Chapter 4. OADP Application backup and restore

Procedure

1. Create an OBC manifest file to request a NooBaa MCG bucket as shown in the following example:

   Example OBC

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc 1
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket 2

   1

   The name of the object bucket claim.

   2

   The name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name> 1

   1

   Specify the file name of the object bucket claim manifest.

3. When you create an OBC, ODF creates a secret and a config map with the same name as the object bucket claim. The secret has the bucket credentials, and the config map has information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc 1

   1

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

4. To get the bucket credentials from the generated secret, run the following command:

   $ oc extract --to=- secret/test-obc

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

5. Get the public URL for the S3 endpoint from the s3 route in the openshift-storage namespace by running the following command:

   $ oc get route s3 -n openshift-storage

6. Create a cloud-credentials file with the object bucket credentials as shown in the following command:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

7. Create the cloud-credentials secret with the cloud-credentials file content as shown in the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

8. Configure the Data Protection Application (DPA) as shown in the following example:

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true 1
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc 2
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 3
             prefix: oadp

   1

   Set to true to use the OADP Data Mover to enable movement of Container Storage Interface (CSI) snapshots to a remote object storage.

   2

   This is the S3 URL of ODF storage.

   3

   Specify the bucket name.

9. Create the DPA by running the following command:

   $ oc apply -f <dpa_filename>

10. Verify that the DPA is created successfully by running the following command. In the example output, you can see the status object has type field set to Reconciled. This means, the DPA is successfully created.

    $ oc get dpa -o yaml

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

12. Configure a backup CR as shown in the following example:

    Example backup CR

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace> 1

    1

    Specify the namespace for the application to back up.

13. Create the backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

Procedure

1. Create a restore CR as shown in the following example:

   Example restore CR

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: test-restore 1
     namespace: openshift-adp
   spec:
     backupName: <backup_name> 2
     restorePVs: true
     namespaceMapping:
       <application_namespace>: test-restore-application 3

   1

   The name of the restore CR.

   2

   Specify the name of the backup.

   3

   namespaceMapping maps the source application namespace to the target application namespace. Specify the application namespace that you backed up. test-restore-application is the target namespace where you want to restore the backup.

2. Apply the restore CR by running the following command:

   $ oc apply -f <restore_cr_filename>

Verification

1. Verify that the restore is in the Completed phase by running the following command:

   $ oc describe restores.velero.io <restore_name> -n openshift-adp

2. Change to the restored namespace test-restore-application by running the following command:

   $ oc project test-restore-application

3. Verify the restored resources such as persistent volume claim (pvc), service (svc), deployment, secret, and config map by running the following command:

   $ oc get pvc,svc,deployment,secret,configmap

   Example output

   NAME                          STATUS   VOLUME
   persistentvolumeclaim/mysql   Bound    pvc-9b3583db-...-14b86
   
   NAME               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   service/mysql      ClusterIP   172....157     <none>        3306/TCP   2m56s
   service/todolist   ClusterIP   172.....15     <none>        8000/TCP   2m56s
   
   NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/mysql   0/1     1            0           2m55s
   
   NAME                                         TYPE                      DATA   AGE
   secret/builder-dockercfg-6bfmd               kubernetes.io/dockercfg   1      2m57s
   secret/default-dockercfg-hz9kz               kubernetes.io/dockercfg   1      2m57s
   secret/deployer-dockercfg-86cvd              kubernetes.io/dockercfg   1      2m57s
   secret/mysql-persistent-sa-dockercfg-rgp9b   kubernetes.io/dockercfg   1      2m57s
   
   NAME                                 DATA   AGE
   configmap/kube-root-ca.crt           1      2m57s
   configmap/openshift-service-ca.crt   1      2m57s

Procedure

1. Create an OBC manifest to request a NooBaa bucket as shown in the following example:

   Example ObjectBucketClaim CR

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc 1
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket 2

   1

   Specifies the name of the object bucket claim.

   2

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

3. When you create an OBC, ODF creates a secret and a ConfigMap with the same name as the object bucket claim. The secret object contains the bucket credentials, and the ConfigMap object contains information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc 1

   1

   The name of the OBC is test-obc.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

4. To get the bucket credentials from the secret object , run the following command:

   $ oc extract --to=- secret/test-obc

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

5. Create a cloud-credentials file with the object bucket credentials by using the following example configuration:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

6. Create the cloud-credentials secret with the cloud-credentials file content by running the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

7. Extract the service CA certificate from the openshift-service-ca.crt config map by running the following command. Ensure that you encode the certificate in Base64 format and note the value to use in the next step.

   $ oc get cm/openshift-service-ca.crt \
     -o jsonpath='{.data.service-ca\.crt}' | base64 -w0; echo

   Example output

   LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0...
   ....gpwOHMwaG9CRmk5a3....FLS0tLS0K

8. Configure the DataProtectionApplication CR manifest file with the bucket name and CA certificate as shown in the following example:

   Example DataProtectionApplication CR

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "false" 1
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 2
             prefix: oadp
             caCert: <ca_cert> 3

   1

   The insecureSkipTLSVerify flag can be set to either true or false. If set to "true", SSL/TLS security is disabled. If set to false, SSL/TLS security is enabled.

   2

   Specify the name of the bucket extracted in an earlier step.

   3

   Copy and paste the Base64 encoded certificate from the previous step.

9. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

10. Verify that the DataProtectionApplication CR is created successfully by running the following command:

    $ oc get dpa -o yaml

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

12. Configure the Backup CR by using the following example:

    Example Backup CR

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace> 1

    1

    Specify the namespace for the application to back up.

13. Create the Backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

Procedure

1. Configure the DataProtectionApplication CR to use the legacy-aws Velero plugin as shown in the following example:

   Example DataProtectionApplication CR

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - legacy-aws 1
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name> 2
             prefix: oadp

   1

   Use the legacy-aws plugin.

   2

   Specify the bucket name.

2. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

3. Verify that the DataProtectionApplication CR is created successfully by running the following command. In the example output, you can see the status object has the type field set to Reconciled and the status field set to "True". That status indicates that the DataProtectionApplication CR is successfully created.

   $ oc get dpa -o yaml

   Example output

   apiVersion: v1
   items:
   - apiVersion: oadp.openshift.io/v1alpha1
     kind: DataProtectionApplication
     metadata:
       namespace: openshift-adp
       #...#
     spec:
       backupLocations:
       - velero:
           config:
             #...#
     status:
       conditions:
       - lastTransitionTime: "20....9:54:02Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled
   kind: List
   metadata:
     resourceVersion: ""

4. Verify that the backup storage location (BSL) is available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
   dpa-sample-1   Available   3s               15s   true

5. Configure a Backup CR as shown in the following example:

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   metadata:
     name: test-backup
     namespace: openshift-adp
   spec:
     includedNamespaces:
     - <application_namespace> 1

   1

   Specify the namespace for the application to back up.

6. Create the Backup CR by running the following command:

   $ oc apply -f <backup_cr_filename>

Procedure

1. Set the BUCKET variable:

   $ BUCKET=<your_bucket>

2. Set the REGION variable:

   $ REGION=<your_region>

3. Create an AWS S3 bucket:

   $ aws s3api create-bucket \
       --bucket $BUCKET \
       --region $REGION \
       --create-bucket-configuration LocationConstraint=$REGION 1

   1

   us-east-1 does not support a LocationConstraint. If your region is us-east-1, omit --create-bucket-configuration LocationConstraint=$REGION.

4. Create an IAM user:

   $ aws iam create-user --user-name velero 1

   1

   If you want to use Velero to back up multiple clusters with multiple S3 buckets, create a unique user name for each cluster.

5. Create a velero-policy.json file:

   $ cat > velero-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeVolumes",
                   "ec2:DescribeSnapshots",
                   "ec2:CreateTags",
                   "ec2:CreateVolume",
                   "ec2:CreateSnapshot",
                   "ec2:DeleteSnapshot"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:DeleteObject",
                   "s3:PutObject",
                   "s3:AbortMultipartUpload",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}/*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetBucketLocation",
                   "s3:ListBucketMultipartUploads"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}"
               ]
           }
       ]
   }
   EOF

6. Attach the policies to give the velero user the minimum necessary permissions:

   $ aws iam put-user-policy \
     --user-name velero \
     --policy-name velero \
     --policy-document file://velero-policy.json

7. Create an access key for the velero user:

   $ aws iam create-access-key --user-name velero

   Example output

   {
     "AccessKey": {
           "UserName": "velero",
           "Status": "Active",
           "CreateDate": "2017-07-31T22:24:41.576Z",
           "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>,
           "AccessKeyId": <AWS_ACCESS_KEY_ID>
     }
   }

8. Create a credentials-velero file:

   $ cat << EOF > ./credentials-velero
   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
   EOF

   You use the credentials-velero file to create a Secret object for AWS before you install the Data Protection Application.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - openshift 2
           - aws
         resourceTimeout: 10m 3
       nodeAgent: 4
         enable: true 5
         uploaderType: kopia 6
         podConfig:
           nodeSelector: <node_selector> 7
     backupLocations:
       - name: default
         velero:
           provider: aws
           default: true
           objectStorage:
             bucket: <bucket_name> 8
             prefix: <prefix> 9
           config:
             region: <region>
             profile: "default"
             s3ForcePathStyle: "true" 10
             s3Url: <s3_url> 11
           credential:
             key: cloud
             name: cloud-credentials 12
     snapshotLocations: 13
       - name: default
         velero:
           provider: aws
           config:
             region: <region> 14
             profile: "default"
           credential:
             key: cloud
             name: cloud-credentials 15

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   The openshift plugin is mandatory.

   3

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   4

   The administrative agent that routes the administrative requests to servers.

   5

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   6

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   7

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   8

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   9

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

   10

   Specify whether to force path style URLs for S3 objects (Boolean). Not Required for AWS S3. Required only for S3 compatible storage.

   11

   Specify the URL of the object store that you are using to store backups. Not required for AWS S3. Required only for S3 compatible storage.

   12

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials, is used. If you specify a custom name, the custom name is used for the backup location.

   13

   Specify a snapshot location, unless you use CSI snapshots or a File System Backup (FSB) to back up PVs.

   14

   The snapshot location must be in the same region as the PVs.

   15

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials, is used. If you specify a custom name, the custom name is used for the snapshot location. If your backup and snapshot locations use different credentials, create separate profiles in the credentials-velero file.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Configure the DPA with more than one BSL. See the following example.

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   #...
   backupLocations:
     - name: aws 1
       velero:
         provider: aws
         default: true 2
         objectStorage:
           bucket: <bucket_name> 3
           prefix: <prefix> 4
         config:
           region: <region_name> 5
           profile: "default"
         credential:
           key: cloud
           name: cloud-credentials 6
     - name: odf 7
       velero:
         provider: aws
         default: false
         objectStorage:
           bucket: <bucket_name>
           prefix: <prefix>
         config:
           profile: "default"
           region: <region_name>
           s3Url: <url> 8
           insecureSkipTLSVerify: "true"
           s3ForcePathStyle: "true"
         credential:
           key: cloud
           name: <custom_secret_name_odf> 9
   #...

   1

   Specify a name for the first BSL.

   2

   This parameter indicates that this BSL is the default BSL. If a BSL is not set in the Backup CR, the default BSL is used. You can set only one BSL as the default.

   3

   Specify the bucket name.

   4

   Specify a prefix for Velero backups; for example, velero.

   5

   Specify the AWS region for the bucket.

   6

   Specify the name of the default Secret object that you created.

   7

   Specify a name for the second BSL.

   8

   Specify the URL of the S3 endpoint.

   9

   Specify the correct name for the Secret; for example, custom_secret_name_odf. If you do not specify a Secret name, the default name is used.

2. Specify the BSL to be used in the backup CR. See the following example.

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   # ...
   spec:
     includedNamespaces:
     - <namespace> 1
     storageLocation: <backup_storage_location> 2
     defaultVolumesToFsBackup: true

   1

   Specify the namespace to back up.

   2

   Specify the storage location.

Procedure

1. Install the IBM Cloud Object Storage (COS) plugin by running the following command:

   $ ibmcloud plugin install cos -f

2. Set a bucket name by running the following command:

   $ BUCKET=<bucket_name>

3. Set a bucket region by running the following command:

   $ REGION=<bucket_region> 1

   1

   Specify the bucket region, for example, eu-gb.

4. Create a resource group by running the following command:

   $ ibmcloud resource group-create <resource_group_name>

5. Set the target resource group by running the following command:

   $ ibmcloud target -g <resource_group_name>

6. Verify that the target resource group is correctly set by running the following command:

   $ ibmcloud target

   Example output

   API endpoint:     https://cloud.ibm.com
   Region:
   User:             test-user
   Account:          Test Account (fb6......e95) <-> 2...122
   Resource group:   Default

   In the example output, the resource group is set to Default.

7. Set a resource group name by running the following command:

   $ RESOURCE_GROUP=<resource_group> 1

   1

   Specify the resource group name, for example, "default".

8. Create an IBM Cloud service-instance resource by running the following command:

   $ ibmcloud resource service-instance-create \
   <service_instance_name> \1
   <service_name> \2
   <service_plan> \3
   <region_name> 4

   1

   Specify a name for the service-instance resource.

   2

   Specify the service name. Alternatively, you can specify a service ID.

   3

   Specify the service plan for your IBM Cloud account.

   4

   Specify the region name.

   Example command

   $ ibmcloud resource service-instance-create test-service-instance cloud-object-storage \ 1
   standard \
   global \
   -d premium-global-deployment 2

   1

   The service name is cloud-object-storage.

   2

   The -d flag specifies the deployment name.

9. Extract the service instance ID by running the following command:

   $ SERVICE_INSTANCE_ID=$(ibmcloud resource service-instance test-service-instance --output json | jq -r '.[0].id')

10. Create a COS bucket by running the following command:

    $ ibmcloud cos bucket-create \//
    --bucket $BUCKET \//
    --ibm-service-instance-id $SERVICE_INSTANCE_ID \//
    --region $REGION

    Variables such as $BUCKET, $SERVICE_INSTANCE_ID, and $REGION are replaced by the values you set previously.

11. Create HMAC credentials by running the following command.

    $ ibmcloud resource service-key-create test-key Writer --instance-name test-service-instance --parameters {\"HMAC\":true}

12. Extract the access key ID and the secret access key from the HMAC credentials and save them in the credentials-velero file. You can use the credentials-velero file to create a secret for the backup storage location. Run the following command:

    $ cat > credentials-velero << __EOF__
    [default]
    aws_access_key_id=$(ibmcloud resource service-key test-key -o json  | jq -r '.[0].credentials.cos_hmac_keys.access_key_id')
    aws_secret_access_key=$(ibmcloud resource service-key test-key -o json  | jq -r '.[0].credentials.cos_hmac_keys.secret_access_key')
    __EOF__

Procedure

1. Create a credentials-velero file for the snapshot location in the appropriate format for your cloud provider.

2. Create a Secret for the snapshot location with the default name:

   $ oc create secret generic cloud-credentials -n openshift-adp --from-file cloud=credentials-velero

3. Create a credentials-velero file for the backup location in the appropriate format for your object storage.

4. Create a Secret for the backup location with a custom name:

   $ oc create secret generic <custom_secret> -n openshift-adp --from-file cloud=credentials-velero

5. Add the Secret with the custom name to the DataProtectionApplication CR, as in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp
   spec:
   ...
     backupLocations:
       - velero:
           provider: <provider>
           default: true
           credential:
             key: cloud
             name: <custom_secret> 1
           objectStorage:
             bucket: <bucket_name>
             prefix: <prefix>

   1

   Backup location Secret with custom name.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     namespace: openshift-adp
     name: <dpa_name>
   spec:
     configuration:
       velero:
         defaultPlugins:
         - openshift
         - aws
         - csi
     backupLocations:
       - velero:
           provider: aws 1
           default: true
           objectStorage:
             bucket: <bucket_name> 2
             prefix: velero
           config:
             insecureSkipTLSVerify: 'true'
             profile: default
             region: <region_name> 3
             s3ForcePathStyle: 'true'
             s3Url: <s3_url> 4
           credential:
             key: cloud
             name: cloud-credentials 5

   1

   The provider is aws when you use IBM Cloud as a backup storage location.

   2

   Specify the IBM Cloud Object Storage (COS) bucket name.

   3

   Specify the COS region name, for example, eu-gb.

   4

   Specify the S3 URL of the COS bucket. For example, http://s3.eu-gb.cloud-object-storage.appdomain.cloud. Here, eu-gb is the region name. Replace the region name according to your bucket region.

   5

   Defines the name of the secret you created by using the access key and the secret access key from the HMAC credentials.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Configure the DPA with more than one BSL. See the following example.

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   #...
   backupLocations:
     - name: aws 1
       velero:
         provider: aws
         default: true 2
         objectStorage:
           bucket: <bucket_name> 3
           prefix: <prefix> 4
         config:
           region: <region_name> 5
           profile: "default"
         credential:
           key: cloud
           name: cloud-credentials 6
     - name: odf 7
       velero:
         provider: aws
         default: false
         objectStorage:
           bucket: <bucket_name>
           prefix: <prefix>
         config:
           profile: "default"
           region: <region_name>
           s3Url: <url> 8
           insecureSkipTLSVerify: "true"
           s3ForcePathStyle: "true"
         credential:
           key: cloud
           name: <custom_secret_name_odf> 9
   #...

   1

   Specify a name for the first BSL.

   2

   This parameter indicates that this BSL is the default BSL. If a BSL is not set in the Backup CR, the default BSL is used. You can set only one BSL as the default.

   3

   Specify the bucket name.

   4

   Specify a prefix for Velero backups; for example, velero.

   5

   Specify the AWS region for the bucket.

   6

   Specify the name of the default Secret object that you created.

   7

   Specify a name for the second BSL.

   8

   Specify the URL of the S3 endpoint.

   9

   Specify the correct name for the Secret; for example, custom_secret_name_odf. If you do not specify a Secret name, the default name is used.

2. Specify the BSL to be used in the backup CR. See the following example.

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   # ...
   spec:
     includedNamespaces:
     - <namespace> 1
     storageLocation: <backup_storage_location> 2
     defaultVolumesToFsBackup: true

   1

   Specify the namespace to back up.

   2

   Specify the storage location.

Procedure

1. To disable the nodeAgent, set the enable flag to false. See the following example:

   Example DataProtectionApplication CR

   # ...
   configuration:
     nodeAgent:
       enable: false  1
       uploaderType: kopia
   # ...

   1

   Disables the node agent.

2. To enable the nodeAgent, set the enable flag to true. See the following example:

   Example DataProtectionApplication CR

   # ...
   configuration:
     nodeAgent:
       enable: true  1
       uploaderType: kopia
   # ...

   1

   Enables the node agent.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - azure
           - openshift 2
         resourceTimeout: 10m 3
       nodeAgent: 4
         enable: true 5
         uploaderType: kopia 6
         podConfig:
           nodeSelector: <node_selector> 7
     backupLocations:
       - velero:
           config:
             resourceGroup: <azure_resource_group> 8
             storageAccount: <azure_storage_account_id> 9
             subscriptionId: <azure_subscription_id> 10
             storageAccountKeyEnvVar: AZURE_STORAGE_ACCOUNT_ACCESS_KEY
           credential:
             key: cloud
             name: cloud-credentials-azure  11
           provider: azure
           default: true
           objectStorage:
             bucket: <bucket_name> 12
             prefix: <prefix> 13
     snapshotLocations: 14
       - velero:
           config:
             resourceGroup: <azure_resource_group>
             subscriptionId: <azure_subscription_id>
             incremental: "true"
           name: default
           provider: azure
           credential:
             key: cloud
             name: cloud-credentials-azure 15

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   The openshift plugin is mandatory.

   3

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   4

   The administrative agent that routes the administrative requests to servers.

   5

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   6

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   7

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   8

   Specify the Azure resource group.

   9

   Specify the Azure storage account ID.

   10

   Specify the Azure subscription ID.

   11

   If you do not specify this value, the default name, cloud-credentials-azure, is used. If you specify a custom name, the custom name is used for the backup location.

   12

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   13

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

   14

   You do not need to specify a snapshot location if you use CSI snapshots or Restic to back up PVs.

   15

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials-azure, is used. If you specify a custom name, the custom name is used for the backup location.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Log in to GCP:

   $ gcloud auth login

2. Set the BUCKET variable:

   $ BUCKET=<bucket> 1

   1

   Specify your bucket name.

3. Create the storage bucket:

   $ gsutil mb gs://$BUCKET/

4. Set the PROJECT_ID variable to your active project:

   $ PROJECT_ID=$(gcloud config get-value project)

5. Create a service account:

   $ gcloud iam service-accounts create velero \
       --display-name "Velero service account"

6. List your service accounts:

   $ gcloud iam service-accounts list

7. Set the SERVICE_ACCOUNT_EMAIL variable to match its email value:

   $ SERVICE_ACCOUNT_EMAIL=$(gcloud iam service-accounts list \
       --filter="displayName:Velero service account" \
       --format 'value(email)')

8. Attach the policies to give the velero user the minimum necessary permissions:

   $ ROLE_PERMISSIONS=(
       compute.disks.get
       compute.disks.create
       compute.disks.createSnapshot
       compute.snapshots.get
       compute.snapshots.create
       compute.snapshots.useReadOnly
       compute.snapshots.delete
       compute.zones.get
       storage.objects.create
       storage.objects.delete
       storage.objects.get
       storage.objects.list
       iam.serviceAccounts.signBlob
   )

9. Create the velero.server custom role:

   $ gcloud iam roles create velero.server \
       --project $PROJECT_ID \
       --title "Velero Server" \
       --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")"

10. Add IAM policy binding to the project:

    $ gcloud projects add-iam-policy-binding $PROJECT_ID \
        --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
        --role projects/$PROJECT_ID/roles/velero.server

11. Update the IAM service account:

    $ gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://${BUCKET}

12. Save the IAM service account keys to the credentials-velero file in the current directory:

    $ gcloud iam service-accounts keys create credentials-velero \
        --iam-account $SERVICE_ACCOUNT_EMAIL

    You use the credentials-velero file to create a Secret object for GCP before you install the Data Protection Application.

Procedure

1. Create an oadp-credrequest directory by running the following command:

   $ mkdir -p oadp-credrequest

2. Create a CredentialsRequest.yaml file as following:

   echo 'apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: oadp-operator-credentials
     namespace: openshift-cloud-credential-operator
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: GCPProviderSpec
       permissions:
       - compute.disks.get
       - compute.disks.create
       - compute.disks.createSnapshot
       - compute.snapshots.get
       - compute.snapshots.create
       - compute.snapshots.useReadOnly
       - compute.snapshots.delete
       - compute.zones.get
       - storage.objects.create
       - storage.objects.delete
       - storage.objects.get
       - storage.objects.list
       - iam.serviceAccounts.signBlob
       skipServiceCheck: true
     secretRef:
       name: cloud-credentials-gcp
       namespace: <OPERATOR_INSTALL_NS>
     serviceAccountNames:
     - velero
   ' > oadp-credrequest/credrequest.yaml

3. Use the ccoctl utility to process the CredentialsRequest objects in the oadp-credrequest directory by running the following command:

   $ ccoctl gcp create-service-accounts \
       --name=<name> \
       --project=<gcp_project_id> \
       --credentials-requests-dir=oadp-credrequest \
       --workload-identity-pool=<pool_id> \
       --workload-identity-provider=<provider_id>

   The manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml file is now available to use in the following steps.

4. Create a namespace by running the following command:

   $ oc create namespace <OPERATOR_INSTALL_NS>

5. Apply the credentials to the namespace by running the following command:

   $ oc apply -f manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: <OPERATOR_INSTALL_NS> 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - gcp
           - openshift 2
         resourceTimeout: 10m 3
       nodeAgent: 4
         enable: true 5
         uploaderType: kopia 6
         podConfig:
           nodeSelector: <node_selector> 7
     backupLocations:
       - velero:
           provider: gcp
           default: true
           credential:
             key: cloud 8
             name: cloud-credentials-gcp 9
           objectStorage:
             bucket: <bucket_name> 10
             prefix: <prefix> 11
     snapshotLocations: 12
       - velero:
           provider: gcp
           default: true
           config:
             project: <project>
             snapshotLocation: us-west1 13
           credential:
             key: cloud
             name: cloud-credentials-gcp 14
     backupImages: true 15

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   The openshift plugin is mandatory.

   3

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   4

   The administrative agent that routes the administrative requests to servers.

   5

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   6

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   7

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   8

   Secret key that contains credentials. For Google workload identity federation cloud authentication use service_account.json.

   9

   Secret name that contains credentials. If you do not specify this value, the default name, cloud-credentials-gcp, is used.

   10

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   11

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

   12

   Specify a snapshot location, unless you use CSI snapshots or Restic to back up PVs.

   13

   The snapshot location must be in the same region as the PVs.

   14

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials-gcp, is used. If you specify a custom name, the custom name is used for the backup location.

   15

   Google workload identity federation supports internal image backup. Set this field to false if you do not want to use image backup.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Obtain the S3 endpoint, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY by running the describe command on the NooBaa custom resource.

2. Create a credentials-velero file:

   $ cat << EOF > ./credentials-velero
   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
   EOF

   You use the credentials-velero file to create a Secret object when you install the Data Protection Application.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - aws 2
           - openshift 3
         resourceTimeout: 10m 4
       nodeAgent: 5
         enable: true 6
         uploaderType: kopia 7
         podConfig:
           nodeSelector: <node_selector> 8
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: <region_name> 9
             s3Url: <url> 10
             insecureSkipTLSVerify: "true"
             s3ForcePathStyle: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name: cloud-credentials 11
           objectStorage:
             bucket: <bucket_name> 12
             prefix: <prefix> 13

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   An object store plugin corresponding to your storage locations is required. For all S3 providers, the required plugin is aws. For Azure and GCP object stores, the azure or gcp plugin is required.

   3

   The openshift plugin is mandatory.

   4

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   5

   The administrative agent that routes the administrative requests to servers.

   6

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   7

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   8

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   9

   Specify the region, following the naming convention of the documentation of your object storage server.

   10

   Specify the URL of the S3 endpoint.

   11

   Specify the name of the Secret object that you created. If you do not specify this value, the default name, cloud-credentials, is used. If you specify a custom name, the custom name is used for the backup location.

   12

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   13

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - aws 2
           - kubevirt 3
           - csi 4
           - openshift 5
         resourceTimeout: 10m 6
       nodeAgent: 7
         enable: true 8
         uploaderType: kopia 9
         podConfig:
           nodeSelector: <node_selector> 10
     backupLocations:
       - velero:
           provider: gcp 11
           default: true
           credential:
             key: cloud
             name: <default_secret> 12
           objectStorage:
             bucket: <bucket_name> 13
             prefix: <prefix> 14

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   An object store plugin corresponding to your storage locations is required. For all S3 providers, the required plugin is aws. For Azure and GCP object stores, the azure or gcp plugin is required.

   3

   Optional: The kubevirt plugin is used with OpenShift Virtualization.

   4

   Specify the csi default plugin if you use CSI snapshots to back up PVs. The csi plugin uses the Velero CSI beta snapshot APIs. You do not need to configure a snapshot location.

   5

   The openshift plugin is mandatory.

   6

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   7

   The administrative agent that routes the administrative requests to servers.

   8

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   9

   Enter kopia or restic as your uploader. You cannot change the selection after the installation. For the Built-in DataMover you must use Kopia. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   10

   Specify the nodes on which Kopia or Restic are available. By default, Kopia or Restic run on all nodes.

   11

   Specify the backup provider.

   12

   Specify the correct default name for the Secret, for example, cloud-credentials-gcp, if you use a default plugin for the backup provider. If specifying a custom name, then the custom name is used for the backup location. If you do not specify a Secret name, the default name is used.

   13

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   14

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

Procedure

1. Install the OADP Operator according to the instructions for your storage provider.
2. Install the Data Protection Application (DPA) with the kubevirt and openshift OADP plugins.

3. Back up virtual machines by creating a Backup custom resource (CR).

   Warning

   Red Hat support is limited to only the following options:

   • CSI backups
   • CSI backups with DataMover.

Procedure

1. Click Operators Installed Operators and select the OADP Operator.
2. Under Provided APIs, click Create instance in the DataProtectionApplication box.

3. Click YAML View and update the parameters of the DataProtectionApplication manifest:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: <dpa_sample>
     namespace: openshift-adp 1
   spec:
     configuration:
       velero:
         defaultPlugins:
           - kubevirt 2
           - gcp 3
           - csi 4
           - openshift 5
         resourceTimeout: 10m 6
       nodeAgent: 7
         enable: true 8
         uploaderType: kopia 9
         podConfig:
           nodeSelector: <node_selector> 10
     backupLocations:
       - velero:
           provider: gcp 11
           default: true
           credential:
             key: cloud
             name: <default_secret> 12
           objectStorage:
             bucket: <bucket_name> 13
             prefix: <prefix> 14

   1

   The default namespace for OADP is openshift-adp. The namespace is a variable and is configurable.

   2

   The kubevirt plugin is mandatory for OpenShift Virtualization.

   3

   Specify the plugin for the backup provider, for example, gcp, if it exists.

   4

   The csi plugin is mandatory for backing up PVs with CSI snapshots. The csi plugin uses the Velero CSI beta snapshot APIs. You do not need to configure a snapshot location.

   5

   The openshift plugin is mandatory.

   6

   Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.

   7

   The administrative agent that routes the administrative requests to servers.

   8

   Set this value to true if you want to enable nodeAgent and perform File System Backup.

   9

   Enter kopia as your uploader to use the Built-in DataMover. The nodeAgent deploys a daemon set, which means that the nodeAgent pods run on each working node. You can configure File System Backup by adding spec.defaultVolumesToFsBackup: true to the Backup CR.

   10

   Specify the nodes on which Kopia are available. By default, Kopia runs on all nodes.

   11

   Specify the backup provider.

   12

   Specify the correct default name for the Secret, for example, cloud-credentials-gcp, if you use a default plugin for the backup provider. If specifying a custom name, then the custom name is used for the backup location. If you do not specify a Secret name, the default name is used.

   13

   Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.

   14

   Specify a prefix for Velero backups, for example, velero, if the bucket is used for multiple purposes.

4. Click Create.

Verification

1. Verify the installation by viewing the OpenShift API for Data Protection (OADP) resources by running the following command:

   $ oc get all -n openshift-adp

   Example output

   NAME                                                     READY   STATUS    RESTARTS   AGE
   pod/oadp-operator-controller-manager-67d9494d47-6l8z8    2/2     Running   0          2m8s
   pod/node-agent-9cq4q                                     1/1     Running   0          94s
   pod/node-agent-m4lts                                     1/1     Running   0          94s
   pod/node-agent-pv4kr                                     1/1     Running   0          95s
   pod/velero-588db7f655-n842v                              1/1     Running   0          95s
   
   NAME                                                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   service/oadp-operator-controller-manager-metrics-service   ClusterIP   172.30.70.140    <none>        8443/TCP   2m8s
   service/openshift-adp-velero-metrics-svc                   ClusterIP   172.30.10.0      <none>        8085/TCP   8h
   
   NAME                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
   daemonset.apps/node-agent    3         3         3       3            3           <none>          96s
   
   NAME                                                READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/oadp-operator-controller-manager    1/1     1            1           2m9s
   deployment.apps/velero                              1/1     1            1           96s
   
   NAME                                                           DESIRED   CURRENT   READY   AGE
   replicaset.apps/oadp-operator-controller-manager-67d9494d47    1         1         1       2m9s
   replicaset.apps/velero-588db7f655                              1         1         1       96s

2. Verify that the DataProtectionApplication (DPA) is reconciled by running the following command:

   $ oc get dpa dpa-sample -n openshift-adp -o jsonpath='{.status}'

   Example output

   {"conditions":[{"lastTransitionTime":"2023-10-27T01:23:57Z","message":"Reconcile complete","reason":"Complete","status":"True","type":"Reconciled"}]}

3. Verify the type is set to Reconciled.

4. Verify the backup storage location and confirm that the PHASE is Available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example output

   NAME           PHASE       LAST VALIDATED   AGE     DEFAULT
   dpa-sample-1   Available   1s               3d16h   true

1. Backup supported
2. Incremental backup supported
3. Not supported

Procedure

1. Configure the DPA with more than one BSL. See the following example.

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   #...
   backupLocations:
     - name: aws 1
       velero:
         provider: aws
         default: true 2
         objectStorage:
           bucket: <bucket_name> 3
           prefix: <prefix> 4
         config:
           region: <region_name> 5
           profile: "default"
         credential:
           key: cloud
           name: cloud-credentials 6
     - name: odf 7
       velero:
         provider: aws
         default: false
         objectStorage:
           bucket: <bucket_name>
           prefix: <prefix>
         config:
           profile: "default"
           region: <region_name>
           s3Url: <url> 8
           insecureSkipTLSVerify: "true"
           s3ForcePathStyle: "true"
         credential:
           key: cloud
           name: <custom_secret_name_odf> 9
   #...

   1

   Specify a name for the first BSL.

   2

   This parameter indicates that this BSL is the default BSL. If a BSL is not set in the Backup CR, the default BSL is used. You can set only one BSL as the default.

   3

   Specify the bucket name.

   4

   Specify a prefix for Velero backups; for example, velero.

   5

   Specify the AWS region for the bucket.

   6

   Specify the name of the default Secret object that you created.

   7

   Specify a name for the second BSL.

   8

   Specify the URL of the S3 endpoint.

   9

   Specify the correct name for the Secret; for example, custom_secret_name_odf. If you do not specify a Secret name, the default name is used.

2. Specify the BSL to be used in the backup CR. See the following example.

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   # ...
   spec:
     includedNamespaces:
     - <namespace> 1
     storageLocation: <backup_storage_location> 2
     defaultVolumesToFsBackup: true

   1

   Specify the namespace to back up.

   2

   Specify the storage location.

Procedure

1. Create the first Secret for the AWS S3 storage provider with the default name by running the following command:

   $ oc create secret generic cloud-credentials -n openshift-adp --from-file cloud=<aws_credentials_file_name> 1

   1

   Specify the name of the cloud credentials file for AWS S3.

2. Create the second Secret for MCG with a custom name by running the following command:

   $ oc create secret generic mcg-secret -n openshift-adp --from-file cloud=<MCG_credentials_file_name> 1

   1

   Specify the name of the cloud credentials file for MCG. Note the name of the mcg-secret custom secret.

3. Configure the DPA with the two BSLs as shown in the following example.

   Example DPA

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: two-bsl-dpa
     namespace: openshift-adp
   spec:
     backupLocations:
     - name: aws
       velero:
         config:
           profile: default
           region: <region_name> 1
         credential:
           key: cloud
           name: cloud-credentials
         default: true
         objectStorage:
           bucket: <bucket_name> 2
           prefix: velero
         provider: aws
     - name: mcg
       velero:
         config:
           insecureSkipTLSVerify: "true"
           profile: noobaa
           region: <region_name> 3
           s3ForcePathStyle: "true"
           s3Url: <s3_url> 4
         credential:
           key: cloud
           name: mcg-secret 5
         objectStorage:
           bucket: <bucket_name_mcg> 6
           prefix: velero
         provider: aws
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
         - openshift
         - aws

   1

   Specify the AWS region for the bucket.

   2

   Specify the AWS S3 bucket name.

   3

   Specify the region, following the naming convention of the documentation of MCG.

   4

   Specify the URL of the S3 endpoint for MCG.

   5

   Specify the name of the custom secret for MCG storage.

   6

   Specify the MCG bucket name.

4. Create the DPA by running the following command:

   $ oc create -f <dpa_file_name> 1

   1

   Specify the file name of the DPA you configured.

5. Verify that the DPA has reconciled by running the following command:

   $ oc get dpa -o yaml

6. Verify that the BSLs are available by running the following command:

   $ oc get bsl

   Example output

   NAME   PHASE       LAST VALIDATED   AGE     DEFAULT
   aws    Available   5s               3m28s   true
   mcg    Available   5s               3m28s

7. Create a backup CR with the default BSL.

   Note

   In the following example, the storageLocation field is not specified in the backup CR.

   Example backup CR

   apiVersion: velero.io/v1
   kind: Backup
   metadata:
     name: test-backup1
     namespace: openshift-adp
   spec:
     includedNamespaces:
     - <mysql_namespace> 1
     defaultVolumesToFsBackup: true

   1

   Specify the namespace for the application installed in the cluster.

8. Create a backup by running the following command:

   $ oc apply -f <backup_file_name> 1

   1

   Specify the name of the backup CR file.

9. Verify that the backup completed with the default BSL by running the following command:

   $ oc get backups.velero.io <backup_name> -o yaml 1

   1

   Specify the name of the backup.

10. Create a backup CR by using MCG as the BSL. In the following example, note that the second storageLocation value is specified at the time of backup CR creation.

    Example backup CR

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup1
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <mysql_namespace> 1
      storageLocation: mcg 2
      defaultVolumesToFsBackup: true

    1

    Specify the namespace for the application installed in the cluster.

    2

    Specify the second storage location.

11. Create a second backup by running the following command:

    $ oc apply -f <backup_file_name> 1

    1

    Specify the name of the backup CR file.

12. Verify that the backup completed with the storage location as MCG by running the following command:

    $ oc get backups.velero.io <backup_name> -o yaml 1

    1

    Specify the name of the backup.

Procedure

1. To preview the resources included in the backup before running the actual backup, run the following command:

   $ velero backup create <backup-name> --snapshot-volumes false 1

   1

   Specify the value of --snapshot-volumes parameter as false.

2. To know more details about the backup resources, run the following command:

   $ velero describe backup <backup_name> --details 1

   1

   Specify the name of the backup.

3. To preview the resources included in the restore before running the actual restore, run the following command:

   $ velero restore create --from-backup <backup-name> 1

   1

   Specify the name of the backup created to review the backup resources.

   Important

   The velero restore create command creates restore resources in the cluster. You must delete the resources created as part of the restore, after you review the resources.

4. To know more details about the restore resources, run the following command:

   $ velero describe restore <restore_name> --details 1

   1

   Specify the name of the restore.