Document restic nuances with NFS volumes and `root_squash`

[dymurray]

With root_squash, restic will be mapped to nfsnobody and will not have enough permissions to perform the backup/restore. This has been documented in our MTC product as well as customers also required the use of root_squash and ran into some issues (see here: https://docs.openshift.com/container-platform/4.7/migration_toolkit_for_containers/troubleshooting-mtc.html#restic-permission-error-when-migrating-from-nfs-storage-with-root-squash-enabled_troubleshooting-mtc).

There are 2 ways to get around this issue:

1. Use supplemental groups and apply this same supplemental group to the restic daemonset (this change will need to be submitted to OADP as well to mimic MTC, which shouldn't be an issue if this is strongly desired)
2. Set no_root_squash

[henrychi2]

Even with supplemental groups, the restic pod still won't be able to copy files that don't have group permissions correct? From the example in #133, there is a file like

-rw-------. 1 1000610000 nobody  33 Jul 13 14:23 .erlang.cookie

The file .erlang.cookie doesn't have group permissions. Doesn't that mean only the owner or root can copy the file? Restic pod will run as nobody, and can't copy it.

[sseago]

And with root squashing, that would require that restic run as the owner. I'm not sure how that would work here, though.

[henrychi2]

The files to backup have different owners too. Unless I'm missing something, it seems like Velero with restic just doesn't work with root squash enabled.

[sseago]

I imagine rsync-based solutions would have the same problem, actually. @dymurray -- is there any way around this issue?

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[shawn-hurley]

@eemcmullan Seems like this issue can be closed?