Permissions

The accounts that Veeam Plug-in for KubeVirt uses to deploy and manage backup infrastructure components must be granted the following permissions.

Veeam Backup & Replication User Account Permissions

A user account that you plan to use when installing and working with Veeam Backup & Replication must have permissions described in section Installing and Using Veeam Backup & Replication.

Red Hat OpenShift Virtualization Service Account Permissions

Veeam Plug-in for KubeVirt interacts with the Red Hat OpenShift Virtualization cluster through a single service account that the Helm chart creates at install time. Veeam Plug-in for KubeVirt does not create or modify RBAC objects at run time.

The Helm chart creates the following service account:

Red Hat OpenShift Virtualization Service Account Permissions
Property	Value
Kind	ServiceAccount
Name	vkp
Namespace	The namespace in which the chart is installed

The same vkp identity is used by the Veeam KubeVirt Proxy and by the VKP Data Mover Pods launched for backup and restore operations.

Names of cluster-scoped objects are built from the namespace in which Veeam Plug-in for KubeVirt is installed. For an installation in the <ns> namespace, the object names are the following:

Service account: vkp
Cluster role and cluster role binding: vkp-<ns>
Security context constraints: vkp-<ns>-scc

For example, an installation in the vkp-system namespace produces the vkp service account, the vkp-vkp-system cluster role and cluster role binding, and the vkp-vkp-system-scc security context constraints.

Cluster Role Permissions

The vkp service account is bound to one cluster role. The role is cluster-scoped because Veeam Plug-in for KubeVirt protects VMs in any namespace of the cluster and reads cluster-scoped objects: persistent volumes, storage classes and volume snapshot classes.

The cluster role grants the following permissions:

Cluster Role Permissions
API Group	Resources	Access	Verbs	Purpose
"" (core)	namespaces	Read-write	get, list, watch, create	Discovering namespaces and creating the target namespace during restore.
"" (core)	secrets	Read-write	get, create, update	Reading Veeam Backup & Replication credentials, and creating or updating secrets restored with a VM.
"" (core)	serviceaccounts	Read-write	get, list, create	Backing up and restoring service account resources mounted into VMs.
"" (core)	persistentvolumeclaims	Read-write	get, list, watch, create, update, patch, delete	Inspecting PVCs, creating clones during backup and restoring PVCs.
"" (core)	persistentvolumes	Read-write	get, list, watch, create, delete, patch, update	Performing cluster-scoped persistent volume operations required for cloning.
"" (core)	pods	Read-write	create, delete, get, list, watch	Creating and managing data mover pods.
"" (core)	configmaps	Read-write	get, list, create	Reading and restoring config maps associated with VMs.
"" (core)	pods/exec	Read-write	create	Running backup commands inside data mover pods.
"" (core)	pods/log	Read-only	get, list, watch	Reading data mover pod logs.
kubevirt.io	virtualmachines, virtualmachineinstances, kubevirts	Read-write	get, list, watch, patch, create, update, delete	Discovering, backing up and restoring VMs and VM instances.
subresources.kubevirt.io	virtualmachineinstances/freeze, virtualmachineinstances/unfreeze	Read-write	get, update	Freezing and unfreezing the guest file system for application-consistent snapshots.
subresources.kubevirt.io	*	Read-only	get	Reading VM and VM instance subresources.
cdi.kubevirt.io	cdis, datavolumes	Read-write	get, list, watch, create, delete	Managing CDI data volumes used to import and restore disks.
instancetype.kubevirt.io	*	Read-write	get, list, watch, create	Reading and restoring VM instance types and preferences.
authentication.k8s.io	tokenreviews	Write (authentication check)	create	Validating the bearer token that Veeam Backup & Replication presents to Veeam Plug-in for KubeVirt.
snapshot.storage.k8s.io	volumesnapshotclasses	Read-write	create, get, update	Resolving and preparing volume snapshot classes for CSI snapshots.
snapshot.storage.k8s.io	volumesnapshotcontents	Read-write	create, delete, get, update	Managing CSI snapshot contents.
snapshot.storage.k8s.io	volumesnapshots	Read-write	create, delete, get, list	Creating and managing CSI volume snapshots.
extensions, apps	daemonsets	Read-only	get, list, watch	Inspecting daemon sets to discover the CSI and CDI topology.
k8s.cni.cncf.io	network-attachment-definitions	Read-write	get, list, create	Listing and restoring VM network configuration.
storage.k8s.io	storageclasses	Read-only	get, list	Listing available storage classes.

Note

The Access column shows whether the permissions are read-only or allow modification of objects. The column does not map to the built-in Kubernetes view, edit and admin roles. These roles are namespaced and do not cover the cluster-scoped resources, custom resource definitions and subresources that Veeam Plug-in for KubeVirt requires. You cannot use them instead of the cluster role.

The cluster role does not include the following permissions:

The cluster-admin role or a wildcard cluster role.
Write access to nodes, custom resource definitions, RBAC objects and webhook configurations.
Permissions to run privileged containers.

Security Context Constraints

Red Hat OpenShift Virtualization requires security context constraints for the service account to run its pods. The Helm chart creates the vkp-<ns>-scc security context constraints, binds them to the vkp service account and specifies the following settings:

Security Context Constraints
Setting	Value
allowPrivilegedContainer	false
runAsUser	RunAsAny
fsGroup	RunAsAny
supplementalGroups	RunAsAny
seLinuxContext	MustRunAs

Note

Data mover pods run as root and use the disk supplemental group to read and write VM disk volumes. The pods do not run as privileged containers.