Project: Velero (Runtime / Cloud Native Storage)
File: aws-config.md

title: "Run Velero on AWS" layout: docs To set up Velero on AWS, you: Download an official release of Velero Create your S3 bucket Create an AWS IAM user for Velero Install the server If you do not have the `aws` CLI locally installed, follow the to set it up. Download the tarball for your client platform. _We strongly recommend that you use an of Velero. The tarballs for each release contain the `velero` command-line client. The code in the main branch of the Velero repository is under active development and is not guaranteed to be stable!_ Extract the tarball: ``` tar -xvf <RELEASE-TARBALL-NAME>.tar.gz -C /dir/to/extract/to ``` We'll refer to the directory you extracted to as the "Velero directory" in subsequent steps. Move the `velero` binary from the Velero directory to somewhere in your PATH. Velero requires an object storage bucket to store backups in, preferably unique to a single Kubernetes cluster (see the for more details). Create an S3 bucket, replacing placeholders appropriately: ```bash BUCKET=<YOUR_BUCKET> REGION=<YOUR_REGION> aws s3api create-bucket \ --bucket $BUCKET \ --region $REGION \ --create-bucket-configuration LocationConstraint=$REGION ``` NOTE: us-east-1 does not support a `LocationConstraint`. If your region is `us-east-1`, omit the bucket configuration: ```bash aws s3api create-bucket \ --bucket $BUCKET \ --region us-east-1 ``` For more information, see . Create the IAM user: ```bash aws iam create-user --user-name velero ``` If you'll be using Velero to backup multiple clusters with multiple S3 buckets, it may be desirable to create a unique username per cluster rather than the default `velero`. Attach policies to give `velero` the necessary permissions: ``` cat > velero-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateSnapshot", "ec2:DeleteSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:DeleteObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::${BUCKET}/*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${BUCKET}" ] } ] } EOF ``` ```bash aws iam put-user-policy \ --user-name velero \ --policy-name velero \ --policy-document file://velero-policy.json ``` Create an access key for the user: ```bash aws iam create-access-key --user-name velero ``` The result should look like: ```json { "AccessKey": { "UserName": "velero", "Status": "Active", "CreateDate": "2017-07-31T22:24:41.576Z", "SecretAccessKey": <AWSSECRETACCESS_KEY>, "AccessKeyId": <AWSACCESSKEY_ID> } } ``` Create a Velero-specific credentials file (`credentials-velero`) in your local directory: ```bash [default] awsaccesskeyid=<AWSACCESSKEYID> awssecretaccesskey=<AWSSECRETACCESSKEY> ``` where the access key id and secret are the values returned from the `create-access-key` request. Install Velero, including all prerequisites, into the cluster and start the deployment. This will create a namespace called `velero`, and place a deployment named `velero` in it. ```bash velero install \ --provider aws \ --bucket $BUCKET \ --secret-file ./credentials-velero \ --backup-location-config region=$REGION \ --snapshot-location-config region=$REGION ``` Additionally, you can specify `--use-restic` to enable restic support, and `--wait` to wait for the deployment to be ready. (Optional) Specify for the `--backup-location-config` flag. (Optional) Specify for the `--snapshot-location-config`

(Optional) Specify for the Velero/restic pods. For more complex installation needs, use either the Helm chart, or add `--dry-run -o yaml` options for generating the YAML representation for the installation. If you have multiple clusters and you want to support migration of resources between them, you can use `kubectl edit deploy/velero -n velero` to edit your deployment: Add the environment variable `AWSCLUSTERNAME` under `spec.template.spec.env`, with the current cluster's name. When restoring backup, it will make Velero (and cluster it's running on) claim ownership of AWS volumes created from snapshots taken on different cluster. The best way to get the current cluster's name is to either check it with used deployment tool or to read it directly from the EC2 instances tags. The following listing shows how to get the cluster's nodes EC2 Tags. First, get the nodes external IDs (EC2 IDs): ```bash kubectl get nodes -o jsonpath='{.items[*].spec.externalID}' ``` Copy one of the returned IDs `<ID>` and use it with the `aws` CLI tool to search for one of the following: The `kubernetes.io/cluster/<AWSCLUSTERNAME>` tag of the value `owned`. The `<AWSCLUSTERNAME>` is then your cluster's name: ```bash aws ec2 describe-tags --filters "Name=resource-id,Values=<ID>" "Name=value,Values=owned" ``` If the first output returns nothing, then check for the legacy Tag `KubernetesCluster` of the value `<AWSCLUSTERNAME>`: ```bash aws ec2 describe-tags --filters "Name=resource-id,Values=<ID>" "Name=key,Values=KubernetesCluster" ``` is a Kubernetes application that allows managing AWS IAM permissions for pod via annotations rather than operating on API keys. This path assumes you have `kube2iam` already running in your Kubernetes cluster. If that is not the case, please install it first, following the docs here: It can be set up for Velero by creating a role that will have required permissions, and later by adding the permissions annotation on the velero deployment to define which role it should use internally. Create a Trust Policy document to allow the role being used for EC2 management & assume kube2iam role: ``` cat > velero-trust-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<AWSACCOUNTID>:role/<ROLECREATEDWHENINITIALIZINGKUBE2IAM>" }, "Action": "sts:AssumeRole" } ] } EOF ``` Create the IAM role: ```bash aws iam create-role --role-name velero --assume-role-policy-document file://./velero-trust-policy.json ``` Attach policies to give `velero` the necessary permissions: ``` BUCKET=<YOUR_BUCKET> cat > velero-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:CreateTags", "ec2:CreateVolume", "ec2:CreateSnapshot", "ec2:DeleteSnapshot" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:DeleteObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::${BUCKET}/*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::${BUCKET}" ] } ] } EOF ``` ```bash aws iam put-role-policy \ --role-name velero \ --policy-name velero-policy \ --policy-document file://./velero-policy.json ``` Use the `--pod-annotations` argument on `velero install` to add the following annotation: ```bash velero install \ --pod-annotations iam.amazonaws.com/role=arn:aws:iam::<AWSACCOUNTID>:role/<VELEROROLENAME> \ --provider aws \ --bucket $BUCKET \ --backup-location-config region=$REGION \ --snapshot-location-config region=$REGION \ --no-secret ```