This is a cache of https://docs.okd.io/4.19/backup_and_restore/application_backup_and_restore/oadp-self-service/oadp-self-service-cluster-admin-use-cases.html. It is a snapshot of the page at 2025-07-01T21:08:28.772+0000.
OADP Self-<strong>service</strong> cluster admin use cases - OADP Application backup and restore | Backup and restore | OKD 4.19
  1. Documentation
×

OADP Self-service cluster admin use cases

Enabling and disabling OADP Self-service

You must be a cluster administrator to enable the OADP Self-service feature. You can use the spec.nonAdmin.enable section of the DataProtectionApplication (DPA) custom resource (CR) to enable and disable the Self-service feature.

Enabling the Self-service feature installs the NonAdminController (NAC) CR in the OADP Operator namespace.

You can install only one instance of the NonAdminController (NAC) CR in the cluster. If you install multiple instances of the NAC CR, you get the following error:

Example error
message: only a single instance of Non-Admin Controller can be installed across the entire cluster. Non-Admin controller is already configured and installed in openshift-adp namespace.
Prerequisites

  • You are logged in to the cluster with the cluster-admin role.

  • You have installed the OADP Operator.

  • You have configured the DPA.

Procedure

  • To enable OADP Self-service, edit the DPA CR to configure the nonAdmin.enable section. See the following example configuration:

    Example DataProtectionApplication CR
    apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: oadp-backup
  namespace: openshift-adp
spec:
  configuration:
    nodeAgent:
      enable: true
      uploaderType: kopia
    velero:
      defaultPlugins:
        - aws
        - openshift
        - csi
      defaultSnapshotMoveData: true
  nonAdmin: (1)
    enable: true (2)
  backupLocations:
    - velero:
        config:
          profile: "default"
          region: noobaa
          s3Url: https://s3.openshift-storage.svc
          s3ForcePathStyle: "true"
          insecureSkipTLSVerify: "true"
        provider: aws
        default: true
        credential:
          key: cloud
          name:  <cloud_credentials>
        objectStorage:
          bucket: <bucket_name>
          prefix: oadp
    1 Add the nonAdmin.enable section in the spec section of the DPA.
    2 Set the enable field to true. To disable the Self-service feature, set the enable field to false.
Verification

  • To verify that the NonAdminController (NAC) pod is running in the OADP namespace, run the following command:

    $ oc get pod -n openshift-adp -l control-plane=non-admin-controller
    Example output
    NAME                                  READY   STATUS    RESTARTS   AGE
non-admin-controller-5d....f5-p..9p   1/1     Running   0          99m

Enabling NonAdminBackupStorageLocation administrator approval workflow

The NonAdminBackupStorageLocation (NABSL) custom resource (CR) administrator approval workflow is an opt-in feature. As a cluster administrator, you must explicitly enable the feature in the DataProtectionApplication (DPA) CR by setting the nonAdmin.requireApprovalForBSL field to true.

You also need to set the noDefaultBackupLocation field in the DPA CR to true. This setting indicates that, there is no default backup storage location configured in the DPA CR and the namespace admin user can create a NABSL CR and send the CR request for approval.

Prerequisites

  • You are logged in to the cluster with the cluster-admin role.

  • You have installed the OADP Operator.

  • You have enabled OADP Self-service in the DataProtectionApplication CR.

Procedure

  • To enable the NABSL administrator approval workflow, edit the DPA CR by using the following example configuration:

    Example DataProtectionApplication CR
    apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: oadp-backup
  namespace: openshift-adp
spec:
  configuration:
    nodeAgent:
      enable: true
      uploaderType: kopia
    velero:
      defaultPlugins:
        - aws
        - openshift
        - csi
      noDefaultBackupLocation: true (1)
  nonAdmin:
    enable: true
    requireApprovalForBSL: true (2)
    1 Add the noDefaultBackupLocation field and set it to true.
    2 Add the requireApprovalForBSL field and set it to true.

Approving a NonAdminBackupStorageLocation request

As a cluster administrator, to approve a NonAdminBackupStorageLocation (NABSL) CR request, you can edit the NonAdminBackupStorageLocationRequest CR and set the approvalDecision field to approve.

Prerequisites

  • You are logged in to the cluster with the cluster-admin role.

  • You have installed the OADP Operator.

  • You have enabled OADP Self-service in the DataProtectionApplication (DPA) CR.

  • You have enabled the NABSL CR approval workflow in the DPA.

Procedure

  1. To see the NABSL CR requests that are in queue for administrator approval, run the following command:

    $ oc -n openshift-adp get NonAdminBackupStorageLocationRequests
    Example output
    NAME                          REQUEST-PHASE   REQUEST-NAMESPACE     REQUEST-NAME               AGE
non-admin-bsl-test-.....175   Approved        non-admin-bsl-test    incorrect-bucket-nabsl    4m57s
non-admin-bsl-test-.....196   Approved        non-admin-bsl-test    perfect-nabsl             5m26s
non-admin-bsl-test-s....e1a   Rejected        non-admin-bsl-test    suspicious-sample         2m56s
non-admin-bsl-test-.....5e0   Pending         non-admin-bsl-test    waitingapproval-nabsl     4m20s

  2. To approve the NABSL CR request, set the approvalDecision field to approve by running the following command:

    $ oc patch nabslrequest <nabsl_name> -n openshift-adp --type=merge -p '{"spec": {"approvalDecision": "approve"}}' (1)
    1 Specify the name of the NonAdminBackupStorageLocationRequest CR.
Verification

  • Verify that the Velero backup storage location is created and the phase is Available by running the following command:

    $ oc get velero.io.backupstoragelocation
    Example output
    NAME                         PHASE       LAST VALIDATED   AGE   DEFAULT
test-nac-test-bsl-cd...930   Available   62s              62s

Rejecting a NonAdminBackupStorageLocation request

As a cluster administrator, to reject a NonAdminBackupStorageLocation (NABSL) custom resource (CR) request, you can edit the NonAdminBackupStorageLocationRequest CR and set the approvalDecision field to reject.

Prerequisites

  • You are logged in to the cluster with the cluster-admin role.

  • You have installed the OADP Operator.

  • You have enabled OADP Self-service in the DataProtectionApplication (DPA) CR.

  • You have enabled the NABSL CR approval workflow in the DPA.

Procedure

  1. To see the NABSL CR requests that are in queue for administrator approval, run the following command:

    $ oc -n openshift-adp get NonAdminBackupStorageLocationRequests
    Example output
    $ oc get nabslrequest
NAME                          REQUEST-PHASE   REQUEST-NAMESPACE     REQUEST-NAME               AGE
non-admin-bsl-test-.....175   Approved        non-admin-bsl-test    incorrect-bucket-nabsl    4m57s
non-admin-bsl-test-.....196   Approved        non-admin-bsl-test    perfect-nabsl             5m26s
non-admin-bsl-test-s....e1a   Rejected        non-admin-bsl-test    suspicious-sample         2m56s
non-admin-bsl-test-.....5e0   Pending         non-admin-bsl-test    waitingapproval-nabsl     4m20s

  2. To reject the NABSL CR request, set the approvalDecision field to reject by running the following command:

    $ oc patch nabslrequest <nabsl_name> -n openshift-adp --type=merge -p '{"spec": {"approvalDecision": "reject"}}' (1)
    1 Specify the name of the NonAdminBackupStorageLocationRequest CR.

OADP Self-service administrator DPA spec enforcement

As a cluster administrator, you can enforce policies in the DataProtectionApplication (DPA) spec template. The spec enforcement applies to Self-service custom resources (CRs) such as NonAdminBackup, NonAdminRestore, and NonAdminBackupStorageLocation.

The cluster administrator can enforce a company, or a compliance policy by using the following fields in the DataProtectionApplication (DPA) CR:

enforceBSLSpec

To enforce a policy on the NonAdminBackupStorageLocation CR.

enforceBackupSpec

To enforce a policy on the NonAdminBackup CR.

enforceRestoreSpec

To enforce a policy on the NonAdminRestore CR.

By using the enforceable fields, administrators can ensure that the NABSL, NAB, and NAR CRs created by a namespace admin user, comply with the administrator defined policy.

Self-service administrator spec enforcement for NABSL

As a cluster administrator, you can enforce the following fields for a NonAdminBackupStorageLocation (NABSL) custom resource (CR):

  • objectStorage

  • credential

  • config

  • accessMode

  • validationFrequency

For example, if you want to enforce a namespace admin user to use a specific storage bucket, you can set up the DataProtectionApplication (DPA) CR as following:

Example DataProtectionApplication CR
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
...
spec:
  nonAdmin:
    enable: true
    enforceBSLSpec: (1)
      config: (2)
        checksumAlgorithm: ""
        profile: default
        region: us-west-2
      objectStorage: (3)
        bucket: my-company-bucket
        prefix: velero
      provider: aws
1 Add the enforceBSLSpec section.
2 Enforce the config section of a NABSL to use an AWS S3 bucket in the us-west-2 region.
3 Enforce the objectStorage section of a NABSL to use a company bucket named my-company-bucket.

When a namespace admin user creates a NABSL, they must follow the template set up in the DPA. Otherwise, the status.phase field on the NABSL CR is set to BackingOff and the NABSL fails to create.

Self-service administrator spec enforcement for NAB

As a cluster administrator, you can enforce the following fields for a NonAdminBackup (NAB) CR:

  • csiSnapshotTimeout

  • itemOperationTimeout

  • resourcePolicy

  • includedResources

  • excludedResources

  • orderedResources

  • includeClusterResources

  • excludedClusterScopedResources

  • excludedNamespaceScopedResources

  • includedNamespaceScopedResources

  • labelSelector

  • orLabelSelectors

  • snapshotVolumes

  • ttl

  • snapshotMoveData

  • uploaderConfig.parallelFilesUpload

If you want to enforce a ttl value and a Data Mover backup for a namespace admin user, you can set up the DataProtectionApplication (DPA) CR as shown in the following example:

Example DataProtectionApplication CR
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
...
spec:
  nonAdmin:
    enable: true
    enforceBackupSpec: (1)
      snapshotMoveData: true (2)
      ttl: 158h0m0s (3)
1 Add the enforceBackupSpec section.
2 Enforce Data Mover by setting the snapshotMoveData field to true.
3 Enforce the ttl value by setting the field to 158h0m0s.

When a namespace admin user creates a NAB CR, they must follow the template set up in the DPA. Otherwise, the status.phase field on the NAB CR is set to BackingOff and the NAB CR fails to create.

Self-service administrator spec enforcement for NAR

As a cluster administrator, you can enforce the following fields for a NonAdminRestore (NAR) custom resource (CR):

  • itemOperationTimeout

  • uploaderConfig

  • includedResources

  • excludedResources

  • restoreStatus

  • includeClusterResources

  • labelSelector

  • orLabelSelectors

  • restorePVs

  • preserveNodePorts