kubevirt: chart RBAC and catalog parameters for CBT backups - #367
Open
anisurrahman75 wants to merge 7 commits into
Open
anisurrahman75 wants to merge 7 commits into
anisurrahman75 wants to merge 7 commits into
Conversation
RBAC forbids granting permissions the granter does not hold, so this must stay a superset of the KubeVirt rules in the operator's pkg/rbac job roles -- which now include backup.kubevirt.io for changed block tracking. Signed-off-by: Anisur Rahman <anisur@appscode.com>
Exposes backupMode, forceFull and cbtScratchStorageClass on the kubevirt addon's backup tasks so a BackupConfiguration can select the changed-block tracking path without a hand-edited Addon. Signed-off-by: Anisur Rahman <anisur@appscode.com>
The appended args and parameters were indented one level short, so the raw YAML no longer parsed. hack/fmt/main.go wipes charts/kubestash-catalog/templates and rebuilds it from catalog/raw, silently skipping files it cannot parse, so the three kubevirt templates were deleted rather than regenerated and the hand-edited copies masked the broken source. Fixed at the source and let the generator emit the templates. Signed-off-by: Anisur Rahman <anisur@appscode.com>
A task declares one static driver, and that is what the retention policy job keys its cleaner containers off. The existing volume-backup writes restic, so changed-block-tracking needs its own task to get its blocks reclaimed. Signed-off-by: Anisur Rahman <anisur@appscode.com>
The charts ship their own copies of the apimachinery CRDs, so a helm upgrade re-applied the stale schema and rejected the new driver. These revert to generated output once apimachinery#258 releases and the dependency is bumped. Signed-off-by: Anisur Rahman <anisur@appscode.com>
The charts carry hand-copied CRDs that lag the apimachinery release, so the new kind has to be copied in the same way the BlockCAS schema was: straight from apimachinery/crds, minus the generated creationTimestamp the other copies also drop. Both the operator chart and the certified-crds chart get it, because the certified chart regenerates from the released operator .tgz and would otherwise stay a kind behind until the next release. The operator's own ClusterRole needs no new rules. Its core.kubestash.com and storage.kubestash.com wildcards already cover kubevirtarchivers, the BackupConfigurations and the Snapshots the reconciler owns, batch/jobs covers the resident archiver Job, and the KubeVirt read rules added for the addon are exactly what the controller needs to resolve and watch VirtualMachines. What changed is why those read verbs exist: they used to be there only so the operator could grant them onward to backup Jobs, and the comment said so. Signed-off-by: Anisur Rahman <anisur@appscode.com>
The Snapshot CRD lagged apimachinery: BlockCASStats grew the fields the resident archiver reports through — the checkpoint index key, first/last checkpoint times, total and failed counts, the last failure, and the bounded recentCheckpoints window — and RestoreSession grew dataSource.pointInTime. Without them the operator's status writes are silently pruned by the API server and the archiver looks idle while it is working. Also drop creationTimestamp: null from the three CRDs that carried it. It is generator noise, the other fourteen in the chart do not have it, and it came back each time these files were copied across from apimachinery. Signed-off-by: Anisur Rahman <anisur@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes for the KubeVirt changed-block-tracking backup path:
backup.kubevirt.iosuperset rule, so the operator can grant KubeVirt addon backup jobs the permissions they need. An operator can only delegate permissions it holds, so this must mirror kubestash/kubestash#388.backupMode,forceFullandcbtScratchStorageClasson thekubevirtaddon'slogical-backupandvolume-backuptasks, with the matching Function args.Without the catalog change the Addon is Helm-managed and a
BackupConfigurationselecting CBT is rejected withParam backupMode is invalid. Not defined in Task logical-backup of Addon kubevirt.Part of the KubeVirt CBT incremental-backup work: