Chapter 5. OADP Application backup and restore

Procedure

1. Create an OBC manifest file to request a NooBaa MCG bucket as shown in the following example:

   Example OBC

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc 

   1

   
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket 

   2

   Copy to Clipboard

   1

   The name of the object bucket claim.

   2

   The name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name> 

   1

   Copy to Clipboard

   1

   Specify the file name of the object bucket claim manifest.

3. When you create an OBC, ODF creates a secret and a config map with the same name as the object bucket claim. The secret has the bucket credentials, and the config map has information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc 

   1

   Copy to Clipboard

   1

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard

4. To get the bucket credentials from the generated secret, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard

5. Get the public URL for the S3 endpoint from the s3 route in the openshift-storage namespace by running the following command:

   $ oc get route s3 -n openshift-storage

   Copy to Clipboard

6. Create a cloud-credentials file with the object bucket credentials as shown in the following command:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard

7. Create the cloud-credentials secret with the cloud-credentials file content as shown in the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard

8. Configure the Data Protection Application (DPA) as shown in the following example:

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true 

   1

   
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc 

   2

   
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 

   3

   
             prefix: oadp

   Copy to Clipboard

   1

   Set to true to use the OADP Data Mover to enable movement of Container Storage Interface (CSI) snapshots to a remote object storage.

   2

   This is the S3 URL of ODF storage.

   3

   Specify the bucket name.

9. Create the DPA by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard

10. Verify that the DPA is created successfully by running the following command. In the example output, you can see the status object has type field set to Reconciled. This means, the DPA is successfully created.

    $ oc get dpa -o yaml

    Copy to Clipboard

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard

12. Configure a backup CR as shown in the following example:

    Example backup CR

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace> 

    1

    Copy to Clipboard

    1

    Specify the namespace for the application to back up.

13. Create the backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard

Procedure

1. Create a restore CR as shown in the following example:

   Example restore CR

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: test-restore 

   1

   
     namespace: openshift-adp
   spec:
     backupName: <backup_name> 

   2

   
     restorePVs: true
     namespaceMapping:
       <application_namespace>: test-restore-application 

   3

   Copy to Clipboard

   1

   The name of the restore CR.

   2

   Specify the name of the backup.

   3

   namespaceMapping maps the source application namespace to the target application namespace. Specify the application namespace that you backed up. test-restore-application is the target namespace where you want to restore the backup.

2. Apply the restore CR by running the following command:

   $ oc apply -f <restore_cr_filename>

   Copy to Clipboard

Verification

1. Verify that the restore is in the Completed phase by running the following command:

   $ oc describe restores.velero.io <restore_name> -n openshift-adp

   Copy to Clipboard

2. Change to the restored namespace test-restore-application by running the following command:

   $ oc project test-restore-application

   Copy to Clipboard

3. Verify the restored resources such as persistent volume claim (pvc), service (svc), deployment, secret, and config map by running the following command:

   $ oc get pvc,svc,deployment,secret,configmap

   Copy to Clipboard

   Example output

   NAME                          STATUS   VOLUME
   persistentvolumeclaim/mysql   Bound    pvc-9b3583db-...-14b86
   
   NAME               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   service/mysql      ClusterIP   172....157     <none>        3306/TCP   2m56s
   service/todolist   ClusterIP   172.....15     <none>        8000/TCP   2m56s
   
   NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/mysql   0/1     1            0           2m55s
   
   NAME                                         TYPE                      DATA   AGE
   secret/builder-dockercfg-6bfmd               kubernetes.io/dockercfg   1      2m57s
   secret/default-dockercfg-hz9kz               kubernetes.io/dockercfg   1      2m57s
   secret/deployer-dockercfg-86cvd              kubernetes.io/dockercfg   1      2m57s
   secret/mysql-persistent-sa-dockercfg-rgp9b   kubernetes.io/dockercfg   1      2m57s
   
   NAME                                 DATA   AGE
   configmap/kube-root-ca.crt           1      2m57s
   configmap/openshift-service-ca.crt   1      2m57s

   Copy to Clipboard

Procedure

1. Create an OBC manifest to request a NooBaa bucket as shown in the following example:

   Example ObjectBucketClaim CR

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc 

   1

   
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket 

   2

   Copy to Clipboard

   1

   Specifies the name of the object bucket claim.

   2

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

   Copy to Clipboard

3. When you create an OBC, ODF creates a secret and a ConfigMap with the same name as the object bucket claim. The secret object contains the bucket credentials, and the ConfigMap object contains information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc 

   1

   Copy to Clipboard

   1

   The name of the OBC is test-obc.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard

4. To get the bucket credentials from the secret object, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard

5. Create a cloud-credentials file with the object bucket credentials by using the following example configuration:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard

6. Create the cloud-credentials secret with the cloud-credentials file content by running the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard

7. Extract the service CA certificate from the openshift-service-ca.crt config map by running the following command. Ensure that you encode the certificate in Base64 format and note the value to use in the next step.

   $ oc get cm/openshift-service-ca.crt \
     -o jsonpath='{.data.service-ca\.crt}' | base64 -w0; echo

   Copy to Clipboard

   Example output

   LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0...
   ....gpwOHMwaG9CRmk5a3....FLS0tLS0K

   Copy to Clipboard

8. Configure the DataProtectionApplication CR manifest file with the bucket name and CA certificate as shown in the following example:

   Example DataProtectionApplication CR

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "false" 

   1

   
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 

   2

   
             prefix: oadp
             caCert: <ca_cert> 

   3

   Copy to Clipboard

   1

   The insecureSkipTLSVerify flag can be set to either true or false. If set to "true", SSL/TLS security is disabled. If set to false, SSL/TLS security is enabled.

   2

   Specify the name of the bucket extracted in an earlier step.

   3

   Copy and paste the Base64 encoded certificate from the previous step.

9. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard

10. Verify that the DataProtectionApplication CR is created successfully by running the following command:

    $ oc get dpa -o yaml

    Copy to Clipboard

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard

12. Configure the Backup CR by using the following example:

    Example Backup CR

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace> 

    1

    Copy to Clipboard

    1

    Specify the namespace for the application to back up.

13. Create the Backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard

Procedure

1. Configure the DataProtectionApplication CR to use the legacy-aws Velero plugin as shown in the following example:

   Example DataProtectionApplication CR

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - legacy-aws 

   1

   
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 

   2

   
             prefix: oadp

   Copy to Clipboard

   1

   Use the legacy-aws plugin.

   2

   Specify the bucket name.

2. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard

3. Verify that the DataProtectionApplication CR is created successfully by running the following command. In the example output, you can see the status object has the type field set to Reconciled and the status field set to "True". That status indicates that the DataProtectionApplication CR is successfully created.

   $ oc get dpa -o yaml

   Copy to Clipboard

   Example output

   apiVersion: v1
   items:
   - apiVersion: oadp.openshift.io/v1alpha1
     kind: DataProtectionApplication
     metadata:
       namespace: openshift-adp
       #...#
     spec:
       backupLocations:
       - velero:
           config:
             #...#
     status:
       conditions:
       - lastTransitionTime: "20....9:54:02Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled
   kind: List
   metadata:
     resourceVersion: ""

   Copy to Clipboard

4. Verify that the backup storage location (BSL) is available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Copy to Clipboard

   Example output

   NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
   dpa-sample-1   Available   3s               15s   true

   Copy to Clipboard

5. Configure a Backup CR as shown in the following example:

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   metadata:
     name: test-backup
     namespace: openshift-adp
   spec:
     includedNamespaces:
     - <application_namespace> 

   1

   Copy to Clipboard

   1

   Specify the namespace for the application to back up.

6. Create the Backup CR by running the following command:

   $ oc apply -f <backup_cr_filename>

   Copy to Clipboard

1. Create a workload to back up by running the following commands:

   $ oc create namespace hello-world

   Copy to Clipboard

   $ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift

   Copy to Clipboard

2. Expose the route by running the following command:

   $ oc expose service/hello-openshift -n hello-world

   Copy to Clipboard

3. Check that the application is working by running the following command:

   $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

   Copy to Clipboard

   Example output

   Hello OpenShift!

   Copy to Clipboard

4. Back up the workload by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Backup
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       includedNamespaces:
       - hello-world
       storageLocation: ${CLUSTER_NAME}-dpa-1
       ttl: 720h0m0s
   EOF

   Copy to Clipboard

5. Wait until the backup is completed and then run the following command:

   $ watch "oc -n openshift-adp get backup hello-world -o json | jq .status"

   Copy to Clipboard

   Example output

   {
     "completionTimestamp": "2022-09-07T22:20:44Z",
     "expiration": "2022-10-07T22:20:22Z",
     "formatVersion": "1.1.0",
     "phase": "Completed",
     "progress": {
       "itemsBackedUp": 58,
       "totalItems": 58
     },
     "startTimestamp": "2022-09-07T22:20:22Z",
     "version": 1
   }

   Copy to Clipboard

6. Delete the demo workload by running the following command:

   $ oc delete ns hello-world

   Copy to Clipboard

7. Restore the workload from the backup by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Restore
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       backupName: hello-world
   EOF

   Copy to Clipboard

8. Wait for the Restore to finish by running the following command:

   $ watch "oc -n openshift-adp get restore hello-world -o json | jq .status"

   Copy to Clipboard

   Example output

   {
     "completionTimestamp": "2022-09-07T22:25:47Z",
     "phase": "Completed",
     "progress": {
       "itemsRestored": 38,
       "totalItems": 38
     },
     "startTimestamp": "2022-09-07T22:25:28Z",
     "warnings": 9
   }

   Copy to Clipboard

9. Check that the workload is restored by running the following command:

   $ oc -n hello-world get pods

   Copy to Clipboard

   Example output

   NAME                              READY   STATUS    RESTARTS   AGE
   hello-openshift-9f885f7c6-kdjpj   1/1     Running   0          90s

   Copy to Clipboard

10. Check the JSONPath by running the following command:

    $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

    Copy to Clipboard

    Example output

    Hello OpenShift!

    Copy to Clipboard

Procedure

1. Delete the workload by running the following command:

   $ oc delete ns hello-world

   Copy to Clipboard

2. Delete the Data Protection Application (DPA) by running the following command:

   $ oc -n openshift-adp delete dpa ${CLUSTER_NAME}-dpa

   Copy to Clipboard

3. Delete the cloud storage by running the following command:

   $ oc -n openshift-adp delete cloudstorage ${CLUSTER_NAME}-oadp

   Copy to Clipboard
   Warning

   If this command hangs, you might need to delete the finalizer by running the following command:

   $ oc -n openshift-adp patch cloudstorage ${CLUSTER_NAME}-oadp -p '{"metadata":{"finalizers":null}}' --type=merge

   Copy to Clipboard

4. If the Operator is no longer required, remove it by running the following command:

   $ oc -n openshift-adp delete subscription oadp-operator

   Copy to Clipboard

5. Remove the namespace from the Operator:

   $ oc delete ns openshift-adp

   Copy to Clipboard

6. If the backup and restore resources are no longer required, remove them from the cluster by running the following command:

   $ oc delete backups.velero.io hello-world

   Copy to Clipboard

7. To delete backup, restore and remote objects in AWS S3 run the following command:

   $ velero backup delete hello-world

   Copy to Clipboard

8. If you no longer need the Custom Resource Definitions (CRD), remove them from the cluster by running the following command:

   $ for CRD in `oc get crds | grep velero | awk '{print $1}'`; do oc delete crd $CRD; done

   Copy to Clipboard

9. Delete the AWS S3 bucket by running the following commands:

   $ aws s3 rm s3://${CLUSTER_NAME}-oadp --recursive

   Copy to Clipboard

   $ aws s3api delete-bucket --bucket ${CLUSTER_NAME}-oadp

   Copy to Clipboard

10. Detach the policy from the role by running the following command:

    $ aws iam detach-role-policy --role-name "${ROLE_NAME}"  --policy-arn "${POLICY_ARN}"

    Copy to Clipboard

11. Delete the role by running the following command:

    $ aws iam delete-role --role-name "${ROLE_NAME}"

    Copy to Clipboard

Procedure

1. Set the BUCKET variable:

   $ BUCKET=<your_bucket>

   Copy to Clipboard

2. Set the REGION variable:

   $ REGION=<your_region>

   Copy to Clipboard

3. Create an AWS S3 bucket:

   $ aws s3api create-bucket \
       --bucket $BUCKET \
       --region $REGION \
       --create-bucket-configuration LocationConstraint=$REGION 

   1

   Copy to Clipboard

   1

   us-east-1 does not support a LocationConstraint. If your region is us-east-1, omit --create-bucket-configuration LocationConstraint=$REGION.

4. Create an IAM user:

   $ aws iam create-user --user-name velero 

   1

   Copy to Clipboard

   1

   If you want to use Velero to back up multiple clusters with multiple S3 buckets, create a unique user name for each cluster.

5. Create a velero-policy.json file:

   $ cat > velero-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeVolumes",
                   "ec2:DescribeSnapshots",
                   "ec2:CreateTags",
                   "ec2:CreateVolume",
                   "ec2:CreateSnapshot",
                   "ec2:DeleteSnapshot"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:DeleteObject",
                   "s3:PutObject",
                   "s3:AbortMultipartUpload",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}/*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetBucketLocation",
                   "s3:ListBucketMultipartUploads"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}"
               ]
           }
       ]
   }
   EOF

   Copy to Clipboard

6. Attach the policies to give the velero user the minimum necessary permissions:

   $ aws iam put-user-policy \
     --user-name velero \
     --policy-name velero \
     --policy-document file://velero-policy.json

   Copy to Clipboard

7. Create an access key for the velero user:

   $ aws iam create-access-key --user-name velero

   Copy to Clipboard

   Example output

   {
     "AccessKey": {
           "UserName": "velero",
           "Status": "Active",
           "CreateDate": "2017-07-31T22:24:41.576Z",
           "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>,
           "AccessKeyId": <AWS_ACCESS_KEY_ID>
     }
   }

   Copy to Clipboard

8. Create a credentials-velero file:

   $ cat << EOF > ./credentials-velero
   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
   EOF

   Copy to Clipboard

   You use the credentials-velero file to create a Secret object for AWS before you install the Data Protection Application.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 

   1

   
   spec:
     configuration:
       velero:
         defaultPlugins:
           - openshift 

   2

   
           - aws
         resourceTimeout: 10m 

   3

   
       nodeAgent: 

   4

   
         enable: true 

   5

   
         uploaderType: kopia 

   6

   
         podConfig:
           nodeSelector: <node_selector> 

   7

   
     backupLocations:
       - name: default
         velero:
           provider: aws
           default: true
           objectStorage:
             bucket: <bucket_name> 

   8

   
             prefix: <prefix> 

   9

   
           config:
             region: <region>
             profile: "default"
             s3ForcePathStyle: "true" 

   10

   
             s3Url: <s3_url> 

   11

   
           credential:
             key: cloud
             name: cloud-credentials 

   12

   
     snapshotLocations: 

   13

   
       - name: default
         velero:
           provider: aws
           config:
             region: <region> 

   14

   
             profile: "default"
           credential:
             key: cloud
             name: cloud-credentials 

   15

   Copy to Clipboard

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   The openshift plugin is mandatory.

   3

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   4

   The administrative agent that routes the administrative requests to servers.

   5

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   6

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   7

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   8

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   9

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

   10

   Specify whether to force path style URLs for S3 objects (Boolean). Not Required for AWS S3. Required only for S3 compatible storage.

   11

   Specify the URL of the object store that you are using to store backups. Not required for AWS S3. Required only for S3 compatible storage.

   12

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials, is used. If you specify a custom name, the custom name is used for the backup location.

   13

   Specify a snapshot location, unless you use CSI snapshots or a File System Backup (FSB) to back up PVs.

   14

   The snapshot location must be in the same region as the PVs.

   15

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials, is used. If you specify a custom name, the custom name is used for the snapshot location. If your backup and snapshot locations use different credentials, create separate profiles in the credentials-velero file.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Copy to Clipboard

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

   Copy to Clipboard

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Copy to Clipboard

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

   Copy to Clipboard

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Copy to Clipboard

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

   Copy to Clipboard