Project: Velero (Runtime / Cloud Native Storage)
File: azure-config.md

title: "Run Velero on Azure" layout: docs To configure Velero on Azure, you: Download an official release of Velero Create your Azure storage account and blob container Create Azure service principal for Velero Install the server If you do not have the `az` Azure CLI 2.0 installed locally, follow the to set it up. Run: ```bash az login ``` Ensure that the VMs for your agent pool allow Managed Disks. If I/O performance is critical, consider using Premium Managed Disks, which are SSD backed. Download the tarball for your client platform. _We strongly recommend that you use an of Velero. The tarballs for each release contain the `velero` command-line client. The code in the main branch of the Velero repository is under active development and is not guaranteed to be stable!_ Extract the tarball: ```bash tar -xvf <RELEASE-TARBALL-NAME>.tar.gz -C /dir/to/extract/to ``` We'll refer to the directory you extracted to as the "Velero directory" in subsequent steps. Move the `velero` binary from the Velero directory to somewhere in your PATH. Velero requires a storage account and blob container in which to store backups. The storage account can be created in the same Resource Group as your Kubernetes cluster or separated into its own Resource Group. The example below shows the storage account created in a separate `Velero_Backups` Resource Group. The storage account needs to be created with a globally unique id since this is used for dns. In the sample script below, we're generating a random name using `uuidgen`, but you can come up with this name however you'd like, following the . The storage account is created with encryption at rest capabilities (Microsoft managed keys) and is configured to only allow access via https. Create a resource group for the backups storage account. Change the location as needed. ```bash AZUREBACKUPRESOURCEGROUP=VeleroBackups az group create -n $AZUREBACKUPRESOURCE_GROUP --location WestUS ``` Create the storage account. ```bash AZURESTORAGEACCOUNT_ID="velero$(uuidgen | cut -d '-' -f5 | tr '[A-Z]' '[a-z]')" az storage account create \ --name $AZURESTORAGEACCOUNT_ID \ --resource-group $AZUREBACKUPRESOURCE_GROUP \ --sku Standard_GRS \ --encryption-services blob \ --https-only true \ --kind BlobStorage \ --access-tier Hot ``` Create the blob container named `velero`. Feel free to use a different name, preferably unique to a single Kubernetes cluster. See the for more

```bash BLOB_CONTAINER=velero az storage container create -n $BLOBCONTAINER --public-access off --account-name $AZURESTORAGEACCOUNTID ``` Set the name of the Resource Group that contains your Kubernetes cluster's virtual machines/disks. WARNING: If you're using , `AZURERESOURCEGROUP` must be set to the name of the auto-generated resource group that is created when you provision your cluster in Azure, since this is the resource group that contains your cluster's virtual machines/disks. ```bash AZURERESOURCEGROUP=<NAMEOFRESOURCE_GROUP> ``` If you are unsure of the Resource Group name, run the following command to get a list that you can select from. Then set the `AZURERESOURCEGROUP` environment variable to the appropriate value. ```bash az group list --query '[].{ ResourceGroup: name, Location:location }' ``` Get your cluster's Resource Group name from the `ResourceGroup` value in the response, and use it to set `$AZURERESOURCEGROUP`. To integrate Velero with Azure, you must create a Velero-specific . Obtain your Azure Account Subscription ID and Tenant ID: ```bash AZURESUBSCRIPTIONID=`az account list --query '[?isDefault].id' -o tsv` AZURETENANTID=`az account list --query '[?isDefault].tenantId' -o tsv` ``` Create a service principal with `Contributor` role. This will have subscription-wide access, so protect this credential. If you'll be using Velero to backup multiple clusters with multiple blob containers, it may be desirable to create a unique username per cluster rather than the default `velero`. Create service principal and let the CLI generate a password for you. Make sure to capture the password. ```bash AZURECLIENTSECRET=`az ad sp create-for-rbac --name "velero" --role "Contributor" --query 'password' -o tsv` ``` After creating the service principal, obtain the client id. ```bash AZURECLIENTID=`az ad sp list --display-name "velero" --query '[0].appId' -o tsv` ``` Now you need to create a file that contains all the environment variables you just set. The command looks like the following: ``` cat << EOF > ./credentials-velero AZURESUBSCRIPTIONID=${AZURESUBSCRIPTIONID} AZURETENANTID=${AZURETENANTID} AZURECLIENTID=${AZURECLIENTID} AZURECLIENTSECRET=${AZURECLIENTSECRET} AZURERESOURCEGROUP=${AZURERESOURCEGROUP} EOF ``` Install Velero, including all prerequisites, into the cluster and start the deployment. This will create a namespace called `velero`, and place a deployment named `velero` in it. ```bash velero install \ --provider azure \ --bucket $BLOB_CONTAINER \ --secret-file ./credentials-velero \ --backup-location-config resourceGroup=$AZUREBACKUPRESOURCEGROUP,storageAccount=$AZURESTORAGEACCOUNTID \ --snapshot-location-config apiTimeout=<YOUR_TIMEOUT> ``` Additionally, you can specify `--use-restic` to enable restic support, and `--wait` to wait for the deployment to be ready. (Optional) Specify for the `--backup-location-config` flag. (Optional) Specify for the `--snapshot-location-config` flag. (Optional) Specify for the Velero/restic pods. For more complex installation needs, use either the Helm chart, or add `--dry-run -o yaml` options for generating the YAML representation for the installation.