Project: K8up (Runtime / Cloud Native Storage)
File: slides.pdf

VSHN – The DevOps Company         
Adrian Kosmaczewski, Developer RelationsIntroduction to K8up
February 23rd, 2023
1VSHN – The DevOps Company  2VSHN – The DevOps Company  Répétez avec moi: /keɪtæpp/
3VSHN – The DevOps Company  4VSHN – The DevOps Company  Backup as a ServiceBaaS
5VSHN – The DevOps Company  A Backup Operator for Kubernetes & OpenShift
Used internally at VSHN since 2018
Uses  under the hood
Current version: 2.5.3 (February 17th, 2023)
k8up.io and github.com/k8up-ioWhat is K8up?
restic
6VSHN – The DevOps Company  K8up is a CNCF Sandbox project since November 2021
7VSHN – The DevOps Company  Any S3-compatible backend
Any restic-compatible backendWhere does it store backups?
8VSHN – The DevOps Company  K8up backs all PVCs in the same namespace
1. Create backup credentials
2. Trigger a backup or set up a backup schedule
3. No step 3!How does it work?
9VSHN – The DevOps Company  1Annotation required for K8up1. PVC Resource
kind: PersistentVolumeClaim 
apiVersion: v1 
metadata: 
  name: app-data 
  labels: 
    app.kubernetes.io/name: demo-app 
  annotations: 
    k8up.io/backup: "true"  
spec: 
  accessModes: 
    - ReadWriteOnce 
  resources: 
    requests: 
      storage: "1Gi"1
10VSHN – The DevOps Company  1A really secure password!2. Backup Credentials
apiVersion: v1 
kind: Secret 
metadata: 
  name: backup-repo 
type: Opaque 
stringData: 
  password: p@ssw0rd 1
11VSHN – The DevOps Company  1A backup every minute!apiVersion: k8up.io/v1 
kind: Schedule 
metadata: 
  name: schedule-test 
spec: 
  failedJobsHistoryLimit: 2 
  successfulJobsHistoryLimit: 2 
  backend: 
    repoPasswordSecretRef: 
      name: backup-repo 
      key: password 
    s3: 
      endpoint: https://sos-ch-gva-2.exo.io 
      bucket: my-bucket-change-name 
      accessKeyIDSecretRef: 
        name: objectbucket-creds 
        key: AWS_ACCESS_KEY_ID 
      secretAccessKeySecretRef: 
        name: objectbucket-creds 
        key: AWS_SECRET_ACCESS_KEY 
  backup: 
    schedule: '*/1 * * * *'  
    failedJobsHistoryLimit: 2 
    successfulJobsHistoryLimit: 21
12VSHN – The DevOps Company  Backend Object
  backend: 
    repoPasswordSecretRef: 
      name: backup-repo 
      key: password 
    s3: 
      endpoint: https://sos-ch-gva-2.exo.io 
      bucket: my-bucket-change-name 
      accessKeyIDSecretRef: 
        name: objectbucket-creds 
        key: AWS_ACCESS_KEY_ID 
      secretAccessKeySecretRef: 
        name: objectbucket-creds 
        key: AWS_SECRET_ACCESS_KEY
13VSHN – The DevOps Company  
t w i t t e r . c o m / n i x c r a f t / s t a t u s / 6 1 3 6 3 6 5 2 8 4 3 9 3 4 5 1 5 2
14VSHN – The DevOps Company  1PVC where the restoration takes placeRestore
apiVersion: k8up.io/v1 
kind: Restore 
metadata: 
  name: restore-wordpress 
spec: 
  snapshot: SNAPSHOT_ID 
  restoreMethod: 
    folder: 
      claimName: wordpress-pvc  
  backend: 
    repoPasswordSecretRef: 
      name: backup-repo 
      key: password 
    s3: 
      endpoint: https://sos-ch-gva-2.exo.io 
      bucket: my-bucket-change-name 
      accessKeyIDSecretRef: 
        name: objectbucket-creds 
        key: AWS_ACCESS_KEY_ID 
      secretAccessKeySecretRef: 
        name: objectbucket-creds 
        key: AWS_SECRET_ACCESS_KEY1
15VSHN – The DevOps Company  Manual Restore via restic
$ export RESTIC_REPOSITORY=s3:http://location/of/the/backup 
$ export RESTIC_PASSWORD=p@assword 
$ export AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
$ export AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 
 
$ restic snapshots 
repository dec6d66c opened successfully, password is correct 
ID        Date                 Host                Tags        Directory 
---------------------------------------------------------------------- 
5ed64a2d  2018-06-08 09:18:34  macbook-vshn.local              /data 
---------------------------------------------------------------------- 
1 snapshots 
 
$ restic restore 5ed64a2d --target /restore
16VSHN – The DevOps Company  Pre-Backup Pods
apiVersion: k8up.io/v1 
kind: PreBackupPod 
metadata: 
  name: mysqldump 
spec: 
  backupCommand: sh -c 'mysqldump -u$USER -p$PW -h $DB_HOST --all-databases' 
  pod: 
    spec: 
      containers: 
        - env: 
            - name: USER 
              value: dumper 
            - name: PW 
              value: topsecret 
            - name: DB_HOST 
              value: mariadb.example.com 
          image: mariadb 
          command: 
            - 'sleep' 
            - 'infinity' 
          imagePullPolicy: Always 
          name: mysqldump
17VSHN – The DevOps Company  Demo!
18VSHN – The DevOps Company  Backup of all PVCs in the same namespace as the Schedule object
"Application-Aware" backups
Backup of data piped through stdin
Regularly checks for data sanity using restic check
Archive feature on a dedicated location (for example AWS Glacier)
Default backup mechanism on APPUiO CloudOther Features
19VSHN – The DevOps Company  20VSHN – The DevOps Company  Annotation-Aware Backups
--- 
# … 
template: 
  metadata: 
    labels: 
      app: mariadb 
    annotations: 
      appuio.ch/backupcommand: mysqldump -uroot -psecure --all-databases 
# … 
---
21VSHN – The DevOps Company  Backup of RWO storage
Already in 2.6.0-rc2, released today!
k8up CLI
Better visibility of backups
List available snapshots directly in Kubernetes
Usability improvements
Specify in which container to run backup commandsRoadmap
22VSHN – The DevOps Company  Your favorite IDE (with a Go plugin)
Docker
make
KindHow to Contribute?
github.com/vshn/k8up
Go
23VSHN – The DevOps Company  Adrian Kosmaczewski, Developer Relations – 
VSHN AG – Neugasse 10 – CH-8005 Zürich – +41 44 545 53 00 –  – Thanks!
adrian@vshn.ch
vshn.chinfo@vshn.ch
24