# T4K Pod/Job Capabilities

#### T4K Application :

| Operation                    | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Original Kind |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ------------- |
| Admission-webhook            | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Webhook-init                 | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Control Plane                | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Analyzer                     | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Exporter                     | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Ingress-nginx-controller     | false, true                                                                                                       | 101, true                                                                                                     | false                  | NET\_BIND\_SERVICE                       | Deployment    |
| Web                          | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Web Backend                  | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Dex                          | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Dex-Init                     | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Manager                      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                                                                                                      | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Syncer                       | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                                                                                                      | true                   | KILL, AUDIT\_WRITE                       | Deployment    |
| Watcher                      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment    |
| Continuous Restore Service   | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment    |
| Continuous Restore Responder | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment    |
| Resource Cleaner             | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Job           |

#### Target :

| Operation      | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| -------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Validator      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | AUDIT\_WRITE,KILL                        | true              | Job           |
| Target Browser | <p><strong>For NFS target</strong> - true, true<br><br><strong>For ObjectStore target</strong> - true, true</p>   | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | true              | Deployment    |

#### BackupPlan / ClusterBackupPlan :

| Operation                        | Privileged / AllowPrivilegeEscalation | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities       | Has data-attacher | Original Kind |
| -------------------------------- | ------------------------------------- | ------------------------ | ---------------------- | ------------------ | ----------------- | ------------- |
| Backup / ClusterBackup Scheduler | false, false                          | 1001, true               | true                   | KILL, AUDIT\_WRITE | false             | Job           |

#### Backup :

| Operation       | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                                                                                                                                                                                                                                                                       | Has data-attacher | Original Kind |
| --------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------- |
| Snapshotting    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID                                                                                                                                                                                                                                           | true              | Job           |
| Image Backup    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Metadata Upload | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Retention       | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Data Upload     | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Quiesce         | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Unquiesce       | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Cleaner         | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | true              | Job           |

#### Restore :

| Operation           | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                                                                                                                                                                                                                                                                       | Has data-attacher | Original Kind |
| ------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------- |
| Metadata Validation | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Metadata Restore    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Add Protection      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID                                                                                                                                                                                                                                       | true              | Job           |
| Data Owner Update   | false, false                                                                                                      | 1001, true               | true                   | CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID                                                                                                                                                                                                                                       | true              | Job           |
| Data Restore        | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Quiesce             | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Cleanup             | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |

#### ClusterRestore :

| Operation           | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| ------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Pre Cluster Restore | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |
| Cleanup             | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | false             | Job           |

#### ConsistentSet:

| Operation          | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| ------------------ | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Pre Consistent Set | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |
| Data Restore       | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |