Backup and restore

1. Create a workload to back up by running the following commands:

   $ oc create namespace hello-world

   $ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift

2. Expose the route by running the following command:

   $ oc expose service/hello-openshift -n hello-world

3. Check that the application is working by running the following command:

   $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

   Example output

   Hello OpenShift!

4. Back up the workload by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Backup
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       includedNamespaces:
       - hello-world
       storageLocation: ${CLUSTER_NAME}-dpa-1
       ttl: 720h0m0s
   EOF

5. Wait until the backup is completed and then run the following command:

   $ watch "oc -n openshift-adp get backup hello-world -o json | jq .status"

   Example output

   {
     "completionTimestamp": "2022-09-07T22:20:44Z",
     "expiration": "2022-10-07T22:20:22Z",
     "formatVersion": "1.1.0",
     "phase": "Completed",
     "progress": {
       "itemsBackedUp": 58,
       "totalItems": 58
     },
     "startTimestamp": "2022-09-07T22:20:22Z",
     "version": 1
   }

6. Delete the demo workload by running the following command:

   $ oc delete ns hello-world

7. Restore the workload from the backup by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Restore
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       backupName: hello-world
   EOF

8. Wait for the Restore to finish by running the following command:

   $ watch "oc -n openshift-adp get restore hello-world -o json | jq .status"

   Example output

   {
     "completionTimestamp": "2022-09-07T22:25:47Z",
     "phase": "Completed",
     "progress": {
       "itemsRestored": 38,
       "totalItems": 38
     },
     "startTimestamp": "2022-09-07T22:25:28Z",
     "warnings": 9
   }

9. Check that the workload is restored by running the following command:

   $ oc -n hello-world get pods

   Example output

   NAME                              READY   STATUS    RESTARTS   AGE
   hello-openshift-9f885f7c6-kdjpj   1/1     Running   0          90s

10. Check the JSONPath by running the following command:

    $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

    Example output

    Hello OpenShift!

Procedure

1. Delete the workload by running the following command:

   $ oc delete ns hello-world

2. Delete the Data Protection Application (DPA) by running the following command:

   $ oc -n openshift-adp delete dpa ${CLUSTER_NAME}-dpa

3. Delete the cloud storage by running the following command:

   $ oc -n openshift-adp delete cloudstorage ${CLUSTER_NAME}-oadp

   Warning

   If this command hangs, you might need to delete the finalizer by running the following command:

   $ oc -n openshift-adp patch cloudstorage ${CLUSTER_NAME}-oadp -p '{"metadata":{"finalizers":null}}' --type=merge

4. If the Operator is no longer required, remove it by running the following command:

   $ oc -n openshift-adp delete subscription oadp-operator

5. Remove the namespace from the Operator:

   $ oc delete ns openshift-adp

6. If the backup and restore resources are no longer required, remove them from the cluster by running the following command:

   $ oc delete backups.velero.io hello-world

7. To delete backup, restore and remote objects in AWS S3 run the following command:

   $ velero backup delete hello-world

8. If you no longer need the Custom Resource Definitions (CRD), remove them from the cluster by running the following command:

   $ for CRD in `oc get crds | grep velero | awk '{print $1}'`; do oc delete crd $CRD; done

9. Delete the AWS S3 bucket by running the following commands:

   $ aws s3 rm s3://${CLUSTER_NAME}-oadp --recursive

   $ aws s3api delete-bucket --bucket ${CLUSTER_NAME}-oadp

10. Detach the policy from the role by running the following command:

    $ aws iam detach-role-policy --role-name "${ROLE_NAME}"  --policy-arn "${POLICY_ARN}"

11. Delete the role by running the following command:

    $ aws iam delete-role --role-name "${ROLE_NAME}"

Procedure

1. Create a restore CR as shown in the following example:

   Example restore CR

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: test-restore 1
     namespace: openshift-adp
   spec:
     backupName: <backup_name> 2
     restorePVs: true
     namespaceMapping:
       <application_namespace>: test-restore-application 3

   1

   The name of the restore CR.

   2

   Specify the name of the backup.

   3

   namespaceMapping maps the source application namespace to the target application namespace. Specify the application namespace that you backed up. test-restore-application is the target namespace where you want to restore the backup.

2. Apply the restore CR by running the following command:

   $ oc apply -f <restore_cr_filename>

Verification

1. Verify that the restore is in the Completed phase by running the following command:

   $ oc describe restores.velero.io <restore_name> -n openshift-adp

2. Change to the restored namespace test-restore-application by running the following command:

   $ oc project test-restore-application

3. Verify the restored resources such as persistent volume claim (pvc), service (svc), deployment, secret, and config map by running the following command:

   $ oc get pvc,svc,deployment,secret,configmap

   Example output

   NAME                          STATUS   VOLUME
   persistentvolumeclaim/mysql   Bound    pvc-9b3583db-...-14b86
   
   NAME               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   service/mysql      ClusterIP   172....157     <none>        3306/TCP   2m56s
   service/todolist   ClusterIP   172.....15     <none>        8000/TCP   2m56s
   
   NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/mysql   0/1     1            0           2m55s
   
   NAME                                         TYPE                      DATA   AGE
   secret/builder-dockercfg-6bfmd               kubernetes.io/dockercfg   1      2m57s
   secret/default-dockercfg-hz9kz               kubernetes.io/dockercfg   1      2m57s
   secret/deployer-dockercfg-86cvd              kubernetes.io/dockercfg   1      2m57s
   secret/mysql-persistent-sa-dockercfg-rgp9b   kubernetes.io/dockercfg   1      2m57s
   
   NAME                                 DATA   AGE
   configmap/kube-root-ca.crt           1      2m57s
   configmap/openshift-service-ca.crt   1      2m57s

Procedure

1. Create the following environment variables by running the following commands:

   Important

   Change the cluster name to match your ROSA cluster, and ensure you are logged into the cluster as an administrator. Ensure that all fields are outputted correctly before continuing.

   $ export CLUSTER_NAME=my-cluster 1
     export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)
     export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
     export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
     export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
     export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')
     export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
     export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
     mkdir -p ${SCRATCH}
     echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
     ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"

   1

   Replace my-cluster with your ROSA cluster name.

2. On the AWS account, create an IAM policy to allow access to AWS S3:

   1. Check to see if the policy exists by running the following command:

      $ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaOadpVer1'].{ARN:Arn}" --output text) 1

      1

      Replace RosaOadp with your policy name.

   2. Enter the following command to create the policy JSON file and then create the policy in ROSA:

      Note

      If the policy ARN is not found, the command creates the policy. If the policy ARN already exists, the if statement intentionally skips the policy creation.

      $ if [[ -z "${POLICY_ARN}" ]]; then
        cat << EOF > ${SCRATCH}/policy.json 1
        {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "s3:CreateBucket",
              "s3:DeleteBucket",
              "s3:PutBucketTagging",
              "s3:GetBucketTagging",
              "s3:PutEncryptionConfiguration",
              "s3:GetEncryptionConfiguration",
              "s3:PutLifecycleConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject",
              "s3:ListBucketMultipartUploads",
              "s3:AbortMultipartUpload",
              "s3:ListMultipartUploadParts",
              "ec2:DescribeSnapshots",
              "ec2:DescribeVolumes",
              "ec2:DescribeVolumeAttribute",
              "ec2:DescribeVolumesModifications",
              "ec2:DescribeVolumeStatus",
              "ec2:CreateTags",
              "ec2:CreateVolume",
              "ec2:CreateSnapshot",
              "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
          }
        ]}
      EOF
      
        POLICY_ARN=$(aws iam create-policy --policy-name "RosaOadpVer1" \
        --policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
        --tags Key=rosa_openshift_version,Value=${CLUSTER_VERSION} Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-oadp Key=operator_name,Value=openshift-oadp \
        --output text)
        fi

      1

      SCRATCH is a name for a temporary directory created for the environment variables.

   3. View the policy ARN by running the following command:

      $ echo ${POLICY_ARN}

3. Create an IAM role trust policy for the cluster:

   1. Create the trust policy file by running the following command:

      $ cat <<EOF > ${SCRATCH}/trust-policy.json
        {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDC_ENDPOINT}:sub": [
                    "system:serviceaccount:openshift-adp:openshift-adp-controller-manager",
                    "system:serviceaccount:openshift-adp:velero"]
                }
              }
            }]
        }
      EOF

   2. Create the role by running the following command:

      $ ROLE_ARN=$(aws iam create-role --role-name \
        "${ROLE_NAME}" \
        --assume-role-policy-document file://${SCRATCH}/trust-policy.json \
        --tags Key=rosa_cluster_id,Value=${ROSA_CLUSTER_ID} \
               Key=rosa_openshift_version,Value=${CLUSTER_VERSION} \
               Key=rosa_role_prefix,Value=ManagedOpenShift \
               Key=operator_namespace,Value=openshift-adp \
               Key=operator_name,Value=openshift-oadp \
        --query Role.Arn --output text)

   3. View the role ARN by running the following command:

      $ echo ${ROLE_ARN}

4. Attach the IAM policy to the IAM role by running the following command:

   $ aws iam attach-role-policy --role-name "${ROLE_NAME}" \
     --policy-arn ${POLICY_ARN}

Procedure

1. Create an Red Hat OpenShift Service on AWS secret from your AWS token file by entering the following commands:

   1. Create the credentials file:

      $ cat <<EOF > ${SCRATCH}/credentials
        [default]
        role_arn = ${ROLE_ARN}
        web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
        region = <aws_region> 1
      EOF

      1

      Replace <aws_region> with the AWS region to use for the STS endpoint.

   2. Create a namespace for OADP:

      $ oc create namespace openshift-adp

   3. Create the Red Hat OpenShift Service on AWS secret:

      $ oc -n openshift-adp create secret generic cloud-credentials \
        --from-file=${SCRATCH}/credentials

      Note

      In Red Hat OpenShift Service on AWS versions 4.15 and later, the OADP Operator supports a new standardized STS workflow through the Operator Lifecycle Manager (OLM) and Cloud Credentials Operator (CCO). In this workflow, you do not need to create the above secret, you only need to supply the role ARN during the installation of OLM-managed operators using the Red Hat OpenShift Service on AWS web console, for more information see Installing from OperatorHub using the web console.

      The preceding secret is created automatically by CCO.

2. Install the OADP Operator:

   1. In the Red Hat OpenShift Service on AWS web console, browse to Operators → OperatorHub.
   2. Search for the OADP Operator.
   3. In the role_ARN field, paste the role_arn that you created previously and click Install.

3. Create AWS cloud storage using your AWS credentials by entering the following command:

   $ cat << EOF | oc create -f -
     apiVersion: oadp.openshift.io/v1alpha1
     kind: CloudStorage
     metadata:
       name: ${CLUSTER_NAME}-oadp
       namespace: openshift-adp
     spec:
       creationSecret:
         key: credentials
         name: cloud-credentials
       enableSharedConfig: true
       name: ${CLUSTER_NAME}-oadp
       provider: aws
       region: $REGION
   EOF

4. Check your application’s storage default storage class by entering the following command:

   $ oc get pvc -n <namespace>

   Example output

   NAME     STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
   applog   Bound    pvc-351791ae-b6ab-4e8b-88a4-30f73caf5ef8   1Gi        RWO            gp3-csi        4d19h
   mysql    Bound    pvc-16b8e009-a20a-4379-accc-bc81fedd0621   1Gi        RWO            gp3-csi        4d19h

5. Get the storage class by running the following command:

   $ oc get storageclass

   Example output

   NAME                PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
   gp2                 kubernetes.io/aws-ebs   Delete          WaitForFirstConsumer   true                   4d21h
   gp2-csi             ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3                 ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3-csi (default)   ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h

   Note

   The following storage classes will work:

   • gp3-csi
   • gp2-csi
   • gp3
   • gp2

   If the application or applications that are being backed up are all using persistent volumes (PVs) with Container Storage Interface (CSI), it is advisable to include the CSI plugin in the OADP DPA configuration.

6. Create the DataProtectionApplication resource to configure the connection to the storage where the backups and volume snapshots are stored:

   1. If you are using only CSI volumes, deploy a Data Protection Application by entering the following command:

      $ cat << EOF | oc create -f -
        apiVersion: oadp.openshift.io/v1alpha1
        kind: DataProtectionApplication
        metadata:
          name: ${CLUSTER_NAME}-dpa
          namespace: openshift-adp
        spec:
          backupImages: true 1
          features:
            dataMover:
              enable: false
          backupLocations:
          - bucket:
              cloudStorageRef:
                name: ${CLUSTER_NAME}-oadp
              credential:
                key: credentials
                name: cloud-credentials
              prefix: velero
              default: true
              config:
                region: ${REGION}
          configuration:
            velero:
              defaultPlugins:
              - openshift
              - aws
              - csi
            nodeAgent:  2
              enable: false
              uploaderType: kopia 3
      EOF

      1

      ROSA supports internal image backup. Set this field to false if you do not want to use image backup.

      2

      See the important note regarding the nodeAgent attribute.

      3

      The type of uploader. The possible values are restic or kopia. The built-in Data Mover uses Kopia as the default uploader mechanism regardless of the value of the uploaderType field.

1. If you are using CSI or non-CSI volumes, deploy a Data Protection Application by entering the following command:

   $ cat << EOF | oc create -f -
     apiVersion: oadp.openshift.io/v1alpha1
     kind: DataProtectionApplication
     metadata:
       name: ${CLUSTER_NAME}-dpa
       namespace: openshift-adp
     spec:
       backupImages: true 1
       backupLocations:
       - bucket:
           cloudStorageRef:
             name: ${CLUSTER_NAME}-oadp
           credential:
             key: credentials
             name: cloud-credentials
           prefix: velero
           default: true
           config:
             region: ${REGION}
       configuration:
         velero:
           defaultPlugins:
           - openshift
           - aws
         nodeAgent: 2
           enable: false
           uploaderType: restic
       snapshotLocations:
         - velero:
             config:
               credentialsFile: /tmp/credentials/openshift-adp/cloud-credentials-credentials 3
               enableSharedConfig: "true" 4
               profile: default 5
               region: ${REGION} 6
             provider: aws
   EOF

   1

   ROSA supports internal image backup. Set this field to false if you do not want to use image backup.

   2

   See the important note regarding the nodeAgent attribute.

   3

   The credentialsFile field is the mounted location of the bucket credential on the pod.

   4

   The enableSharedConfig field allows the snapshotLocations to share or reuse the credential defined for the bucket.

   5

   Use the profile name set in the AWS credentials file.

   6

   Specify region as your AWS region. This must be the same as the cluster region.

   You are now ready to back up and restore Red Hat OpenShift Service on AWS applications, as described in Backing up applications.

Procedure

1. To verify that the OADP subscription has the wrong IAM role ARN environment variable set, run the following command:

   $ oc get sub -o yaml redhat-oadp-operator

   Example subscription

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     annotations:
     creationTimestamp: "2025-01-15T07:18:31Z"
     generation: 1
     labels:
       operators.coreos.com/redhat-oadp-operator.openshift-adp: ""
     name: redhat-oadp-operator
     namespace: openshift-adp
     resourceVersion: "77363"
     uid: 5ba00906-5ad2-4476-ae7b-ffa90986283d
   spec:
     channel: stable-1.4
     config:
       env:
       - name: ROLEARN
         value: arn:aws:iam::11111111:role/wrong-role-arn 1
     installPlanApproval: Manual
     name: redhat-oadp-operator
     source: prestage-operators
     sourceNamespace: openshift-marketplace
     startingCSV: oadp-operator.v1.4.2

   1

   Verify the value of ROLEARN you want to update.

2. Update the ROLEARN field of the subscription with the correct role ARN by running the following command:

   $ oc patch subscription redhat-oadp-operator -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "<role_arn>"}]}}}' --type='merge'

   where:

   <role_arn>

   Specifies the IAM role ARN to be updated. For example, arn:aws:iam::160…​..6956:role/oadprosa…​..8wlf.

3. Verify that the secret object is updated with correct role ARN value by running the following command:

   $ oc get secret cloud-credentials -o jsonpath='{.data.credentials}' | base64 -d

   Example output

   [default]
   sts_regional_endpoints = regional
   role_arn = arn:aws:iam::160.....6956:role/oadprosa.....8wlf
   web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

4. Configure the DataProtectionApplication custom resource (CR) manifest file as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: test-rosa-dpa
     namespace: openshift-adp
   spec:
     backupLocations:
     - bucket:
         config:
           region: us-east-1
         cloudStorageRef:
           name: <cloud_storage> 1
         credential:
           name: cloud-credentials
           key: credentials
         prefix: velero
         default: true
     configuration:
       velero:
         defaultPlugins:
         - aws
         - openshift

   1

   Specify the CloudStorage CR.

5. Create the DataProtectionApplication CR by running the following command:

   $ oc create -f <dpa_manifest_file>

6. Verify that the DataProtectionApplication CR is reconciled and the status is set to "True" by running the following command:

   $  oc get dpa -n openshift-adp -o yaml

   Example DataProtectionApplication

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   ...
   status:
       conditions:
       - lastTransitionTime: "2023-07-31T04:48:12Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled

7. Verify that the BackupStorageLocation CR is in an available state by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example BackupStorageLocation

   NAME       PHASE       LAST VALIDATED   AGE   DEFAULT
   ts-dpa-1   Available   3s               6s    true

Procedure

1. To preview the resources included in the backup before running the actual backup, run the following command:

   $ velero backup create <backup-name> --snapshot-volumes false 1

   1

   Specify the value of --snapshot-volumes parameter as false.

2. To know more details about the backup resources, run the following command:

   $ velero describe backup <backup_name> --details 1

   1

   Specify the name of the backup.

3. To preview the resources included in the restore before running the actual restore, run the following command:

   $ velero restore create --from-backup <backup-name> 1

   1

   Specify the name of the backup created to review the backup resources.

   Important

   The velero restore create command creates restore resources in the cluster. You must delete the resources created as part of the restore, after you review the resources.

4. To know more details about the restore resources, run the following command:

   $ velero describe restore <restore_name> --details 1

   1

   Specify the name of the restore.

Procedure

1. Create a DeleteBackupRequest CR manifest file:

   apiVersion: velero.io/v1
   kind: DeleteBackupRequest
   metadata:
     name: deletebackuprequest
     namespace: openshift-adp
   spec:
     backupName: <backup_name> 1

   1

   Specify the name of the backup.

2. Apply the DeleteBackupRequest CR to delete the backup:

   $ oc apply -f <deletebackuprequest_cr_filename>

Procedure

1. To get the name of the backup repository CR for a backup, run the following command:

   $ oc get backuprepositories.velero.io -n openshift-adp

2. To delete the backup repository CR, run the following command:

   $ oc delete backuprepository <backup_repository_name> -n openshift-adp 1

   1

   Specify the name of the backup repository from the earlier step.

Procedure

1. To preview the resources included in the backup before running the actual backup, run the following command:

   $ velero backup create <backup-name> --snapshot-volumes false 1

   1

   Specify the value of --snapshot-volumes parameter as false.

2. To know more details about the backup resources, run the following command:

   $ velero describe backup <backup_name> --details 1

   1

   Specify the name of the backup.

3. To preview the resources included in the restore before running the actual restore, run the following command:

   $ velero restore create --from-backup <backup-name> 1

   1

   Specify the name of the backup created to review the backup resources.

   Important

   The velero restore create command creates restore resources in the cluster. You must delete the resources created as part of the restore, after you review the resources.

4. To know more details about the restore resources, run the following command:

   $ velero describe restore <restore_name> --details 1

   1

   Specify the name of the restore.

Procedure

1. Create a Restore CR, as in the following example:

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: <restore>
     namespace: openshift-adp
   spec:
     backupName: <backup> 1
     includedResources: [] 2
     excludedResources:
     - nodes
     - events
     - events.events.k8s.io
     - backups.velero.io
     - restores.velero.io
     - resticrepositories.velero.io
     restorePVs: true 3

   1

   Name of the Backup CR.

   2

   Optional: Specify an array of resources to include in the restore process. Resources might be shortcuts (for example, po for pods) or fully-qualified. If unspecified, all resources are included.

   3

   Optional: The restorePVs parameter can be set to false to turn off restore of PersistentVolumes from VolumeSnapshot of Container Storage Interface (CSI) snapshots or from native snapshots when VolumeSnapshotLocation is configured.

2. Verify that the status of the Restore CR is Completed by entering the following command:

   $ oc get restores.velero.io -n openshift-adp <restore> -o jsonpath='{.status.phase}'

3. Verify that the backup resources have been restored by entering the following command:

   $ oc get all -n <namespace> 1

   1

   Namespace that you backed up.

4. If you restore DeploymentConfig with volumes or if you use post-restore hooks, run the dc-post-restore.sh cleanup script by entering the following command:

   $ bash dc-restic-post-restore.sh -> dc-post-restore.sh

   Note

   During the restore process, the OADP Velero plug-ins scale down the DeploymentConfig objects and restore the pods as standalone pods. This is done to prevent the cluster from deleting the restored DeploymentConfig pods immediately on restore and to allow the restore and post-restore hooks to complete their actions on the restored pods. The cleanup script shown below removes these disconnected pods and scales any DeploymentConfig objects back up to the appropriate number of replicas.

   Example 1.1. dc-restic-post-restore.sh → dc-post-restore.sh cleanup script

   #!/bin/bash
   set -e
   
   # if sha256sum exists, use it to check the integrity of the file
   if command -v sha256sum >/dev/null 2>&1; then
     CHECKSUM_CMD="sha256sum"
   else
     CHECKSUM_CMD="shasum -a 256"
   fi
   
   label_name () {
       if [ "${#1}" -le "63" ]; then
   	echo $1
   	return
       fi
       sha=$(echo -n $1|$CHECKSUM_CMD)
       echo "${1:0:57}${sha:0:6}"
   }
   
   if [[ $# -ne 1 ]]; then
       echo "usage: ${BASH_SOURCE} restore-name"
       exit 1
   fi
   
   echo "restore: $1"
   
   label=$(label_name $1)
   echo "label:   $label"
   
   echo Deleting disconnected restore pods
   oc delete pods --all-namespaces -l oadp.openshift.io/disconnected-from-dc=$label
   
   for dc in $(oc get dc --all-namespaces -l oadp.openshift.io/replicas-modified=$label -o jsonpath='{range .items[*]}{.metadata.namespace}{","}{.metadata.name}{","}{.metadata.annotations.oadp\.openshift\.io/original-replicas}{","}{.metadata.annotations.oadp\.openshift\.io/original-paused}{"\n"}')
   do
       IFS=',' read -ra dc_arr <<< "$dc"
       if [ ${#dc_arr[0]} -gt 0 ]; then
   	echo Found deployment ${dc_arr[0]}/${dc_arr[1]}, setting replicas: ${dc_arr[2]}, paused: ${dc_arr[3]}
   	cat <<EOF | oc patch dc  -n ${dc_arr[0]} ${dc_arr[1]} --patch-file /dev/stdin
   spec:
     replicas: ${dc_arr[2]}
     paused: ${dc_arr[3]}
   EOF
       fi
   done