Updated rbac based on the vmfr project #2040
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| creationTimestamp: null | ||
| labels: | ||
| app.kubernetes.io/managed-by: kustomize | ||
| app.kubernetes.io/name: oadp-vm-file-restore | ||
| name: controller-manager |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| creationTimestamp: null | ||
| labels: | ||
| app.kubernetes.io/managed-by: kustomize | ||
| app.kubernetes.io/name: oadp-vm-file-restore | ||
| name: leader-election-role | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - configmaps | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - apiGroups: | ||
| - coordination.k8s.io | ||
| resources: | ||
| - leases | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - create | ||
| - patch |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: RoleBinding | ||
| metadata: | ||
| creationTimestamp: null | ||
| labels: | ||
| app.kubernetes.io/managed-by: kustomize | ||
| app.kubernetes.io/name: oadp-vm-file-restore | ||
| name: leader-election-rolebinding | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: Role | ||
| name: leader-election-role | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: controller-manager | ||
| namespace: system |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: manager-role | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - namespaces | ||
| - pods | ||
| - secrets | ||
| - serviceaccounts | ||
| - services | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - persistentvolumeclaims | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - apps | ||
| resources: | ||
| - deployments | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - oadp.openshift.io | ||
| resources: | ||
| - virtualmachinebackupsdiscoveries | ||
| - virtualmachinefilerestores | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - oadp.openshift.io | ||
| resources: | ||
| - virtualmachinebackupsdiscoveries/finalizers | ||
| - virtualmachinefilerestores/finalizers | ||
| verbs: | ||
| - update | ||
| - apiGroups: | ||
| - oadp.openshift.io | ||
| resources: | ||
| - virtualmachinebackupsdiscoveries/status | ||
| - virtualmachinefilerestores/status | ||
| verbs: | ||
| - get | ||
| - patch | ||
| - update | ||
| - apiGroups: | ||
| - rbac.authorization.k8s.io | ||
| resources: | ||
| - rolebindings | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - route.openshift.io | ||
| resources: | ||
| - routes | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - security.openshift.io | ||
| resourceNames: | ||
| - privileged | ||
| resources: | ||
| - securitycontextconstraints | ||
| verbs: | ||
| - use | ||
| - apiGroups: | ||
| - velero.io | ||
| resources: | ||
| - backups | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - velero.io | ||
| resources: | ||
| - datadownloads | ||
| verbs: | ||
| - get | ||
| - list | ||
| - patch | ||
| - watch | ||
| - apiGroups: | ||
| - velero.io | ||
| resources: | ||
| - downloadrequests | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - velero.io | ||
| resources: | ||
| - restores | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: metrics-reader | ||
| rules: | ||
| - nonResourceURLs: | ||
| - /metrics | ||
| verbs: | ||
| - get |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -172,6 +172,35 @@ metadata: | |
| } | ||
| } | ||
| }, | ||
| { | ||
| "apiVersion": "oadp.openshift.io/v1alpha1", | ||
| "kind": "VirtualMachineBackupsDiscovery", | ||
| "metadata": { | ||
| "labels": { | ||
| "app.kubernetes.io/managed-by": "kustomize", | ||
| "app.kubernetes.io/name": "oadp-vm-file-restore" | ||
| }, | ||
| "name": "virtualmachinebackupsdiscovery-sample" | ||
| }, | ||
| "spec": { | ||
| "endTime": "2024-12-31T23:59:59Z", | ||
| "startTime": "2024-01-01", | ||
| "virtualMachineName": "test-vm", | ||
| "virtualMachineNamespace": "test-namespace" | ||
| } | ||
| }, | ||
| { | ||
| "apiVersion": "oadp.openshift.io/v1alpha1", | ||
| "kind": "VirtualMachineFileRestore", | ||
| "metadata": { | ||
| "labels": { | ||
| "app.kubernetes.io/managed-by": "kustomize", | ||
| "app.kubernetes.io/name": "oadp-vm-file-restore" | ||
| }, | ||
| "name": "virtualmachinefilerestore-sample" | ||
| }, | ||
| "spec": null | ||
| }, | ||
| { | ||
| "apiVersion": "velero.io/v1", | ||
| "kind": "Backup", | ||
|
|
@@ -845,7 +874,6 @@ spec: | |
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - namespaces | ||
| - pods | ||
| - secrets | ||
|
|
@@ -879,18 +907,6 @@ spec: | |
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - oadp.openshift.io | ||
| resources: | ||
|
|
@@ -944,6 +960,14 @@ spec: | |
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - security.openshift.io | ||
| resourceNames: | ||
| - privileged | ||
| resources: | ||
| - securitycontextconstraints | ||
| verbs: | ||
| - use | ||
|
Comment on lines
+963
to
+970
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: # First, let's understand the repository structure
cd /tmp && find . -type f \( -name 'README*' -o -name '*.md' \) -maxdepth 3 2>/dev/null | head -10
git ls-files | grep -E '(README|readme)' | head -5Repository: openshift/oadp-operator Length of output: 190 🏁 Script executed: git ls-files | head -30Repository: openshift/oadp-operator Length of output: 190 🏁 Script executed: # Check the file in question
cat -n bundle/manifests/oadp-operator.clusterserviceversion.yaml | sed -n '960,980p'Repository: openshift/oadp-operator Length of output: 190 🏁 Script executed: # Search for context about VM File Restore and privileged SCC
rg -i "vm file restore|privileged" --type yaml --type md -B 2 -A 2Repository: openshift/oadp-operator Length of output: 190 🏁 Script executed: # Look for any documentation or comments explaining SCC requirements
rg -i "securitycontextconstraint|scc" --type yaml -B 3 -A 3 | head -100Repository: openshift/oadp-operator Length of output: 190 🏁 Script executed: # Check if there's any documentation folder
git ls-files | grep -i -E '(doc|readme|install|quickstart)'Repository: openshift/oadp-operator Length of output: 190 🌐 Web query:
💡 Result: Summary — key security requirements and considerations for OADP (OpenShift API for Data Protection) VM file-level restore:
Sources:
If you want, I can extract exact RBAC rules, required SCC annotations, sample Secrets (BSL) and example pre-freeze hook scripts with SELinux labels. 🌐 Web query:
💡 Result: Short answer — grant the OADP operator’s service account permission to "use" the privileged SecurityContextConstraints in the operator CSV (install.spec.clusterPermissions) and document why in the CSV description. How-to (minimal):
References:
Sources: Citations:
🌐 Web query:
💡 Result: Short answer — what to put in the OADP CSV "spec.description" and related CSV fields for SCCs plus where to find VM backup/restore docs:
Key references:
If you want, I can:
Ensure the CSV description documents why the privileged SCC grant is required. The privileged SCC permission is necessary for OADP's VM File Restore controller to handle file access and security context restoration during VM backup and restore operations. Per OpenShift Operator guidelines, the CSV spec.description must explicitly justify this escalated privilege grant and explain the specific use cases (Velero/kubevirt plugin VM operations, CSI snapshot handling, volume attachment). This documentation is required by OLM when an operator requests privileged SCC access. |
||
| - apiGroups: | ||
| - velero.io | ||
| resources: | ||
|
|
@@ -983,6 +1007,18 @@ spec: | |
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - authentication.k8s.io | ||
| resources: | ||
| - tokenreviews | ||
| verbs: | ||
| - create | ||
| - apiGroups: | ||
| - authorization.k8s.io | ||
| resources: | ||
| - subjectaccessreviews | ||
| verbs: | ||
| - create | ||
| serviceAccountName: oadp-vm-file-restore-controller-manager | ||
| - rules: | ||
| - apiGroups: | ||
|
|
@@ -1348,6 +1384,39 @@ spec: | |
| - emptyDir: {} | ||
| name: tmp-dir | ||
| permissions: | ||
| - rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - configmaps | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - apiGroups: | ||
| - coordination.k8s.io | ||
| resources: | ||
| - leases | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - create | ||
| - patch | ||
| serviceAccountName: oadp-vm-file-restore-controller-manager | ||
| - rules: | ||
| - apiGroups: | ||
| - "" | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/oadp-operator
Length of output: 190
🌐 Web query:
OADP operator Velero controller RBAC permissions requirements secrets services routes💡 Result:
Summary — OADP (Velero via the OADP operator) RBAC, Secrets, Services and Routes (concise)
Namespace / ServiceAccount
RBAC (recommended permissions)
Secrets (names and behavior)
Services & Routes
Practical notes / links
Sources
[1] Velero docs — RBAC guidance.
[2] Red Hat / OpenShift docs — OADP install, required Secrets and behavior (openshift-adp namespace, cloud-credentials, velero-repo-credentials).
[3] Red Hat / OpenShift backup & restore docs (version matrix, Velero access).
[4] openshift-velero-plugin (GitHub) — plugin behavior for OpenShift (registry, routes).
[5] Red Hat KB — route restore behavior with OADP / openshift-velero-plugin.
Would you like: (A) example ClusterRole/ClusterRoleBinding and Role/RoleBinding YAML tuned for OADP, or (B) step-by-step commands to create the required Secrets and bind RBAC in your cluster?
🌐 Web query:
Velero OADP ClusterRole least privilege verbs secrets services routes example💡 Result:
Below is a minimal ClusterRole example for Velero / OADP that follows least-privilege principles for secrets, services, and OpenShift routes. Key ideas: avoid broad verbs on secrets (don’t grant get/list/watch unless absolutely required), grant only the verbs Velero needs for backup/restore operations on services and routes, and keep other rules narrow. Adjust namespaces, serviceAccount, and any additional Velero resources you need.
ClusterRole (example)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: velero-oadp-minimal
rules:
core resources Velero commonly needs (narrow verbs)
resources:
verbs: ["get","list","watch"]
resources:
verbs: ["get","list","watch"]
Secrets: avoid read verbs unless required — here only "create" and "patch" for credential injection (no get/list/watch)
resources:
verbs: ["create","patch","update"]
ConfigMaps used by Velero (restricted verbs)
resources:
verbs: ["get","list","watch","create","update","patch"]
OpenShift routes (route.openshift.io) — only read/list/watch needed for discovery; add update/create only if Velero plugin modifies routes
resources:
verbs: ["get","list","watch"]
CRDs Velero operates on (narrowed to specific names where possible)
resources:
verbs: ["get","list","create","update","patch","delete","watch"]
ClusterRoleBinding (bind service account)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: velero-oadp-minimal-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: velero-oadp-minimal
subjects:
name: velero
namespace: openshift-adp
Notes / recommendations
Sources
References
[1] Velero docs: Run Velero more securely with restrictive RBAC settings.
[2] OKD OADP docs: Configuring OADP (secrets, routes).
[3] Kyverno policy: restrict-secret-role-verbs (example).
Major: Overly broad permissions on secrets, services, and routes.
While Velero/OADP does require access to these resources for backup/restore operations, the permissions should follow least-privilege principles. Industry best practices and the Velero security documentation recommend:
create,patch,update(avoidget,list,watchunless retrieving specific backup location credentials, which should be in a dedicated Secret with namespace-scoped Role)get,list,watch(read-only)get,list,watch(read-only unless the openshift-velero-plugin explicitly modifies routes)Full CRUD on these resources is unnecessary and violates least-privilege. Verify the manifest grants only the minimum verbs required and update accordingly.