# T4K Pod/Job Capabilities

> Note: Privilege escalation for T4K components is limited to the `trilio-system` namespace and is required for the Data Upload and Metadata Upload states.

#### T4K Application :

| Operation                                              | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Original Kind  |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | -------------- |
| Control Plane                                          | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Webhook-init                                           | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Exporter                                               | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Ingress-nginx-controller                               | false, true                                                                                                       | 101, true                                                                                                     | false                  | NET\_BIND\_SERVICE                       | Deployment     |
| Web                                                    | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Web Backend                                            | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Dex                                                    | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Dex-Init                                               | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Manager                                                | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                                                                                                      | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Syncer                                                 | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                                                                                                      | true                   | KILL, AUDIT\_WRITE                       | Deployment     |
| Watcher                                                | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment     |
| Continuous Restore Service                             | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment     |
| Continuous Restore Responder                           | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | false                  | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | Deployment     |
| Resource Cleaner                                       | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | Job            |
| <p><del>Admission-webhook</del><br>(NA from 5.0.3)</p> | ~~false, false~~                                                                                                  | ~~1001, true~~                                                                                                | ~~true~~               | ~~KILL, AUDIT\_WRITE~~                   | ~~Deployment~~ |
| <p><del>Analyzer</del><br>(NA from 5.0.3)</p>          | ~~false, false~~                                                                                                  | ~~1001, true~~                                                                                                | ~~true~~               | ~~KILL, AUDIT\_WRITE~~                   | ~~Deployment~~ |

#### Target :

| Operation      | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| -------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Validator      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | AUDIT\_WRITE,KILL                        | true              | Job           |
| Target Browser | <p><strong>For NFS target</strong> - true, true<br><br><strong>For ObjectStore target</strong> - true, true</p>   | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID | true              | Deployment    |

#### BackupPlan / ClusterBackupPlan :

| Operation                        | Privileged / AllowPrivilegeEscalation | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities       | Has data-attacher | Original Kind |
| -------------------------------- | ------------------------------------- | ------------------------ | ---------------------- | ------------------ | ----------------- | ------------- |
| Backup / ClusterBackup Scheduler | false, false                          | 1001, true               | true                   | KILL, AUDIT\_WRITE | false             | Job           |

#### Backup :

| Operation       | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                                                                                                                                                                                                                                                                       | Has data-attacher | Original Kind |
| --------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------- |
| Snapshotting    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETGID,SETUID                                                                                                                                                                                                                                           | true              | Job           |
| Image Backup    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Metadata Upload | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Retention       | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Data Upload     | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Quiesce         | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Unquiesce       | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Cleaner         | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | true              | Job           |

#### Restore :

| Operation           | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot | ReadOnlyRootFilesystem | Capabilities                                                                                                                                                                                                                                                                       | Has data-attacher | Original Kind |
| ------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------- |
| Metadata Validation | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Metadata Restore    | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID                                                                                                                                                                                                                                           | true              | Job           |
| Add Protection      | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID                                                                                                                                                                                                                                       | true              | Job           |
| Data Owner Update   | false, false                                                                                                      | 1001, true               | true                   | CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID                                                                                                                                                                                                                                       | true              | Job           |
| Data Restore        | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | 0, false                 | true                   | <p><strong>T4K 3.0.3 onwards:</strong></p><p>CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID</p><p><strong>T4K < 3.0.3:</strong></p><p><strong>For NFS target</strong> - CHOWN, FOWNER, DAC\_OVERRIDE, SETGID, SETUID<br><br><strong>For ObjectStore target</strong> - SYS\_ADMIN</p> | true              | Job           |
| Quiesce             | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |
| Cleanup             | false, false                                                                                                      | 1001, true               | true                   | KILL, AUDIT\_WRITE                                                                                                                                                                                                                                                                 | false             | Job           |

#### ClusterRestore :

| Operation           | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| ------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Pre Cluster Restore | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |
| Cleanup             | false, false                                                                                                      | 1001, true                                                                                                    | true                   | KILL, AUDIT\_WRITE                       | false             | Job           |

#### ConsistentSet:

| Operation          | Privileged / AllowPrivilegeEscalation                                                                             | RunAsUser / RunAsNonRoot                                                                                      | ReadOnlyRootFilesystem | Capabilities                             | Has data-attacher | Original Kind |
| ------------------ | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ----------------- | ------------- |
| Pre Consistent Set | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |
| Data Restore       | <p><strong>For NFS target</strong> - false, false<br><br><strong>For ObjectStore target</strong> - true, true</p> | <p><strong>For NFS target</strong> - 1001, true<br><br><strong>For ObjectStore target</strong> - 0, false</p> | true                   | CHOWN,FOWNER,DAC\_OVERRIDE,SETUID,SETGID | true              | Job           |