RBAC for external backup imports in OpenEverest
When importing external backups into OpenEverest, it is essential to consider Role-Based Access Control(RBAC) permissions. This ensures only authorized users have the required permissions to access and manage the data.
Required roles and permissions
The following RBAC permissions are supported for DataImporters and DataImportJobs:
Important
❌ Represents an action that's not supported by the OpenEverest API.
| Resource | Read | Create | Update | Delete |
|---|---|---|---|---|
data-importers | [name] | ❌ | ❌ | ❌ |
data-import-jobs | [namespace]/[db name] | ❌ | ❌ | ❌ |
Example: RBAC policy for importing a MySQL backup
To import a MySQL backup using a DataImporter, a user with the dbadmin role needs the following permissions within the a2 namespace :
p, role:dbadmin, namespaces, read, *
p, role:dbadmin, database-engines, read, a2/*
p, role:dbadmin, database-clusters, *, a2/*
p, role:dbadmin, backup-storages, read, a2/*
p, role:dbadmin, database-cluster-backups, *, a2/*
p, role:dbadmin, monitoring-instances, read, a2/*
p, role:dbadmin, data-importers, read, everest-percona-pxc-operator
p, role:dbadmin, data-import-jobs, read, a2/*
Let’s dive into decoding this!
| Resource | Action | Description |
|---|---|---|
namespaces | read | You can view all namespaces in the cluster. |
database-engines | read | You can view the available database engine types within the a2 namespace. |
database-clusters | * | Full access to manage database clusters in the a2 namespace. |
backup-storages | read | You can view configured external storage targets (e.g., S3, GCS). |
database-cluster-backups | * | Grants complete control over database backups. You can create new backups, restore from existing ones, and delete them as needed. |
monitoring-instances | read | You can view monitoring configuration for clusters |
data-importers | read | You can view and use a specific DataImporter (in this case, everest-percona-pxc-operator) during the backup import workflow. Without this, the importer will not appear in the UI or CLI. |
data-import-jobs | read | You can monitor the status of import jobs triggered via the DataImporter. |
note
For MongoDB and PostgreSQL, the importer names will be everest-percona-psmdb-operator and everest-percona-pg-operator, respectively.