From 6391b84dc6718caad14a8b302412da2fd4fbdecd Mon Sep 17 00:00:00 2001 From: Shashank Ranjan <35235543+shashank855@users.noreply.github.com> Date: Fri, 6 Dec 2019 22:41:41 +0530 Subject: [PATCH] Updating restic document for OpenShift cluster having version 4.1 or later (#2106) * Updating restic document for OpenShift cluster having version 4.1 or later Signed-off-by: shashank855 * update documentation for velero-v1.2.0 Signed-off-by: shashank855 --- site/docs/master/restic.md | 12 +++++++++++- site/docs/v1.2.0/restic.md | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/site/docs/master/restic.md b/site/docs/master/restic.md index 1952b5208..6664a932e 100644 --- a/site/docs/master/restic.md +++ b/site/docs/master/restic.md @@ -58,8 +58,17 @@ The restic containers should be running in a `privileged` mode to be able to mou $ oc adm policy add-scc-to-user privileged -z velero -n velero ``` -2. Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. +2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode. +```diff +@@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch ++ securityContext: ++ privileged: true +``` +3. For OpenShift version < `4.1`, Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. ```diff @@ -35,7 +35,7 @@ spec: secretName: cloud-credentials @@ -78,6 +87,7 @@ $ oc adm policy add-scc-to-user privileged -z velero -n velero + privileged: true ``` + If restic is not running in a privileged mode, it will not be able to access pods volumes within the mounted hostpath directory because of the default enforced SELinux mode configured in the host system level. You can [create a custom SCC](https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html) in order to relax the security in your cluster so that restic pods are allowed to use the hostPath volume plug-in without granting them access to the `privileged` SCC. By default a userland openshift namespace will not schedule pods on all nodes in the cluster. diff --git a/site/docs/v1.2.0/restic.md b/site/docs/v1.2.0/restic.md index 1952b5208..6664a932e 100644 --- a/site/docs/v1.2.0/restic.md +++ b/site/docs/v1.2.0/restic.md @@ -58,8 +58,17 @@ The restic containers should be running in a `privileged` mode to be able to mou $ oc adm policy add-scc-to-user privileged -z velero -n velero ``` -2. Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. +2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode. +```diff +@@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch ++ securityContext: ++ privileged: true +``` +3. For OpenShift version < `4.1`, Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. ```diff @@ -35,7 +35,7 @@ spec: secretName: cloud-credentials @@ -78,6 +87,7 @@ $ oc adm policy add-scc-to-user privileged -z velero -n velero + privileged: true ``` + If restic is not running in a privileged mode, it will not be able to access pods volumes within the mounted hostpath directory because of the default enforced SELinux mode configured in the host system level. You can [create a custom SCC](https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html) in order to relax the security in your cluster so that restic pods are allowed to use the hostPath volume plug-in without granting them access to the `privileged` SCC. By default a userland openshift namespace will not schedule pods on all nodes in the cluster.