Advanced Gateway Configuration

Overview

CloudCasa mounts NFS and SMB storage into pods that it starts on the cluster for backups and other operations. Some sites have complex requirements regarding labels, annotations, requests, limits, etc. that must be applied to the resources CloudCasa creates for a storage. The Customize gateway parameters section under Advanced options in the Edit Storage page allows administrators to configure these properties using YAML.

The YAML document has three sections:

common

Labels and annotations for all the resources in the fs section. The pods that use the storage take theirs from the cluster’s configuration.

containers

Requests and limits for the pods that CloudCasa starts to use this storage. They override the values that the cluster’s configuration sets for the same pods, so that one storage can get larger pods than the others. Everything else about these pods, such as their labels, tolerations and security context, is set in the cluster’s configuration. See Advanced Agent Configuration.

fs

The PersistentVolume and PersistentVolumeClaim through which the storage is mounted, and the S3 gateway. CloudCasa uses the gateway only for recovery points that were created before it started mounting NFS and SMB storage directly.

The pods that CloudCasa starts to use a storage are:

job-helper

Runs a backup, restore or delete.

file-access

Keeps the storage mounted while CloudCasa validates it, browses a recovery point, or finishes a copy.

file-service

Prepares files to download from a recovery point.

repository-server

Serves a recovery point to the VM that CloudCasa starts to browse the files of a VM backup.

The YAML document for this has the following schema:

# This section applies a common label and annotation to ALL resources
# in the fs section.
common:
  annotations:
    contact-person:
  labels:

# ===================================================================
# Requests and limits of the pods that use this storage
# ===================================================================
containers:
  job-helper:
    requests:
      cpu:
      memory:
      ephemeral-storage:
    limits:
      cpu:
      memory:
      ephemeral-storage:
  file-access:
    requests:
      cpu:
      memory:
      ephemeral-storage:
    limits:
      cpu:
      memory:
      ephemeral-storage:
  file-service:
    requests:
      cpu:
      memory:
      ephemeral-storage:
    limits:
      cpu:
      memory:
      ephemeral-storage:
  repository-server:
    requests:
      cpu:
      memory:
      ephemeral-storage:
    limits:
      cpu:
      memory:
      ephemeral-storage:

# ===================================================================
# FS S3 Gateway Specific Customizations
# ===================================================================
fs:
  # --- Customizations for the PersistentVolume ---
  # (also used when the storage is mounted directly)
  pv:
    labels:
    annotations:

  # --- Customizations for the PersistentVolumeClaim ---
  # (also used when the storage is mounted directly)
  pvc:
    labels:
    annotations:

  # --- Customizations for the Secret ---
  secret:
    labels:
    annotations:

  # --- Customizations for the NetworkPolicy ---
  network-policy:
    labels:
    annotations:

  # --- Customizations for the Service ---
  service:
    labels:
    annotations:
    # Test changing the port name.
    portName:

  # --- Customizations for the Deployment object itself ---
  deployment:
    labels:
    annotations:

  # --- Customizations for the Pod template within the Deployment ---
  pod:
    labels:
    annotations:
    # Test adding a toleration to allow scheduling on specific nodes.
    tolerations:
      - key:
        operator:
        effect:
    # Test setting a specific Pod-level security context.
    securityContext:
      fsGroup:
      runAsUser:
      runAsGroup:
      runAsNonRoot:

  # --- Customizations for the main Container within the Pod ---
  container:
    # Test overriding default resource requests and limits.
    requests:
      cpu:
      memory:
    limits:
      cpu:
      memory:
    # Test adding a new environment variable.
    env:
      - name:
        value:
    # Test setting a restrictive container-level security context.
    securityContext:
      allowPrivilegeEscalation:
      readOnlyRootFilesystem:
      capabilities:

Example

Here is an example that gives more memory to the pods that prepare downloads and serve VM file browsing for this storage, for instance because its backups are very large:

containers:
  file-service:
    requests:
      memory: "1Gi"
    limits:
      memory: "4Gi"
  repository-server:
    limits:
      memory: "4Gi"

Here is an example that configures CPU and memory requests and limits for the gateway pod:

fs:
  container:
    requests:
      cpu: "250m"
      memory: "350Mi"
    limits:
      cpu: "550m"
      memory: "650Mi"

Notes

• Under containers, only requests and limits can be set. A value that is not set keeps the value from the cluster’s configuration.

• Under containers, write every value in quotes, for example cpu: "1". A plain number is refused.

• If a request ends up above its limit, CloudCasa raises the limit to the request.

• Users must provide the entire securityContext section.

• Annotations and labels set in the common section will be overwritten by the values set at the resource level.