Kanister Pod Override

In some cases, there can be a requirement to override Kanister jobs pods specifications with custom values, such as tolerations for taints, nodeSelector, or serviceAccountName. This can serve a use-case when the pods need to be scheduled on a particular node, or use a ServiceAccount which provides limited access. Changing these values manually for Kanister Job pods will not be feasible.

To handle specifying the custom pod override for all Kanister Pods, a ConfigMap named pod-spec-override must be created in the kasten-io namespace. Veeam Kasten will merge the specifications configured in pod-spec-override with other specifications set through Helm (such as Root CA) and apply the merged configuration to all Kanister Job Pods.

Note

imagePullSecrets and securityContext should not be set via pod-spec-override. If these configurations are set in this manner, Veeam Kasten will ignore them.

Note

When the helm option for providing a Root CA to Veeam Kasten (i.e., cacertconfigmap.name) is enabled, the Kanister Backup/Restore workflow will create a new ConfigMap, in the application namespace to provide the Root CA to the sidecar. This ConfigMap in the application namespace would be a copy of the Root CA ConfigMap residing in the Veeam Kasten namespace, which would be deleted at the end of the workflow. To override this, the Root CA ConfigMap can be created in the application namespace and the respective Volume and VolumeMounts in the pod-spec-override in kasten-io namespace.

For example, the following ConfigMap defines a Pod Specification, which contains tolerations to node taints, and a nodeSelector.

apiVersion: v1
data:
  override: |
    kind: Pod
    spec:
      nodeSelector:
        disktype: ssd
      tolerations:
        - effect: NoSchedule
          key: app
          operator: Equal
          value: mysql
      serviceAccountName: abcd
      containers:
        - name: container
          volumeMounts:
            - mountPath: /etc/ssl/certs/custom-ca-bundle.pem
              name: custom-ca-bundle-store
              subPath: custom-ca-bundle.pem
      volumes:
        - configMap:
            defaultMode: 420
            name: custom-ca-bundle-store
          name: custom-ca-bundle-store
kind: ConfigMap
metadata:
  name: pod-spec-override
  namespace: kasten-io
...

This ConfigMap now would be merged with all Kanister job Pod specifications. The Kanister restore job Pods would look like:

apiVersion: v1
kind: Pod
metadata:
  name: restore-data-*
  namespace: mysql
spec:
  containers:
    - name: container
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - mountPath: /etc/ssl/certs/custom-ca-bundle.pem
          name: custom-ca-bundle-store
          subPath: custom-ca-bundle.pem
  nodeSelector:
    disktype: ssd
  serviceAccount: abcd
  serviceAccountName: abcd
  tolerations:
    - effect: NoSchedule
      key: app
      operator: Equal
      value: mysql
  volumes:
    - configMap:
        defaultMode: 420
        name: custom-ca-bundle-store
      name: custom-ca-bundle-store
...

Configuring custom labels and annotations

Kanister pods launched during Veeam Kasten operations can be configured with additional custom labels and annotations through Helm Values.

Custom labels can be configured through Helm in following ways:

• Providing the path to one or more YAML files during helm install or helm upgrade with the --values flag:

  kanisterPodCustomLabels: "key1=value1,key2=value2"
  kanisterPodCustomAnnotations: "key1=value1,key2=value2"

• Modifying the resource values one at a time with the --set flag during helm install or helm upgrade:

  --set=kanisterPodCustomLabels="key1=value1,key2=value2"
  --set=kanisterPodCustomAnnotations="key1=value1,key2=value2"