Skip to main content

RBAC And Permissions

Testudo permissions fall into three groups: management cluster permissions, Server API permissions, and remote business cluster permissions.

Management Cluster Permissions​

disaster-operator needs to:

  • Manage CRDs under testudo.softcdata.com/v1.
  • Read and write CRD status, conditions, and history.
  • Create Kubernetes Events.
  • Access Secrets that store remote cluster credentials.
  • Manage ConfigMaps/Leases for leader election.
  • Serve metrics and webhook endpoints.

disaster-server needs to:

  • Read and write disaster recovery CRDs.
  • Read Events.
  • Read and write user, system setting, and License resources.
  • Convert console actions into CRD creates or updates.

The current Chart gives disaster-server a broad ClusterRole. Production environments that require least privilege should narrow this based on actual API coverage and regression-test console, Watch, License, statistics, and deletion-check flows.

Remote Business Cluster Permissions​

Remote cluster credentials are used to access source and target clusters. Minimum permissions should cover:

  • Reading Kubernetes API resources and namespace resources.
  • Reading and writing Velero Backup, Restore, Schedule, and BackupStorageLocation.
  • Reading and restoring protected namespace workloads, Services, Ingresses, PVCs, Secrets, and ConfigMaps.
  • Reading StorageClasses, IngressClasses, CRDs, and dependency resources.

Do not use cluster-admin as a permanent default. It can help initial validation, but production credentials should be narrowed before launch.

Permission Troubleshooting​

SymptomCheck First
Cluster registered but resource lists are emptyRemote token list/watch permissions
Backup is not createdVelero namespace, Backup/BSL permissions
Restore failsTarget namespace, PV/PVC, StorageClass permissions
Instance does not become ProtectedDataSync/ResourceSync, Events, operator logs
Server API returns 403User permissions, JWT, Server RBAC

Audit Guidance​

  • Regularly export ClusterRole, ClusterRoleBinding, and related Secrets.
  • Define remote cluster credential rotation.
  • Enable object storage bucket access logs or auditing.
  • Record trace ID, user ID, and target object for console operations.