mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-04-22 00:30:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

openshift needs namespace annotation for restic to schedule on all nodes (#1629)

Browse Source 
* openshift needs namespace annotation for restic to schedule on all nodes

Signed-off-by: Thomas Tischner <tti@bitsbeats.com>
This commit is contained in:
ThoTischner
2019-07-10 23:04:39 +02:00
committed by KubeKween
parent 8cde8fdbc7
commit d615cc6de0
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
site/docs/master/restic.md
View File

@@ -80,6 +80,19 @@ $ oc adm policy add-scc-to-user privileged -z velero -n velero
If restic is not running in a privileged mode, it will not be able to access pods volumes within the mounted hostpath directory because of the default enforced SELinux mode configured in the host system level. You can [create a custom SCC](https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html) in order to relax the security in your cluster so that restic pods are allowed to use the hostPath volume plug-in without granting them access to the `privileged` SCC.
By default a userland openshift namespace will not schedule pods on all nodes in the cluster.
To schedule on all nodes the namespace needs an annotation:
```
oc annotate namespace <velero namespace> openshift.io/node-selector=""
```
This should be done before velero installation.
Or the ds needs to be deleted and recreated:
```
oc get ds restic -o yaml -n <velero namespace> > ds.yaml
oc annotate namespace <velero namespace> openshift.io/node-selector=""
oc create -n <velero namespace> -f ds.yaml
```
**Enterprise PKS**
You need to enable the `Allow Privileged` option in your plan configuration so that restic is able to mount the hostpath.