Resources and Permissions

This page describes the different resources that Trilio for Kubernetes (T4K) accesses within the Kubernetes cluster, including the mapping of jobs to pods and the RBAC permissions required by each.

Job to Pod Mapping

The table below shows the translation of T4K Jobs to their corresponding container images or Pods.

Job / Function Name	Images / Pods Used
ControlPlane	ControlPlane
Webhook	Webhook
Exporter	Exporter
Target Validation Job	DataAttacher
Snapshot Job	Metamover
DataUpload Job	Datamover
MetaData Upload Job	Metamover
Retention Job	Alpine image (TBD)
Backup Cleaner Job	DataAttacher
Cron Job	BackupScheduler
Metamover Validation Job	Metamover
Data Restore Job	Datamover
Metamover Restore Job	Metamover
Resource Cleaner Job	ResourceCleaner
Conversion Server Job	ConversionController

Job Permissions

The following tabs list the resources and permissions that T4K components and jobs require.

ControlPlane/Webhook/Exporter/TargetValidation/BackupCleaner/ResourceCleaner Job

API Group	Resources / Resource Name	Verbs
triliovault.trilio.io	*	*
*	*	get, list, watch
apiextensions.k8s.io	customresourcedefinitions	get, list, watch, create
core	serviceaccounts, services, services/finalizers, events, secrets, persistentvolumeclaims	*
core	pods, services, services/finalizers, endpoints, events, configmaps, secrets	get, list, watch
core	namespaces	get, list, watch, create, update
core	persistentvolumes	get, list, watch, update
admissionregistration.k8s.io	validatingwebhookconfigurations, mutatingwebhookconfigurations	*
batch	job	*
apps	statefulsets, daemonsets, replicasets, deployments/finalizers	get, list, watch
apps	deployments	get, list, watch, create, update, delete
extensions	cronjobs	*
snapshot.storage.k8s.io	*	*
rbac.authorization.k8s.io	clusterrole, clusterrolebindings	*

Snapshot/MetaData Upload/Data Upload Job

Metamover Validation/Data Restore/Metamover Restore Job

Conversion Server

Security Context / Security Policy Definitions

Privileged SCC

Name:                             privileged
Priority:                         <none>
Access:
  Users:
  Groups:
Settings:
  Allow Privileged:               true
  Allow Privilege Escalation:     true
  Default Add Capabilities:       <none>
  Required Drop Capabilities:     <none>
  Allowed Capabilities:           *
  Allowed Seccomp Profiles:       *
  Allowed Volume Types:           *
  Allowed Flexvolumes:            <all>
  Allowed Unsafe Sysctls:         *
  Forbidden Sysctls:              <none>
  Allow Host Network:             true
  Allow Host Ports:               true
  Allow Host PID:                 true
  Allow Host IPC:                 true
  Read Only Root Filesystem:      false
  Run As User Strategy:           RunAsAny
    UID:                          <none>
    UID Range Min:                <none>
    UID Range Max:                <none>
  SELinux Context Strategy:       RunAsAny
    User:                         <none>
    Role:                         <none>
    Type:                         <none>
    Level:                        <none>
  FSGroup Strategy:               RunAsAny
    Ranges:                       <none>
  Supplemental Groups Strategy:   RunAsAny
    Ranges:                       <none>

Restricted SCC

Pod Security Context Summary

Pod	Type	SCC / PSP	Specific Capability
Control-plane	Deploy time	Restricted	KILL, AUDIT_WRITE
Webhook	Deploy time	Restricted	KILL, AUDIT_WRITE
Exporter	Deploy time	Restricted	KILL, AUDIT_WRITE
Metamover	Run-time	Privileged	*
Datamover	Run-time	Privileged	*
DataAttacher	Run-time	Privileged	*
BackupScheduler	Run-time	Restricted	KILL, AUDIT_WRITE
ResourceCleaner	Run-time	Restricted	KILL, AUDIT_WRITE
Conversion Deployment	Run-time	Restricted	KILL, AUDIT_WRITE