|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.adoc |
| 4 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-azure.adoc |
| 5 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-gcp.adoc |
| 6 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-mcg.adoc |
| 7 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-ocs.adoc |
| 8 | +// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-kubevirt.adoc |
| 9 | + |
| 10 | + |
| 11 | +:_mod-docs-content-type: PROCEDURE |
| 12 | +[id="oadp-configuring-node-agent-non-root_{context}"] |
| 13 | += Configuring the node agent as a non-root and non-privileged user |
| 14 | + |
| 15 | +[role="_abstract"] |
| 16 | +To enhance the node agent security, you can configure the {oadp-short} Operator node agent daemonset to run as a non-root and non-privileged user by using the `spec.configuration.velero.disableFsBackup` setting in the `DataProtectionApplication` (DPA) custom resource (CR). |
| 17 | + |
| 18 | +By setting the `spec.configuration.velero.disableFsBackup` setting to `true`, the node agent security context sets the root file system to read-only and sets the `privileged` flag to `false`. |
| 19 | + |
| 20 | +[NOTE] |
| 21 | +==== |
| 22 | +Setting `spec.configuration.velero.disableFsBackup` to `true` enhances the node agent security by removing the need for privileged containers and enforcing a read-only root file system. |
| 23 | +
|
| 24 | +However, it also disables File System Backup (FSB) with Kopia. If your workloads rely on FSB for backing up volumes that do not support native snapshots, then you should evaluate whether the `disableFsBackup` configuration fits your use case. |
| 25 | +==== |
| 26 | + |
| 27 | +.Prerequisites |
| 28 | + |
| 29 | +* You have installed the {oadp-short} Operator. |
| 30 | +
|
| 31 | +.Procedure |
| 32 | + |
| 33 | +* Configure the `disableFsBackup` field in the DPA as shown in the following example: |
| 34 | ++ |
| 35 | +[source,yaml] |
| 36 | +---- |
| 37 | +apiVersion: oadp.openshift.io/v1alpha1 |
| 38 | +kind: DataProtectionApplication |
| 39 | +metadata: |
| 40 | + name: ts-dpa |
| 41 | + namespace: openshift-adp |
| 42 | +spec: |
| 43 | + backupLocations: |
| 44 | + - velero: |
| 45 | + credential: |
| 46 | + key: cloud |
| 47 | + name: cloud-credentials |
| 48 | + default: true |
| 49 | + objectStorage: |
| 50 | + bucket: <bucket_name> |
| 51 | + prefix: velero |
| 52 | + provider: gcp |
| 53 | + configuration: |
| 54 | + nodeAgent: # <1> |
| 55 | + enable: true |
| 56 | + uploaderType: kopia |
| 57 | + velero: |
| 58 | + defaultPlugins: |
| 59 | + - csi |
| 60 | + - gcp |
| 61 | + - openshift |
| 62 | + disableFsBackup: true # <2> |
| 63 | +---- |
| 64 | +<1> Enable the node agent in the DPA. |
| 65 | +<2> Set the `disableFsBackup` field to `true`. |
| 66 | +
|
| 67 | +
|
| 68 | +.Verification |
| 69 | + |
| 70 | +. Verify that the node agent security context is set to run as non-root and the root file system is `readOnly` by running the following command: |
| 71 | ++ |
| 72 | +[source,terminal] |
| 73 | +---- |
| 74 | +$ oc get daemonset node-agent -o yaml |
| 75 | +---- |
| 76 | ++ |
| 77 | +The example output is as following: |
| 78 | ++ |
| 79 | +[source,yaml] |
| 80 | +---- |
| 81 | +apiVersion: apps/v1 |
| 82 | +kind: DaemonSet |
| 83 | +metadata: |
| 84 | + ... |
| 85 | + name: node-agent |
| 86 | + namespace: openshift-adp |
| 87 | + ... |
| 88 | +spec: |
| 89 | + ... |
| 90 | + template: |
| 91 | + metadata: |
| 92 | + ... |
| 93 | + spec: |
| 94 | + containers: |
| 95 | + ... |
| 96 | + securityContext: |
| 97 | + allowPrivilegeEscalation: false # <1> |
| 98 | + capabilities: |
| 99 | + drop: |
| 100 | + - ALL |
| 101 | + privileged: false # <2> |
| 102 | + readOnlyRootFilesystem: true # <3> |
| 103 | + ... |
| 104 | + nodeSelector: |
| 105 | + kubernetes.io/os: linux |
| 106 | + os: |
| 107 | + name: linux |
| 108 | + restartPolicy: Always |
| 109 | + schedulerName: default-scheduler |
| 110 | + securityContext: |
| 111 | + runAsNonRoot: true # <4> |
| 112 | + seccompProfile: |
| 113 | + type: RuntimeDefault |
| 114 | + serviceAccount: velero |
| 115 | + serviceAccountName: velero |
| 116 | + .... |
| 117 | +---- |
| 118 | +<1> The `allowPrivilegeEscalation` field is false. |
| 119 | +<2> The `privileged` field is false. |
| 120 | +<3> The root file system is read-only. |
| 121 | +<4> The node agent is run as a non-root user. |
0 commit comments