Skip to content

Commit b4eeda4

Browse files
gaurav-nelsongaurav-nelson
authored
Merge pull request #53359 from RichardHoch/rsync_root_non_root
Update instructions for running Rsync as root for PSA-enabled clusters
2 parents a457443 + 6efb18d commit b4eeda4

File tree

4 files changed

+124
-0
lines changed

4 files changed

+124
-0
lines changed

‎migration_toolkit_for_containers/installing-mtc-restricted.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,33 @@ include::modules/migration-configuring-proxies.adoc[leveloffset=+2]
3737

3838
For more information, see xref:../networking/enable-cluster-wide-proxy.adoc#nw-proxy-configure-object_config-cluster-wide-proxy[Configuring the cluster-wide proxy].
3939

40+
[id="migration-rsync-root-non-root_{context}"]
41+
== Running Rsync as either root or non-root
42+
43+
[IMPORTANT]
44+
====
45+
This section applies only when you are working with the OpenShift API, not the web console.
46+
====
47+
48+
OpenShift environments have the `PodSecurityAdmission` controller enabled by default. This controller requires cluster administrators to enforce Pod Security Standards by means of namespace labels. All workloads in the cluster are expected to run one of the following Pod Security Standard levels: `Privileged`, `Baseline` or `Restricted`. Every cluster has its own default policy set.
49+
50+
To guarantee successful data transfer in all environments, {mtc-full} ({mtc-short}) 1.7.5 introduced changes in Rsync pods, including running Rsync pods as non-root user by default. This ensures that data transfer is possible even for workloads that do not necessarily require higher privileges. This change was made because it is best to run workloads with the lowest level of privileges possible.
51+
52+
==== Manually overriding default non-root operation for data trannsfer
53+
54+
Although running Rsync pods as non-root user works in most cases, data transfer might fail when when you run workloads as root user on the source side. {mtc-short} provides two ways to manually override default non-root operation for data transfer:
55+
56+
* Configure all migrations to run an Rsync pod as root on the destination cluster for all migrations.
57+
* Run an Rsync pod as root on the destination cluster per migration.
58+
59+
In both cases, you must set the following labels on the source side of any namespaces that are running workloads with higher privileges prior to migration: `enforce`, `audit`, and `warn.`
60+
61+
To learn more about Pod Security Admission and setting values for labels, see xref:../authentication/understanding-and-managing-pod-security-admission.adoc#security-context-constraints-psa-opting_understanding-and-managing-pod-security-admission[Controlling pod security admission synchronization].
62+
63+
include::modules/migration-rsync-migration-controller-root-non-root.adoc[leveloffset=+1]
64+
65+
include::modules/migration-rsync-mig-migration-root-non-root.adoc[leveloffset=+1]
66+
4067
[id="configuring-replication-repository_{context}"]
4168
== Configuring a replication repository
4269

‎migration_toolkit_for_containers/installing-mtc.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,33 @@ include::modules/migration-configuring-proxies.adoc[leveloffset=+2]
2828

2929
For more information, see xref:../networking/enable-cluster-wide-proxy.adoc#nw-proxy-configure-object_config-cluster-wide-proxy[Configuring the cluster-wide proxy].
3030

31+
[id="migration-rsync-root-non-root_{context}"]
32+
=== Running Rsync as either root or non-root
33+
34+
[IMPORTANT]
35+
====
36+
This section applies only when you are working with the OpenShift API, not the web console.
37+
====
38+
39+
OpenShift environments have the `PodSecurityAdmission` controller enabled by default. This controller requires cluster administrators to enforce Pod Security Standards by means of namespace labels. All workloads in the cluster are expected to run one of the following Pod Security Standard levels: `Privileged`, `Baseline` or `Restricted`. Every cluster has its own default policy set.
40+
41+
To guarantee successful data transfer in all environments, {mtc-full} ({mtc-short}) 1.7.5 introduced changes in Rsync pods, including running Rsync pods as non-root user by default. This ensures that data transfer is possible even for workloads that do not necessarily require higher privileges. This change was made because it is best to run workloads with the lowest level of privileges possible.
42+
43+
==== Manually overriding default non-root operation for data trannsfer
44+
45+
Although running Rsync pods as non-root user works in most cases, data transfer might fail when when you run workloads as root user on the source side. {mtc-short} provides two ways to manually override default non-root operation for data transfer:
46+
47+
* Configure all migrations to run an Rsync pod as root on the destination cluster for all migrations.
48+
* Run an Rsync pod as root on the destination cluster per migration.
49+
50+
In both cases, you must set the following labels on the source side of any namespaces that are running workloads with higher privileges prior to migration: `enforce`, `audit`, and `warn.`
51+
52+
To learn more about Pod Security Admission and setting values for labels, see xref:../authentication/understanding-and-managing-pod-security-admission.adoc#security-context-constraints-psa-opting_understanding-and-managing-pod-security-admission[Controlling pod security admission synchronization].
53+
54+
include::modules/migration-rsync-migration-controller-root-non-root.adoc[leveloffset=+2]
55+
56+
include::modules/migration-rsync-mig-migration-root-non-root.adoc[leveloffset=+2]
57+
3158
[id="configuring-replication-repository_{context}"]
3259
== Configuring a replication repository
3360

‎modules/migration-rsync-mig-migration-root-non-root.adoc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * migration_toolkit_for_containers/installing-mtc.adoc
4+
// * migration_toolkit_for_containers/installing-mtc-restricted.adoc
5+
[id="migration-rsync-mig-migration-root-non-root_{context}"]
6+
== Configuring the MigMigration CR as root or non-root per migration
7+
8+
On the destination cluster, you can configure the `MigMigration` CR to run Rsync as root or non-root, with the following non-root options:
9+
10+
* As a specific user ID (UID)
11+
* As a specific group ID (GID)
12+
13+
.Procedure
14+
15+
. To run Rsync as root, configure the `MigMigration` CR according to this example:
16+
+
17+
[source,yaml]
18+
----
19+
apiVersion: migration.openshift.io/v1alpha1
20+
kind: MigMigration
21+
metadata:
22+
name: migration-controller
23+
namespace: openshift-migration
24+
spec:
25+
[...]
26+
runAsRoot: true
27+
----
28+
29+
. To run Rsync as a specific User ID (UID) or as a specific Group ID (GID), configure the `MigMigration` CR according to this example:
30+
+
31+
[source,yaml]
32+
----
33+
apiVersion: migration.openshift.io/v1alpha1
34+
kind: MigMigration
35+
metadata:
36+
name: migration-controller
37+
namespace: openshift-migration
38+
spec:
39+
[...]
40+
runAsUser: 10010001
41+
runAsGroup: 3
42+
----

‎modules/migration-rsync-migration-controller-root-non-root.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * migration_toolkit_for_containers/installing-mtc.adoc
4+
// * migration_toolkit_for_containers/installing-mtc-restricted.adoc
5+
[id="migration-rsync-migration-controller-root-non-root_{context}"]
6+
== Configuring the MigrationController CR as root or non-root for all migrations
7+
8+
By default, Rsync runs as non-root.
9+
10+
On the destination cluster, you can configure the `MigrationController` CR to run Rsync as root.
11+
12+
.Procedure
13+
14+
* Configure the `MigrationController` CR as follows:
15+
+
16+
[source,yaml]
17+
----
18+
apiVersion: migration.openshift.io/v1alpha1
19+
kind: MigrationController
20+
metadata:
21+
name: migration-controller
22+
namespace: openshift-migration
23+
spec:
24+
[...]
25+
migration_rsync_privileged: true
26+
----
27+
+
28+
This configuration will apply to all future migrations.

0 commit comments

Comments
 (0)