Skip to content

Commit 4e22229

Browse files
weshayutinweshayutin
authored
add spec constraints and enforcements to README (#303)
1 parent a9be432 commit 4e22229

File tree

1 file changed

+130
-0
lines changed

1 file changed

+130
-0
lines changed

‎README.md‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,136 @@ To use NAC functionality:
7272

7373
After NonAdminRestore completes, check if the application was successful restored by accessing its route and seeing its items in application UI.
7474

75+
## Notes on Non Admin Permissions and Enforcements
76+
### Cluster Administrator Enforceable Spec Fields
77+
There are several types of cluster scoped objects that non-admin users should not have access to backup or restore. OADP self-service automatically excludes the following list of cluster scoped resources from being backed up or restored.
78+
79+
* SCCs
80+
* ClusterRoles
81+
* ClusterRoleBindings
82+
* CRDs
83+
* PriorityClasses
84+
* virtualmachineclusterinstancetypes
85+
* virtualmachineclusterpreferences
86+
87+
Cluster administrators may also enforce company or compliance policy by utilizing templated NABSL's, NAB's and NAR's that require fields values to be set and conform to the administrator defined policy. Admin Enforceable fields are fields that the cluster administrator can enforce non cluster admin users to use. Restricted fields are automatically managed by OADP and cannot be modified by either administrators or users.
88+
89+
#### NABSL
90+
The following NABSL fields are currently supported for template enforcement:
91+
92+
| **NABSL Field** | **Admin Enforceable** | **Restricted** | **special case** |
93+
|----------------------------|-----------------|----------------|-----------------|
94+
| `backupSyncPeriod` | | | ⚠️ Must be set lower than the DPA.backupSyncPeriod and lower than the garbage collection period |
95+
| `provider` | | | |
96+
| `objectStorage` | ✅ Yes | | |
97+
| `credential` | ✅ Yes | | |
98+
| `config` | ✅ Yes | | |
99+
| `accessMode` | ✅ Yes | | |
100+
| `validationFrequency` | ✅ Yes | | |
101+
| `default` | | | ⚠️ Must be false or empty |
102+
103+
For example if the cluster administrator wanted to mandate that all NABSL's used a particular aws s3 bucket.
104+
105+
```
106+
spec:
107+
config:
108+
checksumAlgorithm: ""
109+
profile: default
110+
region: us-west-2
111+
credential:
112+
key: cloud
113+
name: cloud-credentials
114+
objectStorage:
115+
bucket: my-company-bucket <---
116+
prefix: velero
117+
provider: aws
118+
```
119+
The DPA spec must be set in the following way:
120+
121+
```
122+
nonAdmin:
123+
enable: true
124+
enforceBSLSpec:
125+
config: <--- entire config must match expected NaBSL config
126+
checksumAlgorithm: ""
127+
profile: default
128+
region: us-west-2
129+
objectStorage: <--- all of the objectStorage options must match expected NaBSL options
130+
bucket: my-company-bucket
131+
prefix: velero
132+
provider: aws
133+
```
134+
135+
#### Restricted NonAdminBackups
136+
137+
In the same sense as the NABSL, cluster administrators can also restrict the NonAdminBackup spec fields to ensure the backup request conforms to the administrator defined policy. Most of the backup spec fields can be restricted by the cluster administrator, below is a table of reference for the current implementation.
138+
139+
140+
| **Backup Spec Field** | **Admin Enforceable** | **Restricted** | **special case** |
141+
|--------------------------------------------|--------------|--------------------------|-----------------|
142+
| `csiSnapshotTimeout` | ✅ Yes | | |
143+
| `itemOperationTimeout` | ✅ Yes | | |
144+
| `resourcePolicy` | ✅ Yes | | ⚠️ Non-admin users can specify the config-map that admins created in OADP Operator NS(Admins enforcing this value be a good alternative here), they cannot specify their own configmap as its lifecycle handling is not currently managed by NAC controller |
145+
| `includedNamespaces` | ❌ No | ✅ Yes | ⚠️ Admins cannot enforce this because it does not make sense for a cluster wide non-admin backup setting, we have validations in place such that only the NS admins NS in included in the NAB spec. |
146+
| `excludedNamespaces` | ✅ Yes | ✅ Yes | ⚠️ This spec is restricted for non-admin users and hence not enforceable by admins |
147+
| `includedResources` | ✅ Yes | | |
148+
| `excludedResources` | ✅ Yes | | |
149+
| `orderedResources` | ✅ Yes | | |
150+
| `includeClusterResources` | ✅ Yes | | ⚠️ Non-admin users can only set this spec to false if they want, all other values are restricted, similar rule for admin enforcement regarding this spec value. |
151+
| `excludedClusterScopedResources` | ✅ Yes | | |
152+
| `includedClusterScopedResources` | ✅ Yes | | ⚠️ This spec is restricted and non-enforceable, only empty list is acceptable |
153+
| `excludedNamespaceScopedResources` | ✅ Yes | | |
154+
| `includedNamespaceScopedResources` | ✅ Yes | | |
155+
| `labelSelector` | ✅ Yes | | |
156+
| `orLabelSelectors` | ✅ Yes | | |
157+
| `snapshotVolumes` | ✅ Yes | | |
158+
| `storageLocation` | | | ⚠️ should point to an existing NABSL |
159+
| `volumeSnapshotLocations` | | | ⚠️ Not supported for non-admin users, default will be used if needed |
160+
| `ttl` | ✅ Yes | | |
161+
| `defaultVolumesToFsBackup` | ✅ Yes | | |
162+
| `snapshotMoveData` | ✅ Yes | | |
163+
| `datamover` | ✅ Yes | | |
164+
| `uploaderConfig.parallelFilesUpload` | ✅ Yes | | |
165+
| `hooks` | | | |
166+
167+
An example enforcement set in the DPA spec to enforce the
168+
* ttl to be set to "158h0m0s"
169+
* snapshotMoveData to be set to true
170+
171+
```
172+
nonAdmin:
173+
enable: true
174+
enforcedBackupSpec.ttl: "158h0m0s"
175+
enforcedBackupSpec.snapshotMoveData: true
176+
```
177+
178+
#### Restricted NonAdminRestore NAR
179+
180+
NonAdminRestores spec fields can also be restricted by the cluster administrator. The following NAR spec fields are currently supported for template enforcement:
181+
182+
| **Field** | **Admin Enforceable** | **Restricted** | **special case** |
183+
|-------------------------------|--------------|--------------------|-----------------|
184+
| `backupName` | ❌ No | | |
185+
| `scheduleName` | ❌ No | ✅ Yes | ⚠️ not supported for non-admin users, we don't have non-admin backup schedule API as of now. |
186+
| `itemOperationTimeout` | ✅ Yes | | |
187+
| `uploaderConfig` | ✅ Yes | | |
188+
| `includedNamespaces` | ❌ No | ✅ Yes | ⚠️ restricted for non-admin users and hence non-enforceable by admins |
189+
| `excludedNamespaces` | ❌ No | ✅ Yes | ⚠️ restricted for non-admin users and hence non-enforceable by admins |
190+
| `includedResources` | ✅ Yes | | |
191+
| `excludedResources` | ✅ Yes | | |
192+
| `restoreStatus` | ✅ Yes | | |
193+
| `includeClusterResources` | ✅ Yes | | |
194+
| `labelSelector` | ✅ Yes | | |
195+
| `orLabelSelectors` | ✅ Yes | | |
196+
| `namespaceMapping` | ❌ No | ✅ Yes | ⚠️ restricted for non-admin users and hence non-enforceable by admins |
197+
| `restorePVs` | ✅ Yes | | |
198+
| `preserveNodePorts` | ✅ Yes | | |
199+
| `existingResourcePolicy` | | | |
200+
| `hooks` | | | ⚠️ special case |
201+
| `resourceModifers` | | | ⚠️ Non-admin users can specify the config-map that admins created in OADP Operator NS(Admins enforcing this value be a good alternative here), they cannot specify their own configmap as its lifecycle handling is not currently managed by NAC controller |
202+
203+
204+
75205
## Contributing
76206
77207
Please check our [contributing documentation](docs/CONTRIBUTING.md) to propose changes to the repository.

0 commit comments

Comments
 (0)