets/configmaps are labeled `velero.io/backup-pvc-secret=<DataUpload UID>` and
deleted when the DataUpload completes (or on failure). If concurrent DataUploads from different namespaces need a secret with the
same name but different content in the Velero namespace, they conflict; for ceph-csi this can be avoided by configuring a
per-namespace `tenantTokenName` so each namespace uses a unique secret name.
deleted when the DataUpload completes (or on failure). If concurrent DataUploads from different namespaces need a secret with the same
name but different content in the Velero namespace, they conflict. For ceph-csi,
this can be avoided by configuring a unique
[`tenantTokenName` per tenant](https://github.com/ceph/ceph-csi/blob/devel/docs/design/proposals/encryption-with-vault-tokens.md#example-of-the-kms-configuration-file-for-vault-tokens).
**Note:**
- Users should make sure that the storage class specified in `backupPVC` config should exist in the cluster and can be used by the