Chapter 3. Installing the Migration Toolkit for Containers

Procedure

1. Get the

   MigrationController

   CR manifest:

   $ oc get migrationcontroller <migration_controller> -n openshift-migration

2. Update the proxy parameters:

   apiVersion: migration.openshift.io/v1alpha1
   kind: MigrationController
   metadata:
     name: <migration_controller>
     namespace: openshift-migration
   ...
   spec:
     stunnel_tcp_proxy: http://<username>:<password>@<ip>:<port> 

   1

   
     noProxy: example.com 

   2

   1

   Stunnel proxy URL for direct volume migration.

   2

   Comma-separated list of destination domain names, domains, IP addresses, or other network CIDRs to exclude proxying.

   Preface a domain with

   .

   to match subdomains only. For example,

   .y.com

   matches

   x.y.com

   , but not

   y.com

   . Use

   *

   to bypass proxy for all destinations. If you scale up workers that are not included in the network defined by the

   networking.machineNetwork[].cidr

   field from the installation configuration, you must add them to this list to prevent connection issues.

   This field is ignored if neither the

   httpProxy

   nor the

   httpsProxy

   field is set.

3. Save the manifest as

   migration-controller.yaml

   .

4. Apply the updated manifest:

   $ oc replace -f migration-controller.yaml -n openshift-migration

Procedure

1. Create an AWS S3 bucket:

   $ aws s3api create-bucket \
       --bucket <bucket> \ 

   1

   
       --region <bucket_region> 

   2

   1

   Specify your S3 bucket name.

   2

   Specify your S3 bucket region, for example, us-east-1.

2. Create the IAM user

   velero

   :

   $ aws iam create-user --user-name velero

3. Create an EC2 EBS snapshot policy:

   $ cat > velero-ec2-snapshot-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeVolumes",
                   "ec2:DescribeSnapshots",
                   "ec2:CreateTags",
                   "ec2:CreateVolume",
                   "ec2:CreateSnapshot",
                   "ec2:DeleteSnapshot"
               ],
               "Resource": "*"
           }
       ]
   }
   EOF

4. Create an AWS S3 access policy for one or for all S3 buckets:

   $ cat > velero-s3-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:DeleteObject",
                   "s3:PutObject",
                   "s3:AbortMultipartUpload",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::<bucket>/*" 

   1

   
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetBucketLocation",
                   "s3:ListBucketMultipartUploads"
               ],
               "Resource": [
                   "arn:aws:s3:::<bucket>" 

   2

   
               ]
           }
       ]
   }
   EOF

   1 2

   To grant access to a single S3 bucket, specify the bucket name. To grant access to all AWS S3 buckets, specify * instead of a bucket name as in the following example:

   Example output

   "Resource": [
       "arn:aws:s3:::*"

5. Attach the EC2 EBS policy to

   velero

   :

   $ aws iam put-user-policy \
     --user-name velero \
     --policy-name velero-ebs \
     --policy-document file://velero-ec2-snapshot-policy.json

6. Attach the AWS S3 policy to

   velero

   :

   $ aws iam put-user-policy \
     --user-name velero \
     --policy-name velero-s3 \
     --policy-document file://velero-s3-policy.json

7. Create an access key for

   velero

   :

   $ aws iam create-access-key --user-name velero
   {
     "AccessKey": {
           "UserName": "velero",
           "Status": "Active",
           "CreateDate": "2017-07-31T22:24:41.576Z",
           "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>, 

   1

   
           "AccessKeyId": <AWS_ACCESS_KEY_ID> 

   2

   
       }
   }

   Record the

   AWS_SECRET_ACCESS_KEY

   and the

   AWS_ACCESS_KEY_ID

   . You use the credentials to add AWS as a replication repository.

Procedure

1. Log in to

   gsutil

   :

   $ gsutil init

   Example output

   Welcome! This command will take you through the configuration of gcloud.
   
   Your current configuration has been set to: [default]
   
   To continue, you must login. Would you like to login (Y/n)?

2. Set the

   BUCKET

   variable:

   $ BUCKET=<bucket> 

   1

   1 2 1

   Specify your bucket name.

3. Create a storage bucket:

   $ gsutil mb gs://$BUCKET/

4. Set the

   PROJECT_ID

   variable to your active project:

   $ PROJECT_ID=`gcloud config get-value project`

5. Create a

   velero

   IAM service account:

   $ gcloud iam service-accounts create velero \
       --display-name "Velero Storage"

6. Create the

   SERVICE_ACCOUNT_EMAIL

   variable:

   $ SERVICE_ACCOUNT_EMAIL=`gcloud iam service-accounts list \
     --filter="displayName:Velero Storage" \
     --format 'value(email)'`

7. Create the

   ROLE_PERMISSIONS

   variable:

   $ ROLE_PERMISSIONS=(
       compute.disks.get
       compute.disks.create
       compute.disks.createSnapshot
       compute.snapshots.get
       compute.snapshots.create
       compute.snapshots.useReadOnly
       compute.snapshots.delete
       compute.zones.get
   )

8. Create the

   velero.server

   custom role:

   $ gcloud iam roles create velero.server \
       --project $PROJECT_ID \
       --title "Velero Server" \
       --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")"

9. Add IAM policy binding to the project:

   $ gcloud projects add-iam-policy-binding $PROJECT_ID \
       --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
       --role projects/$PROJECT_ID/roles/velero.server

10. Update the IAM service account:

    $ gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://${BUCKET}

11. Save the IAM service account keys to the

    credentials-velero

    file in the current directory:

    $ gcloud iam service-accounts keys create credentials-velero \
      --iam-account $SERVICE_ACCOUNT_EMAIL

    You use the

    credentials-velero

    file to add GCP as a replication repository.

Procedure

1. Set the

   AZURE_RESOURCE_GROUP

   variable:

   $ AZURE_RESOURCE_GROUP=Velero_Backups

2. Create an Azure resource group:

   $ az group create -n $AZURE_RESOURCE_GROUP --location <CentralUS> 

   1

   1

   Specify your location.

3. Set the

   AZURE_STORAGE_ACCOUNT_ID

   variable:

   $ AZURE_STORAGE_ACCOUNT_ID=velerobackups

4. Create an Azure storage account:

   $ az storage account create \
     --name $AZURE_STORAGE_ACCOUNT_ID \
     --resource-group $AZURE_RESOURCE_GROUP \
     --sku Standard_GRS \
     --encryption-services blob \
     --https-only true \
     --kind BlobStorage \
     --access-tier Hot

5. Set the

   BLOB_CONTAINER

   variable:

   $ BLOB_CONTAINER=velero

6. Create an Azure Blob storage container:

   $ az storage container create \
     -n $BLOB_CONTAINER \
     --public-access off \
     --account-name $AZURE_STORAGE_ACCOUNT_ID

7. Create a service principal and credentials for

   velero

   :

   $ AZURE_SUBSCRIPTION_ID=`az account list --query '[?isDefault].id' -o tsv` \
     AZURE_TENANT_ID=`az account list --query '[?isDefault].tenantId' -o tsv` \
     AZURE_CLIENT_SECRET=`az ad sp create-for-rbac --name "velero" \
     --role "Contributor" --query 'password' -o tsv` \
     AZURE_CLIENT_ID=`az ad sp list --display-name "velero" \
     --query '[0].appId' -o tsv`

8. Save the service principal credentials in the

   credentials-velero

   file:

   $ cat << EOF > ./credentials-velero
   AZURE_SUBSCRIPTION_ID=${AZURE_SUBSCRIPTION_ID}
   AZURE_TENANT_ID=${AZURE_TENANT_ID}
   AZURE_CLIENT_ID=${AZURE_CLIENT_ID}
   AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
   AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
   AZURE_CLOUD_NAME=AzurePublicCloud
   EOF

   You use the

   credentials-velero

   file to add Azure as a replication repository.