Velero for Kubernetes cluster backup
By: Satish Balakrishnan
Tags: Containers, Backup, Kubernetes, Velero, DevOps

I have been working with dev and test clusters on Kubernetes and hence never really felt the need for a comprehensive back and restore solution mainly because I was just running stateless workloads. In my earlier post, I wrote about katafygio which does a good job for test or dev clusters and is quite easy to set up but backs up the configuration in Github.

Open-sourced Velero is the most popular choice when it comes to Kubernetes backup and restores. It was formerly known as Heptio Ark. You can run Velero on AWS, GCP or Azure and also on-premises. Velero enables you to

Take a backup of your cluster Restore from a backup Migrate a cluster Replicate a cluster

The good thing about Velero is setting it up and operationalizing it is very easy and doesn't take long. I did a quick setup on my AWS where I already have a minikube running on an elastic cloud compute (EC2).

Download Velero

Download the latest release’s tarball for your client platform



$ tar -xvf velero-v1.5.2-linux-amd64.tar.gz -C /tmp

$ sudo mv /tmp/velero-v1.5.2-linux-amd64/velero /usr/local/bin $ wget https://github.com/vmware-tanzu/velero/releases/download/v1.5.2/velero-v1.5.2-linux-amd64.tar.gz $ tar -xvf velero-v1.5.2-linux-amd64.tar.gz -C /tmp$ sudo mv /tmp/velero-v1.5.2-linux-amd64/velero /usr/local/bin

Now that you have installed Velero on your system, check if it works alright.

$ velero version

Although it shows the version, you would probably see an error as well but that is ok. You get this error as we have not installed Velero in your Kubernetes cluster yet. Before we do that let us create a IAM user and S3 bucket.

Create S3 bucket

You can create this bucket via the console or using the command line. I am creating the bucket in us-west-2 region.

$ aws s3 mb s3://velero-test-hpe-bucket --region us-west-2 $ aws s3api put-public-access-block --bucket velero-test-hpe-bucket \ --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true" \ --region us-west-2

Create IAM user

Create an IAM policy using the below gist and call it velero-policy.json

It is always good to create an IAM user for Velero. Once you create it, assign the above policy to it as well.

$ aws iam create-user --user-name velero

$ aws iam put-user-policy \

--user-name velero \

--policy-name velero \

--policy-document file://velero-policy.json

Velero user needs to have programmatic access to AWS services (S3). You can enable programmatic access for velero user by running the following command.

$ aws iam create-access-key --user-name velero output:

(Note down the AccessKeyId and SecretAccessKey) "AccessKey": {

"UserName": "velero",

"AccessKeyId": "AK45AFSEFHDYNYGL6TH",

"Status": "Active",

"SecretAccessKey": "mOUuV7Lz17P9IndfdfdsfJIOSJJ0ZJ0iNdAB3nOe4D",

"CreateDate": "2020-12-16T03:29:22Z"

}

}

Install Velero in your cluster

Create a secrets file called ‘velero-credentials’ and paste the AccessKeyId and SecretAccessKey. It should look like below. For those of you who try to use the below credentials to gain access to my account, the user has been deleted :).

[default]

aws_access_key_id=AK45AFSEFHDYNYGL6TH

aws_secret_access_key=mOUuV7Lz17P9IndfdfdsfJIOSJJ0ZJ0iNdAB3nOe4D

All the velero resources will be created in a namespace called velero.

$ velero install \

--provider aws \

--plugins velero/velero-plugin-for-aws:v1.0.1 \

--bucket velero-test-hpe-bucket \

--backup-location-config region=us-west-2 \

--snapshot-location-config region=us-west-2 \

--secret-file ./velero-credentials

That is it, Velero is installed. To check just run the following command and you should see output as shown in the image.

$ kubectl get all -n velero

Using Velero

Let’s create a new namespace and deploy an application in that namespace. You could deploy an application that you want to, those steps are not covered in this post. Create a namespace called ‘staging’ and deploy the application within the staging namespace



$ kubectl create namespace staging

To Backup using Velero

$ velero backup create staging-backup --include-namespaces staging $ velero backup describe staging-backup

Now let's assume that the namespace gets deleted and you want to restore it using velero.

$ kubectl delete namespace staging

$ velero restore create --from-backup staging-backup

$ velero restore get

For more comprehensive use cases please refer to Velero docs @ https://velero.io/docs/v1.5/