OpenShift tenants can now back up VMs and containers without cluster-admin access

Red Hat has documented a self-service data-protection pattern that removes a familiar multi-tenant OpenShift bottleneck: application teams can create and monitor their own backups without receiving access to the cluster-wide OADP namespace or cluster-admin credentials.

The mechanism ships in OpenShift APIs for Data Protection (OADP), Red Hat’s operator distribution around Velero. Red Hat says self-service became supported in OADP 1.5 and recommends OADP 1.6 for current deployments.

What changes for tenants

Instead of creating Velero resources in openshift-adp, a namespace owner creates a NonAdminBackup or NonAdminRestore custom resource alongside the application. The self-service controller validates that request, creates the corresponding Velero object in the protected operator namespace and synchronizes status back to the tenant-facing resource.

That proxy boundary matters because ordinary users previously needed a platform-team ticket for each backup or restore. Velero understands namespace scope, but its control objects normally live where tenants cannot reach them. OADP’s namespace-scoped API separates the right to protect an application from the right to administer the backup system.

The same workflow covers container workloads and OpenShift Virtualization virtual machines. VM objects, data volumes and persistent volume claims reside in the tenant namespace, so they can be protected through the same NonAdminBackup request. OADP 1.6 also adds VM File Restore for retrieving individual files without restoring a full virtual machine.

What platform teams still control

Self-service does not hand policy to tenants. Administrators enable the feature in the DataProtectionApplication resource and can enforce retention periods, snapshot movement, filesystem-backup strategy and resource inclusion or exclusion rules. Conflicting tenant settings are rejected rather than silently rewritten.

The controller also excludes sensitive cluster-scoped objects such as SecurityContextConstraints, cluster roles, cluster role bindings and custom resource definitions. If a tenant wants to bring an S3-compatible, Google Cloud Storage or Azure Blob Storage location, administrators can require a separate approval before data is sent there.

That makes the design useful as a platform-engineering control plane rather than merely a convenience API: teams get an immediate backup path, while operators keep common recovery, cost and compliance boundaries.

Limits to test before rollout

The current API is v1alpha1, although Red Hat describes the feature itself as supported. OADP 1.6 does not provide a native tenant schedule resource, restricts restores to the tenant’s own namespace and proxies log downloads rather than exposing Velero logs directly. Tenant-provided storage also requires long-lived cloud credentials; short-lived identity mechanisms such as AWS STS and workload identity are not supported in this path.

Red Hat says OADP 1.6 ships for OpenShift 4.19 through 4.22. Platform teams should first enable nonAdmin.enable in a development cluster, apply enforced backup fields and storage approval rules, then test the namespace role binding and failure behavior before exposing self-service in production.