Loading post…
Red HatMichal Pryc, Shubham Dilip PampattiwarProblem & solution
Self-service backup for VMs and containers on OpenShift: No cluster-admin required
Summary
In multi-tenant Red Hat OpenShift clusters, Velero Backup and Restore resources live in the OADP installation namespace, leaving non-admin application teams dependent on platform staff. OADP self-service addresses this with namespace-scoped NonAdminBackup and NonAdminRestore resources that proxy Velero resources, while a controller validates requests against DataProtectionApplication policies and synchronizes phase, progress, and queue status back to the tenant namespace. Administrators can enforce retention, snapshot and file-system backup settings, resource inclusion or exclusion, and approval for tenant-provided backup storage; cluster-scoped resources such as SCCs, ClusterRoles, CRDs, and KubeVirt cluster preferences are automatically excluded. OADP 1.6 supports the same workflow for containers, stateful applications, and OpenShift Virtualization VMs, but self-service has no native schedules, cross-namespace restores, or short-lived credentials for tenant-provided storage locations.
Context
In shared OpenShift clusters, non-admin users cannot create Velero Backup or Restore resources in the OADP installation namespace. This forces application teams to request backups from platform staff or requires granting excessive privileges, creating an operational bottleneck and a security trade-off.
Approach / What changed
Enable OADP self-service in the DataProtectionApplication and grant namespace-scoped users permissions to create NonAdminBackup and NonAdminRestore resources. The self-service controller validates tenant requests against administrator-enforced policies, creates corresponding Velero resources in the OADP namespace, synchronizes status back to the tenant namespace, and supports approval workflows for tenant-provided backup storage.
Takeaways
A user needs permissions such as the namespace-level admin ClusterRole to create NonAdminBackup and NonAdminRestore resources; view-only RBAC is insufficient.
When a tenant conflicts with an enforced backup setting, the controller rejects the request rather than silently overriding it. Omitted fields receive the enforced value when the Velero Backup is created.
As of OADP 1.6, tenants have no native self-service schedule CRD, cannot restore across namespaces, and cannot use short-lived credentials for tenant-provided backup storage locations.
Source and freshness
- Source
- developers.redhat.com
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.