Backup and restore

Procedure

1. Create a workload to back up by running the following commands:

   $ oc create namespace hello-world

   Copy to Clipboard Toggle word wrap

   $ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift

   Copy to Clipboard Toggle word wrap

2. Expose the route by running the following command:

   $ oc expose service/hello-openshift -n hello-world

   Copy to Clipboard Toggle word wrap

3. Check that the application is working by running the following command:

   $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

   Copy to Clipboard Toggle word wrap

   You should see an output similar to the following example:

   Hello OpenShift!

   Copy to Clipboard Toggle word wrap

4. Back up the workload by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Backup
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       includedNamespaces:
       - hello-world
       storageLocation: ${CLUSTER_NAME}-dpa-1
       ttl: 720h0m0s
   EOF

   Copy to Clipboard Toggle word wrap

5. Wait until the backup is complete, and then run the following command:

   $ watch "oc -n openshift-adp get backup hello-world -o json | jq .status"

   Copy to Clipboard Toggle word wrap

   You should see an output similar to the following example:

   {
     "completionTimestamp": "2022-09-07T22:20:44Z",
     "expiration": "2022-10-07T22:20:22Z",
     "formatVersion": "1.1.0",
     "phase": "Completed",
     "progress": {
       "itemsBackedUp": 58,
       "totalItems": 58
     },
     "startTimestamp": "2022-09-07T22:20:22Z",
     "version": 1
   }

   Copy to Clipboard Toggle word wrap

6. Delete the demo workload by running the following command:

   $ oc delete ns hello-world

   Copy to Clipboard Toggle word wrap

7. Restore the workload from the backup by running the following command:

   $ cat << EOF | oc create -f -
     apiVersion: velero.io/v1
     kind: Restore
     metadata:
       name: hello-world
       namespace: openshift-adp
     spec:
       backupName: hello-world
   EOF

   Copy to Clipboard Toggle word wrap

8. Wait for the Restore to finish by running the following command:

   $ watch "oc -n openshift-adp get restore hello-world -o json | jq .status"

   Copy to Clipboard Toggle word wrap

   You should see an output similar to the following example:

   {
     "completionTimestamp": "2022-09-07T22:25:47Z",
     "phase": "Completed",
     "progress": {
       "itemsRestored": 38,
       "totalItems": 38
     },
     "startTimestamp": "2022-09-07T22:25:28Z",
     "warnings": 9
   }

   Copy to Clipboard Toggle word wrap

9. Check that the workload is restored by running the following command:

   $ oc -n hello-world get pods

   Copy to Clipboard Toggle word wrap

   You should see an output similar to the following example:

   NAME                              READY   STATUS    RESTARTS   AGE
   hello-openshift-9f885f7c6-kdjpj   1/1     Running   0          90s

   Copy to Clipboard Toggle word wrap

10. Check the JSONPath by running the following command:

    $ curl `oc get route/hello-openshift -n hello-world -o jsonpath='{.spec.host}'`

    Copy to Clipboard Toggle word wrap

    You should see an output similar to the following example:

    Hello OpenShift!

    Copy to Clipboard Toggle word wrap

Procedure

1. Delete the workload by running the following command:

   $ oc delete ns hello-world

   Copy to Clipboard Toggle word wrap

2. Delete the Data Protection Application (DPA) by running the following command:

   $ oc -n openshift-adp delete dpa ${CLUSTER_NAME}-dpa

   Copy to Clipboard Toggle word wrap

3. Delete the cloud storage by running the following command:

   $ oc -n openshift-adp delete cloudstorage ${CLUSTER_NAME}-oadp

   Copy to Clipboard Toggle word wrap
   Warning

   If this command hangs, you might need to delete the finalizer by running the following command:

   $ oc -n openshift-adp patch cloudstorage ${CLUSTER_NAME}-oadp -p '{"metadata":{"finalizers":null}}' --type=merge

   Copy to Clipboard Toggle word wrap

4. If the Operator is no longer required, remove it by running the following command:

   $ oc -n openshift-adp delete subscription oadp-operator

   Copy to Clipboard Toggle word wrap

5. Remove the namespace from the Operator:

   $ oc delete ns openshift-adp

   Copy to Clipboard Toggle word wrap

6. If the backup and restore resources are no longer required, remove them from the cluster by running the following command:

   $ oc delete backups.velero.io hello-world

   Copy to Clipboard Toggle word wrap

7. To delete backup, restore and remote objects in AWS S3 run the following command:

   $ velero backup delete hello-world

   Copy to Clipboard Toggle word wrap

8. If you no longer need the Custom Resource Definitions (CRD), remove them from the cluster by running the following command:

   $ for CRD in `oc get crds | grep velero | awk '{print $1}'`; do oc delete crd $CRD; done

   Copy to Clipboard Toggle word wrap

9. Delete the AWS S3 bucket by running the following commands:

   $ aws s3 rm s3://${CLUSTER_NAME}-oadp --recursive

   Copy to Clipboard Toggle word wrap

   $ aws s3api delete-bucket --bucket ${CLUSTER_NAME}-oadp

   Copy to Clipboard Toggle word wrap

10. Detach the policy from the role by running the following command:

    $ aws iam detach-role-policy --role-name "${ROLE_NAME}"  --policy-arn "${POLICY_ARN}"

    Copy to Clipboard Toggle word wrap

11. Delete the role by running the following command:

    $ aws iam delete-role --role-name "${ROLE_NAME}"

    Copy to Clipboard Toggle word wrap

Procedure

1. Create an OBC manifest file to request a NooBaa MCG bucket as shown in the following example:

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket

   Copy to Clipboard Toggle word wrap

   where:

   test-obc

   Specifies the name of the object bucket claim.

   test-backup-bucket

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

   Copy to Clipboard Toggle word wrap

   where:

   <obc_file_name>

   Specifies the file name of the object bucket claim manifest.

3. When you create an OBC, ODF creates a secret and a config map with the same name as the object bucket claim. The secret has the bucket credentials, and the config map has information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc

   Copy to Clipboard Toggle word wrap

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard Toggle word wrap

4. To get the bucket credentials from the generated secret, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard Toggle word wrap

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard Toggle word wrap

5. Get the public URL for the S3 endpoint from the s3 route in the openshift-storage namespace by running the following command:

   $ oc get route s3 -n openshift-storage

   Copy to Clipboard Toggle word wrap

6. Create a cloud-credentials file with the object bucket credentials as shown in the following command:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard Toggle word wrap

7. Create the cloud-credentials secret with the cloud-credentials file content as shown in the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard Toggle word wrap

8. Configure the Data Protection Application (DPA) as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name>
             prefix: oadp

   Copy to Clipboard Toggle word wrap

   where:

   defaultSnapshotMoveData

   Set to true to use the OADP Data Mover to enable movement of Container Storage Interface (CSI) snapshots to a remote object storage.

   s3Url

   Specifies the S3 URL of ODF storage.

   <bucket_name>

   Specifies the bucket name.

9. Create the DPA by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard Toggle word wrap

10. Verify that the DPA is created successfully by running the following command. In the example output, you can see the status object has type field set to Reconciled. This means, the DPA is successfully created.

    $ oc get dpa -o yaml

    Copy to Clipboard Toggle word wrap

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard Toggle word wrap

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard Toggle word wrap

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard Toggle word wrap

12. Configure a backup CR as shown in the following example:

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace>

    Copy to Clipboard Toggle word wrap

    where:

    <application_namespace>

    Specifies the namespace for the application to back up.

13. Create the backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard Toggle word wrap

Procedure

1. Create a restore CR as shown in the following example:

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: test-restore
     namespace: openshift-adp
   spec:
     backupName: <backup_name>
     restorePVs: true
     namespaceMapping:
       <application_namespace>: test-restore-application

   Copy to Clipboard Toggle word wrap

   where:

   test-restore

   Specifies the name of the restore CR.

   <backup_name>

   Specifies the name of the backup.

   <application_namespace>

   Specifies the target namespace to restore to. namespaceMapping maps the source application namespace to the target application namespace. test-restore-application is the name of target namespace where you want to restore the backup.

2. Apply the restore CR by running the following command:

   $ oc apply -f <restore_cr_filename>

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the restore is in the Completed phase by running the following command:

   $ oc describe restores.velero.io <restore_name> -n openshift-adp

   Copy to Clipboard Toggle word wrap

2. Change to the restored namespace test-restore-application by running the following command:

   $ oc project test-restore-application

   Copy to Clipboard Toggle word wrap

3. Verify the restored resources such as persistent volume claim (pvc), service (svc), deployment, secret, and config map by running the following command:

   $ oc get pvc,svc,deployment,secret,configmap

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                          STATUS   VOLUME
   persistentvolumeclaim/mysql   Bound    pvc-9b3583db-...-14b86
   
   NAME               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   service/mysql      ClusterIP   172....157     <none>        3306/TCP   2m56s
   service/todolist   ClusterIP   172.....15     <none>        8000/TCP   2m56s
   
   NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/mysql   0/1     1            0           2m55s
   
   NAME                                         TYPE                      DATA   AGE
   secret/builder-dockercfg-6bfmd               kubernetes.io/dockercfg   1      2m57s
   secret/default-dockercfg-hz9kz               kubernetes.io/dockercfg   1      2m57s
   secret/deployer-dockercfg-86cvd              kubernetes.io/dockercfg   1      2m57s
   secret/mysql-persistent-sa-dockercfg-rgp9b   kubernetes.io/dockercfg   1      2m57s
   
   NAME                                 DATA   AGE
   configmap/kube-root-ca.crt           1      2m57s
   configmap/openshift-service-ca.crt   1      2m57s

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an OBC manifest to request a NooBaa bucket as shown in the following example:

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket

   Copy to Clipboard Toggle word wrap

   where:

   test-obc

   Specifies the name of the object bucket claim.

   test-backup-bucket

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

   Copy to Clipboard Toggle word wrap

3. When you create an OBC, ODF creates a secret and a ConfigMap with the same name as the object bucket claim. The secret object contains the bucket credentials, and the ConfigMap object contains information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc

   Copy to Clipboard Toggle word wrap

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard Toggle word wrap

4. To get the bucket credentials from the secret object, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard Toggle word wrap

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard Toggle word wrap

5. Create a cloud-credentials file with the object bucket credentials by using the following example configuration:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard Toggle word wrap

6. Create the cloud-credentials secret with the cloud-credentials file content by running the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard Toggle word wrap

7. Extract the service CA certificate from the openshift-service-ca.crt config map by running the following command. Ensure that you encode the certificate in Base64 format and note the value to use in the next step.

   $ oc get cm/openshift-service-ca.crt \
     -o jsonpath='{.data.service-ca\.crt}' | base64 -w0; echo

   Copy to Clipboard Toggle word wrap

   Example output

   LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0...
   ....gpwOHMwaG9CRmk5a3....FLS0tLS0K

   Copy to Clipboard Toggle word wrap

8. Configure the DataProtectionApplication CR manifest file with the bucket name and CA certificate as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "false"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name>
             prefix: oadp
             caCert: <ca_cert>

   Copy to Clipboard Toggle word wrap

   where:

   insecureSkipTLSVerify

   Specifies whether SSL/TLS security is enabled. If set to true, SSL/TLS security is disabled. If set to false, SSL/TLS security is enabled.

   <bucket_name>

   Specifies the name of the bucket extracted in an earlier step.

   <ca_cert>

   Specifies the Base64 encoded certificate from the previous step.

9. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard Toggle word wrap

10. Verify that the DataProtectionApplication CR is created successfully by running the following command:

    $ oc get dpa -o yaml

    Copy to Clipboard Toggle word wrap

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard Toggle word wrap

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard Toggle word wrap

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard Toggle word wrap

12. Configure the Backup CR by using the following example:

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace>

    Copy to Clipboard Toggle word wrap

    where:

    <application_namespace>

    Specifies the namespace for the application to back up.

13. Create the Backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard Toggle word wrap

Procedure

1. Create the following environment variables by running the following commands:

   Important

   Change the cluster name to match your cluster, and ensure you are logged into the cluster as an administrator. Ensure that all fields are outputted correctly before continuing.

   $ export CLUSTER_NAME=my-cluster

   Copy to Clipboard Toggle word wrap
   • my-cluster: Replace my-cluster with your cluster name.

   $ export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)

   Copy to Clipboard Toggle word wrap

   $ export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)

   Copy to Clipboard Toggle word wrap

   $ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')

   Copy to Clipboard Toggle word wrap

   $ export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

   Copy to Clipboard Toggle word wrap

   $ export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')

   Copy to Clipboard Toggle word wrap

   $ export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"

   Copy to Clipboard Toggle word wrap

   $ export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"

   Copy to Clipboard Toggle word wrap

   $ mkdir -p ${SCRATCH}

   Copy to Clipboard Toggle word wrap

   $ echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
     ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"

   Copy to Clipboard Toggle word wrap

2. On the AWS account, create an IAM policy to allow access to AWS S3:

   1. Check to see if the policy exists by running the following command:

      $ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaOadpVer1'].{ARN:Arn}" --output text)

      Copy to Clipboard Toggle word wrap
      • RosaOadp: Replace RosaOadp with your policy name.

   2. Enter the following command to create the policy JSON file and then create the policy:

      Note

      If the policy ARN is not found, the command creates the policy. If the policy ARN already exists, the if statement intentionally skips the policy creation.

      $ if [[ -z "${POLICY_ARN}" ]]; then
        cat << EOF > ${SCRATCH}/policy.json
        {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "s3:CreateBucket",
              "s3:DeleteBucket",
              "s3:PutBucketTagging",
              "s3:GetBucketTagging",
              "s3:PutEncryptionConfiguration",
              "s3:GetEncryptionConfiguration",
              "s3:PutLifecycleConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject",
              "s3:ListBucketMultipartUploads",
              "s3:AbortMultipartUpload",
              "s3:ListMultipartUploadParts",
              "ec2:DescribeSnapshots",
              "ec2:DescribeVolumes",
              "ec2:DescribeVolumeAttribute",
              "ec2:DescribeVolumesModifications",
              "ec2:DescribeVolumeStatus",
              "ec2:CreateTags",
              "ec2:CreateVolume",
              "ec2:CreateSnapshot",
              "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
          }
        ]}
      EOF
      
        POLICY_ARN=$(aws iam create-policy --policy-name "RosaOadpVer1" \
        --policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
        --tags Key=rosa_openshift_version,Value=${CLUSTER_VERSION} Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-oadp Key=operator_name,Value=openshift-oadp \
        --output text)
        fi

      Copy to Clipboard Toggle word wrap
      • SCRATCH: SCRATCH is a name for a temporary directory created for the environment variables.

   3. View the policy ARN by running the following command:

      $ echo ${POLICY_ARN}

      Copy to Clipboard Toggle word wrap

3. Create an IAM role trust policy for the cluster:

   1. Create the trust policy file by running the following command:

      $ cat <<EOF > ${SCRATCH}/trust-policy.json
        {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDC_ENDPOINT}:sub": [
                    "system:serviceaccount:openshift-adp:openshift-adp-controller-manager",
                    "system:serviceaccount:openshift-adp:velero"]
                }
              }
            }]
        }
      EOF

      Copy to Clipboard Toggle word wrap

   2. Create the role by running the following command:

      $ ROLE_ARN=$(aws iam create-role --role-name \
        "${ROLE_NAME}" \
        --assume-role-policy-document file://${SCRATCH}/trust-policy.json \
        --tags Key=rosa_cluster_id,Value=${ROSA_CLUSTER_ID} \
               Key=rosa_openshift_version,Value=${CLUSTER_VERSION} \
               Key=rosa_role_prefix,Value=ManagedOpenShift \
               Key=operator_namespace,Value=openshift-adp \
               Key=operator_name,Value=openshift-oadp \
        --query Role.Arn --output text)

      Copy to Clipboard Toggle word wrap

   3. View the role ARN by running the following command:

      $ echo ${ROLE_ARN}

      Copy to Clipboard Toggle word wrap

4. Attach the IAM policy to the IAM role by running the following command:

   $ aws iam attach-role-policy --role-name "${ROLE_NAME}" \
     --policy-arn ${POLICY_ARN}

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a Red Hat OpenShift Service on AWS secret from your AWS token file by entering the following commands:

   1. Create the credentials file:

      $ cat <<EOF > ${SCRATCH}/credentials
        [default]
        role_arn = ${ROLE_ARN}
        web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
        region = <aws_region> 

      1

      
      EOF

      Copy to Clipboard Toggle word wrap

      1

      Replace <aws_region> with the AWS region to use for the STS endpoint.

   2. Create a namespace for OADP:

      $ oc create namespace openshift-adp

      Copy to Clipboard Toggle word wrap

   3. Create the Red Hat OpenShift Service on AWS secret:

      $ oc -n openshift-adp create secret generic cloud-credentials \
        --from-file=${SCRATCH}/credentials

      Copy to Clipboard Toggle word wrap
      Note

      In Red Hat OpenShift Service on AWS versions 4.15 and later, the OADP Operator supports a new standardized STS workflow through the Operator Lifecycle Manager (OLM) and Cloud Credentials Operator (CCO). In this workflow, you do not need to create the above secret, you only need to supply the role ARN during the installation of OLM-managed operators using the Red Hat OpenShift Service on AWS web console, for more information see Installing from software catalog using the web console.

      The preceding secret is created automatically by CCO.

2. Install the OADP Operator:

   1. In the Red Hat OpenShift Service on AWS web console, browse to Ecosystem → Software Catalog.
   2. Search for the OADP Operator.
   3. In the role_ARN field, paste the role_arn that you created previously and click Install.

3. Create AWS cloud storage using your AWS credentials by entering the following command:

   $ cat << EOF | oc create -f -
     apiVersion: oadp.openshift.io/v1alpha1
     kind: CloudStorage
     metadata:
       name: ${CLUSTER_NAME}-oadp
       namespace: openshift-adp
     spec:
       creationSecret:
         key: credentials
         name: cloud-credentials
       enableSharedConfig: true
       name: ${CLUSTER_NAME}-oadp
       provider: aws
       region: $REGION
   EOF

   Copy to Clipboard Toggle word wrap

4. Check your application’s storage default storage class by entering the following command:

   $ oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap

   Example output

   NAME     STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
   applog   Bound    pvc-351791ae-b6ab-4e8b-88a4-30f73caf5ef8   1Gi        RWO            gp3-csi        4d19h
   mysql    Bound    pvc-16b8e009-a20a-4379-accc-bc81fedd0621   1Gi        RWO            gp3-csi        4d19h

   Copy to Clipboard Toggle word wrap

5. Get the storage class by running the following command:

   $ oc get storageclass

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
   gp2                 kubernetes.io/aws-ebs   Delete          WaitForFirstConsumer   true                   4d21h
   gp2-csi             ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3                 ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3-csi (default)   ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h

   Copy to Clipboard Toggle word wrap

   Note

   The following storage classes will work:

   • gp3-csi
   • gp2-csi
   • gp3
   • gp2

   If the application or applications that are being backed up are all using persistent volumes (PVs) with Container Storage Interface (CSI), it is advisable to include the CSI plugin in the OADP DPA configuration.

6. Create the DataProtectionApplication resource to configure the connection to the storage where the backups and volume snapshots are stored:

   1. If you are using only CSI volumes, deploy a Data Protection Application by entering the following command:

      $ cat << EOF | oc create -f -
        apiVersion: oadp.openshift.io/v1alpha1
        kind: DataProtectionApplication
        metadata:
          name: ${CLUSTER_NAME}-dpa
          namespace: openshift-adp
        spec:
          backupImages: true 

      1

      
          features:
            dataMover:
              enable: false
          backupLocations:
          - bucket:
              cloudStorageRef:
                name: ${CLUSTER_NAME}-oadp
              credential:
                key: credentials
                name: cloud-credentials
              prefix: velero
              default: true
              config:
                region: ${REGION}
          configuration:
            velero:
              defaultPlugins:
              - openshift
              - aws
              - csi
            nodeAgent:  

      2

      
              enable: false
              uploaderType: kopia 

      3

      
      EOF

      Copy to Clipboard Toggle word wrap

      1

      Red Hat OpenShift Service on AWS supports internal image backup. Set this field to false if you do not want to use image backup.

      2

      See the important note regarding the nodeAgent attribute at the end of this procedure.

      3

      The type of uploader. The built-in Data Mover uses Kopia as the default uploader mechanism regardless of the value of the uploaderType field.

   2. If you are using CSI or non-CSI volumes, deploy a Data Protection Application by entering the following command:

      $ cat << EOF | oc create -f -
        apiVersion: oadp.openshift.io/v1alpha1
        kind: DataProtectionApplication
        metadata:
          name: ${CLUSTER_NAME}-dpa
          namespace: openshift-adp
        spec:
          backupImages: true 

      1

      
          backupLocations:
          - bucket:
              cloudStorageRef:
                name: ${CLUSTER_NAME}-oadp
              credential:
                key: credentials
                name: cloud-credentials
              prefix: velero
              default: true
              config:
                region: ${REGION}
          configuration:
            velero:
              defaultPlugins:
              - openshift
              - aws
            nodeAgent: 

      2

      
              enable: false
              uploaderType: restic
          snapshotLocations:
            - velero:
                config:
                  credentialsFile: /tmp/credentials/openshift-adp/cloud-credentials-credentials 

      3

      
                  enableSharedConfig: "true" 

      4

      
                  profile: default 

      5

      
                  region: ${REGION} 

      6

      
                provider: aws
      EOF

      Copy to Clipboard Toggle word wrap

      1

      Red Hat OpenShift Service on AWS supports internal image backup. Set this field to false if you do not want to use image backup.

      2

      See the important note regarding the nodeAgent attribute at the end of this procedure.

      3

      The credentialsFile field is the mounted location of the bucket credential on the pod.

      4

      The enableSharedConfig field allows the snapshotLocations to share or reuse the credential defined for the bucket.

      5

      Use the profile name set in the AWS credentials file.

      6

      Specify region as your AWS region. This must be the same as the cluster region.

      You are now ready to back up and restore Red Hat OpenShift Service on AWS applications, as described in Backing up applications.

Procedure

1. To verify that the OADP subscription has the wrong IAM role ARN environment variable set, run the following command:

   $ oc get sub -o yaml redhat-oadp-operator

   Copy to Clipboard Toggle word wrap

   Example subscription

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     annotations:
     creationTimestamp: "2025-01-15T07:18:31Z"
     generation: 1
     labels:
       operators.coreos.com/redhat-oadp-operator.openshift-adp: ""
     name: redhat-oadp-operator
     namespace: openshift-adp
     resourceVersion: "77363"
     uid: 5ba00906-5ad2-4476-ae7b-ffa90986283d
   spec:
     channel: stable-1.4
     config:
       env:
       - name: ROLEARN
         value: arn:aws:iam::11111111:role/wrong-role-arn 

   1

   
     installPlanApproval: Manual
     name: redhat-oadp-operator
     source: prestage-operators
     sourceNamespace: openshift-marketplace
     startingCSV: oadp-operator.v1.4.2

   Copy to Clipboard Toggle word wrap

   1

   Verify the value of ROLEARN you want to update.

2. Update the ROLEARN field of the subscription with the correct role ARN by running the following command:

   $ oc patch subscription redhat-oadp-operator -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "<role_arn>"}]}}}' --type='merge'

   Copy to Clipboard Toggle word wrap

   where:

   <role_arn>

   Specifies the IAM role ARN to be updated. For example, arn:aws:iam::160…​..6956:role/oadprosa…​..8wlf.

3. Verify that the secret object is updated with correct role ARN value by running the following command:

   $ oc get secret cloud-credentials -o jsonpath='{.data.credentials}' | base64 -d

   Copy to Clipboard Toggle word wrap

   Example output

   [default]
   sts_regional_endpoints = regional
   role_arn = arn:aws:iam::160.....6956:role/oadprosa.....8wlf
   web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

   Copy to Clipboard Toggle word wrap

4. Configure the DataProtectionApplication custom resource (CR) manifest file as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: test-rosa-dpa
     namespace: openshift-adp
   spec:
     backupLocations:
     - bucket:
         config:
           region: us-east-1
         cloudStorageRef:
           name: <cloud_storage> 

   1

   
         credential:
           name: cloud-credentials
           key: credentials
         prefix: velero
         default: true
     configuration:
       velero:
         defaultPlugins:
         - aws
         - openshift

   Copy to Clipboard Toggle word wrap

   1

   Specify the CloudStorage CR.

5. Create the DataProtectionApplication CR by running the following command:

   $ oc create -f <dpa_manifest_file>

   Copy to Clipboard Toggle word wrap

6. Verify that the DataProtectionApplication CR is reconciled and the status is set to "True" by running the following command:

   $  oc get dpa -n openshift-adp -o yaml

   Copy to Clipboard Toggle word wrap

   Example DataProtectionApplication

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   ...
   status:
       conditions:
       - lastTransitionTime: "2023-07-31T04:48:12Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled

   Copy to Clipboard Toggle word wrap

7. Verify that the BackupStorageLocation CR is in an available state by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Copy to Clipboard Toggle word wrap

   Example BackupStorageLocation

   NAME       PHASE       LAST VALIDATED   AGE   DEFAULT
   ts-dpa-1   Available   3s               6s    true

   Copy to Clipboard Toggle word wrap

Procedure

1. To preview the resources included in the backup before running the actual backup, run the following command:

   $ velero backup create <backup-name> --snapshot-volumes false 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the value of --snapshot-volumes parameter as false.

2. To know more details about the backup resources, run the following command:

   $ velero describe backup <backup_name> --details 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the name of the backup.

3. To preview the resources included in the restore before running the actual restore, run the following command:

   $ velero restore create --from-backup <backup-name> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the name of the backup created to review the backup resources.

   Important

   The velero restore create command creates restore resources in the cluster. You must delete the resources created as part of the restore, after you review the resources.

4. To know more details about the restore resources, run the following command:

   $ velero describe restore <restore_name> --details 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the name of the restore.