Kubernetes requirements
Verify the Kubernetes version, permissions, storage, networking, DNS, and capacity required by a RestoreTrust project worker.
Loading documentation…
Powered by heyo
Use this page to prepare a cluster before creating a project worker.
| Requirement | Supported baseline |
|---|---|
| Kubernetes | 1.29 or newer. Restore Jobs use native sidecar containers. |
| Recommended Kubernetes | 1.30 or newer to apply the optional egress ValidatingAdmissionPolicy generated by the console. |
| Workload APIs | apps/v1 Deployments, batch/v1 Jobs, generic ephemeral volumes, and networking.k8s.io/v1 NetworkPolicies |
| Pod Security | Built-in Pod Security admission. The generated job namespace enforces the restricted profile. |
| NetworkPolicy | A CNI that enforces ingress and egress NetworkPolicies for Pods |
| Storage | A CSI-backed StorageClass that dynamically provisions ReadWriteOnce filesystem volumes |
| DNS | Cluster DNS reachable on UDP and TCP port 53 from the job namespace |
Kubernetes 1.29 is the minimum supported version. On 1.29, skip the optional egress admission step; the namespace egress floor and per-execution NetworkPolicies still apply.
The person applying the generated manifests must be able to create:
Applying the optional egress admission manifest additionally requires permission to manage cluster-scoped ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.
Existing admission policies must permit the generated agent Deployment and restore Jobs. Do not weaken cluster-wide policy to make the install pass. Review the generated manifests and add a narrowly scoped exception only when your own policy requires one.
Each worker needs two different DNS-1123 namespace names:
The console suggests restoretrust-workers-<project> and restoretrust-jobs-<project>. Choose unique names for every worker identity installed in the same cluster. Names may contain lowercase letters, digits, and hyphens and must be at most 63 characters.
The scratch StorageClass must:
reclaimPolicy: Delete;ReadWriteOnce filesystem volumes;fsGroup so non-root containers can write;WaitForFirstConsumer when storage is topology-bound;See Scratch storage for sizing and quota guidance.
Allow:
WORKER_GRPC_TARGET;No inbound connection from RestoreTrust to your cluster is required. See Networking and egress for protocol ports and CIDR guardrails.
The generated Deployment sets CPU, memory, and ephemeral-storage requests and limits for the agent according to Max parallel jobs. These settings are separate from restore Job resources.
| Max parallel jobs | CPU request / limit | Memory request / limit | Ephemeral storage request / limit |
|---|---|---|---|
| 1 | 150m / 400m | 192Mi / 384Mi | 256Mi / 512Mi |
| 2–4 | 400m / 1000m | 384Mi / 768Mi | 512Mi / 1Gi |
| 5–16 | 1200m / 3000m | 1Gi / 2Gi | 1Gi / 2Gi |
| 17–64 | 4000m / 8000m | 3Gi / 6Gi | 2Gi / 4Gi |
These values cover the agent only. Restore Jobs need additional CPU, memory, image-pull bandwidth, and one scratch volume each. Ensure the cluster can schedule the configured number of Jobs concurrently. Changing the worker's parallel-job capacity requires saving the worker record and applying its generated Deployment patch.
By default a restore Job sets no CPU or memory requests or limits, so Kubernetes reserves nothing for it and, unless cluster admission adds defaults, treats it as BestEffort: under memory pressure it is among the first Pods evicted. There is no separate BestEffort option; leave all database-resource fields empty to retain this behavior.
A database schedule can set requests and limits for the database container, the one that imports the dump and answers the health probes. All four values are optional and independent: CPU request and limit in millicores (1000 = one CPU), memory request and limit in MiB. RestoreTrust sets exactly what the schedule contains and derives nothing; when only a limit is set, Kubernetes uses it as the request too. The other containers of the Job keep no requests or limits. File checks have no database container.
The values only reserve and cap resources; they do not tune the database itself. If no node has the requested CPU or memory free for five minutes by default, the check fails with exit code 49 (insufficient compute). A memory limit below what the restore needs can end with the database container OOM-killed. See CPU and memory for workers and Jobs for configuration and capacity examples.
Replace the placeholders with your planned names:
If your cluster uses NodeLocal DNSCache or a custom resolver, record the resolver IPs now. You may need to add them to the generated egress floor.