From 89f0309e7b7b9af53da2a64bb5bee05a5af5b9ab Mon Sep 17 00:00:00 2001 From: Steve Kriss Date: Mon, 16 Dec 2019 09:35:55 -0700 Subject: [PATCH] add oc patch cmds for OpenShift+restic setup Signed-off-by: Steve Kriss Co-authored-by: Aleks --- site/docs/master/restic.md | 83 +++++++++++++++++++++++++------------- site/docs/v1.2.0/restic.md | 83 +++++++++++++++++++++++++------------- 2 files changed, 108 insertions(+), 58 deletions(-) diff --git a/site/docs/master/restic.md b/site/docs/master/restic.md index 7d4d08f97..b3c071b4d 100644 --- a/site/docs/master/restic.md +++ b/site/docs/master/restic.md @@ -54,38 +54,63 @@ The restic containers should be running in a `privileged` mode to be able to mou 1. Add the `velero` ServiceAccount to the `privileged` SCC: -``` -$ oc adm policy add-scc-to-user privileged -z velero -n velero -``` + ``` + $ oc adm policy add-scc-to-user privileged -z velero -n velero + ``` -2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode. -```diff -@@ -67,3 +67,5 @@ spec: - value: /credentials/cloud - - name: VELERO_SCRATCH_DIR - value: /scratch -+ securityContext: -+ privileged: true -``` +2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode: + + ```diff + @@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch + + securityContext: + + privileged: true + ``` + + or + + ```shell + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value": { "privileged": true}}]' + ``` 3. For OpenShift version < `4.1`, Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. -```diff -@@ -35,7 +35,7 @@ spec: - secretName: cloud-credentials - - name: host-pods - hostPath: -- path: /var/lib/kubelet/pods -+ path: /var/lib/origin/openshift.local.volumes/pods - - name: scratch - emptyDir: {} - containers: -@@ -67,3 +67,5 @@ spec: - value: /credentials/cloud - - name: VELERO_SCRATCH_DIR - value: /scratch -+ securityContext: -+ privileged: true -``` + + ```diff + @@ -35,7 +35,7 @@ spec: + secretName: cloud-credentials + - name: host-pods + hostPath: + - path: /var/lib/kubelet/pods + + path: /var/lib/origin/openshift.local.volumes/pods + - name: scratch + emptyDir: {} + containers: + @@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch + + securityContext: + + privileged: true + ``` + + or + + ```shell + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value": { "privileged": true}}]' + + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"replace","path":"/spec/template/spec/volumes/0/hostPath","value": { "path": "/var/lib/origin/openshift.local.volumes/pods"}}]' + ``` If restic is not running in a privileged mode, it will not be able to access pods volumes within the mounted hostpath directory because of the default enforced SELinux mode configured in the host system level. You can [create a custom SCC](https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html) in order to relax the security in your cluster so that restic pods are allowed to use the hostPath volume plug-in without granting them access to the `privileged` SCC. diff --git a/site/docs/v1.2.0/restic.md b/site/docs/v1.2.0/restic.md index 7d4d08f97..b3c071b4d 100644 --- a/site/docs/v1.2.0/restic.md +++ b/site/docs/v1.2.0/restic.md @@ -54,38 +54,63 @@ The restic containers should be running in a `privileged` mode to be able to mou 1. Add the `velero` ServiceAccount to the `privileged` SCC: -``` -$ oc adm policy add-scc-to-user privileged -z velero -n velero -``` + ``` + $ oc adm policy add-scc-to-user privileged -z velero -n velero + ``` -2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode. -```diff -@@ -67,3 +67,5 @@ spec: - value: /credentials/cloud - - name: VELERO_SCRATCH_DIR - value: /scratch -+ securityContext: -+ privileged: true -``` +2. For OpenShift version >= `4.1`, Modify the DaemonSet yaml to request a privileged mode: + + ```diff + @@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch + + securityContext: + + privileged: true + ``` + + or + + ```shell + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value": { "privileged": true}}]' + ``` 3. For OpenShift version < `4.1`, Modify the DaemonSet yaml to request a privileged mode and mount the correct hostpath to pods volumes. -```diff -@@ -35,7 +35,7 @@ spec: - secretName: cloud-credentials - - name: host-pods - hostPath: -- path: /var/lib/kubelet/pods -+ path: /var/lib/origin/openshift.local.volumes/pods - - name: scratch - emptyDir: {} - containers: -@@ -67,3 +67,5 @@ spec: - value: /credentials/cloud - - name: VELERO_SCRATCH_DIR - value: /scratch -+ securityContext: -+ privileged: true -``` + + ```diff + @@ -35,7 +35,7 @@ spec: + secretName: cloud-credentials + - name: host-pods + hostPath: + - path: /var/lib/kubelet/pods + + path: /var/lib/origin/openshift.local.volumes/pods + - name: scratch + emptyDir: {} + containers: + @@ -67,3 +67,5 @@ spec: + value: /credentials/cloud + - name: VELERO_SCRATCH_DIR + value: /scratch + + securityContext: + + privileged: true + ``` + + or + + ```shell + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value": { "privileged": true}}]' + + oc patch ds/restic \ + --namespace velero \ + --type json \ + -p '[{"op":"replace","path":"/spec/template/spec/volumes/0/hostPath","value": { "path": "/var/lib/origin/openshift.local.volumes/pods"}}]' + ``` If restic is not running in a privileged mode, it will not be able to access pods volumes within the mounted hostpath directory because of the default enforced SELinux mode configured in the host system level. You can [create a custom SCC](https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html) in order to relax the security in your cluster so that restic pods are allowed to use the hostPath volume plug-in without granting them access to the `privileged` SCC.