---
title: Installation
product: trilio-site-recovery-for-kubernetes
doc_type: guide
version: 0.2.0
source: git2docs (code-derived, validation-filtered)
canonical: https://docs-tsr.trilio.io/trilio-site-recovery-for-kubernetes/site-recovery/installation
---

# Installation

_Installing CRDs and deploying the site recovery operator_

## Overview

This page walks you through installing Trilio Site Recovery on OpenShift. Installation proceeds in two stages: first, you install the operator on your TSR-Manager cluster using OLM, which deploys the ProtectionZone controller, the TSR web console, and all required CRDs; second, you create zone credentials for your two workload clusters and declare a ProtectionZone CR, which causes the ProtectionZone controller to automatically deploy the TSR-Manager and workload control plane stacks across all three clusters. You do not run Helm commands directly — the Helm charts are embedded in the operator binary and applied by the controller on your behalf.

## Configuration

The ProtectionZone CR is the primary configuration object. All workload-cluster and TSR-Manager-side components are configured through its `spec`, not through chart values files.

---

### ProtectionZone spec fields

| Field | Required | Default | Description |
|---|---|---|---|
| `spec.storageBackendMode` | Yes | — | Must be `DRBD`. The `Linstor` value is rejected at admission. |
| `spec.displayName` | Yes | — | Human-readable name shown in the TSR web console. 5–253 characters. |
| `spec.description` | No | — | Free-form text, up to 1024 characters. |
| `spec.clusters[].name` | Yes | — | Operator-facing identifier for this cluster within the zone. Up to 63 characters. |
| `spec.clusters[].clusterID` | Yes | — | Fixed slot: `cluster1` or `cluster2`. This is the stable identifier used in ProtectionGroup and ProtectionRequest `sourceCluster` fields. |
| `spec.clusters[].distributionName` | No | `RHEL-CoreOS-9` | Selects the DRBD kernel-module loader image. Accepted values: `RHEL-CoreOS-9`, `RHEL-CoreOS-10`. RHEL CoreOS 10 is not validated in Tech Preview. |
| `spec.clusters[].kubeconfigSecretRef.name` | Yes | — | Name of the Secret in the zone namespace holding the kubeconfig for this cluster. |
| `spec.clusters[].kubeconfigSecretRef.key` | Yes | — | Key within the Secret containing the kubeconfig data. |

---

### Optional tuning fields

**Node agent startup behavior**

The DRBD node agent applies a `siterecovery.trilio.io/not-ready:NoSchedule` taint to its node at startup while DRBD resources are converging. The taint is removed when all resources are up or when the deadline passes.

```yaml
spec:
  nodeAgent:
    startupDeadlineSeconds: 120  # default; range 10–3600
```

Increasing this value gives DRBD more time to converge on nodes with many replicated volumes before workloads are allowed to schedule. Changing it rolls the node agent DaemonSet once on each workload cluster.

**Runtime log levels**

You can adjust log verbosity for all zone components without restarting pods. The change propagates via the `site-recovery-logging` ConfigMap within approximately 15 seconds.

```yaml
spec:
  logging:
    level: info              # required; one of: error | info | debug | trace
    controlPlaneLevel: debug # optional override for TSR-Manager and workload control planes only
    nodeAgentLevel: info     # optional override for DRBD node agents only
```

The `warn` level does not exist in the accepted value set. Use `info` for normal operations and `debug` or `trace` when diagnosing issues.

**Hook job retention**

Configure how long hook Jobs remain on workload clusters after finishing, so their logs remain accessible via `kubectl logs`:

```yaml
spec:
  hooks:
    jobTTLSeconds: 3600          # default: 3600 — how long a succeeded hook Job is kept
    failedJobRetentionSeconds: 604800  # default: 604800 (seven days) — how long a failed hook Job is kept
```

---

### What the ProtectionZone controller deploys automatically

You do not configure the following directly; the ProtectionZone controller manages them:

- **TSR-Manager control plane** (`site-recovery-manager-control-plane` chart) — installed into `dr-<zone-name>` on the TSR-Manager cluster. Hosts the ProtectionRequest, FailoverRequest, TestFailover, replication monitor, and DRBDReplicationPolicy reconcilers.
- **Workload control plane** (`site-recovery-workload-control-plane` chart) — installed into `trilio-site-recovery-system` on each workload cluster. Hosts the DRBDResource placement reconciler and admission webhooks.
- **DRBD node agent DaemonSet** — one pod per worker node on each workload cluster, named `<release>-site-recovery-workload-control-plane-agent`. Manages DRBD kernel state and metadata PVCs.
- **Default DRBDReplicationPolicy** — named `<zone-name>-default` with `isDefault: true` and Protocol C. You do not author or modify replication policies.
- **Webhook serving certificates** — provisioned and renewed automatically by the ProtectionZone controller. You do not create or rotate these.

---

### RBAC persona ClusterRoles

Three ClusterRoles ship with the OLM bundle. They are inert until bound to users or groups by a cluster administrator.

| ClusterRole | Bind with | Capabilities |
|---|---|---|
| `trilio-site-recovery-admin` | `ClusterRoleBinding` | Full control of all Site Recovery resources, including zone credential Secrets. Treat a cluster-wide binding as equivalent to cluster-wide Secret read access. |
| `trilio-site-recovery-operator` | `RoleBinding` per zone namespace | Full control of TestFailover; read-only access to all other Site Recovery resources. |
| `trilio-site-recovery-viewer` | `ClusterRoleBinding` | Read-only access to all Site Recovery resources across all zones. |

```bash
# Example: grant cluster-wide admin access to a user
oc create clusterrolebinding site-recovery-admin-alice \
  --clusterrole=trilio-site-recovery-admin \
  --user=alice

# Example: grant operator access scoped to one zone namespace
oc create rolebinding site-recovery-operator-bob \
  --clusterrole=trilio-site-recovery-operator \
  --user=bob \
  -n dr-my-zone
```