1.6. Installing and configuring OADP

Procedure

1. Create the following environment variables by running the following commands:

   중요

   Change the cluster name to match your cluster, and ensure you are logged into the cluster as an administrator. Ensure that all fields are outputted correctly before continuing.

   $ export CLUSTER_NAME=<my_cluster>

   Replace <my_cluster> with your cluster name.

   $ export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)

   $ export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)

   $ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')

   $ export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

   $ export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')

   $ export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"

   $ export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"

   $ mkdir -p ${SCRATCH}

   $ echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
     ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"

2. On the AWS account, create an IAM policy to allow access to AWS S3:

   1. Check to see if the policy exists by running the following command:

      $ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaOadpVer1'].{ARN:Arn}" --output text)

      • RosaOadp: Replace RosaOadp with your policy name.

   2. Enter the following command to create the policy JSON file and then create the policy:

      참고

      If the policy ARN is not found, the command creates the policy. If the policy ARN already exists, the if statement intentionally skips the policy creation.

      $ if [[ -z "${POLICY_ARN}" ]]; then
        cat << EOF > ${SCRATCH}/policy.json
        {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "s3:CreateBucket",
              "s3:DeleteBucket",
              "s3:PutBucketTagging",
              "s3:GetBucketTagging",
              "s3:PutEncryptionConfiguration",
              "s3:GetEncryptionConfiguration",
              "s3:PutLifecycleConfiguration",
              "s3:GetLifecycleConfiguration",
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject",
              "s3:ListBucketMultipartUploads",
              "s3:AbortMultipartUpload",
              "s3:ListMultipartUploadParts",
              "ec2:DescribeSnapshots",
              "ec2:DescribeVolumes",
              "ec2:DescribeVolumeAttribute",
              "ec2:DescribeVolumesModifications",
              "ec2:DescribeVolumeStatus",
              "ec2:CreateTags",
              "ec2:CreateVolume",
              "ec2:CreateSnapshot",
              "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
          }
        ]}
      EOF
      
        POLICY_ARN=$(aws iam create-policy --policy-name "RosaOadpVer1" \
        --policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
        --tags Key=rosa_openshift_version,Value=${CLUSTER_VERSION} Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-oadp Key=operator_name,Value=openshift-oadp \
        --output text)
        fi

      • SCRATCH: SCRATCH is a name for a temporary directory created for the environment variables.

   3. View the policy ARN by running the following command:

      $ echo ${POLICY_ARN}

3. Create an IAM role trust policy for the cluster:

   1. Create the trust policy file by running the following command:

      $ cat <<EOF > ${SCRATCH}/trust-policy.json
        {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDC_ENDPOINT}:sub": [
                    "system:serviceaccount:openshift-adp:openshift-adp-controller-manager",
                    "system:serviceaccount:openshift-adp:velero"]
                }
              }
            }]
        }
      EOF

   2. Create the role by running the following command:

      $ ROLE_ARN=$(aws iam create-role --role-name \
        "${ROLE_NAME}" \
        --assume-role-policy-document file://${SCRATCH}/trust-policy.json \
        --tags Key=rosa_cluster_id,Value=${ROSA_CLUSTER_ID} \
               Key=rosa_openshift_version,Value=${CLUSTER_VERSION} \
               Key=rosa_role_prefix,Value=ManagedOpenShift \
               Key=operator_namespace,Value=openshift-adp \
               Key=operator_name,Value=openshift-oadp \
        --query Role.Arn --output text)

   3. View the role ARN by running the following command:

      $ echo ${ROLE_ARN}

4. Attach the IAM policy to the IAM role by running the following command:

   $ aws iam attach-role-policy --role-name "${ROLE_NAME}" \
     --policy-arn ${POLICY_ARN}

Procedure

1. Create a Red Hat OpenShift Service on AWS secret from your AWS token file by entering the following commands:

   1. Create the credentials file:

      $ cat <<EOF > ${SCRATCH}/credentials
        [default]
        role_arn = ${ROLE_ARN}
        web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
        region = <aws_region>
      EOF

      Replace <aws_region> with the AWS region to use for the STS endpoint.

   2. Create a namespace for OADP:

      $ oc create namespace openshift-adp

   3. Create the Red Hat OpenShift Service on AWS secret:

      $ oc -n openshift-adp create secret generic cloud-credentials \
        --from-file=${SCRATCH}/credentials

      참고

      In Red Hat OpenShift Service on AWS versions 4.15 and later, the OADP Operator supports a new standardized STS workflow through the Operator Lifecycle Manager (OLM) and Cloud Credentials Operator (CCO). In this workflow, you do not need to create the above secret, you only need to supply the role ARN during the installation of OLM-managed operators using the Red Hat OpenShift Service on AWS web console, for more information see Installing from software catalog using the web console.

      The preceding secret is created automatically by CCO.

2. Install the OADP Operator:

   1. In the Red Hat OpenShift Service on AWS web console, browse to Ecosystem Software Catalog.
   2. Search for the OADP Operator.
   3. In the role_ARN field, paste the role_arn that you created previously and click Install.

3. Create AWS cloud storage using your AWS credentials by entering the following command:

   $ cat << EOF | oc create -f -
     apiVersion: oadp.openshift.io/v1alpha1
     kind: CloudStorage
     metadata:
       name: ${CLUSTER_NAME}-oadp
       namespace: openshift-adp
     spec:
       creationSecret:
         key: credentials
         name: cloud-credentials
       enableSharedConfig: true
       name: ${CLUSTER_NAME}-oadp
       provider: aws
       region: $REGION
   EOF

4. Check your application’s storage default storage class by entering the following command:

   $ oc get pvc -n <namespace>

   NAME     STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
   applog   Bound    pvc-351791ae-b6ab-4e8b-88a4-30f73caf5ef8   1Gi        RWO            gp3-csi        4d19h
   mysql    Bound    pvc-16b8e009-a20a-4379-accc-bc81fedd0621   1Gi        RWO            gp3-csi        4d19h

5. Get the storage class by running the following command:

   $ oc get storageclass

   NAME                PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
   gp2                 kubernetes.io/aws-ebs   Delete          WaitForFirstConsumer   true                   4d21h
   gp2-csi             ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3                 ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h
   gp3-csi (default)   ebs.csi.aws.com         Delete          WaitForFirstConsumer   true                   4d21h

   참고

   The following storage classes will work:

   • gp3-csi
   • gp2-csi
   • gp3
   • gp2

   If the application or applications that are being backed up are all using persistent volumes (PVs) with Container Storage Interface (CSI), it is advisable to include the CSI plugin in the OADP DPA configuration.

6. Create the DataProtectionApplication resource to configure the connection to the storage where the backups and volume snapshots are stored:

   1. If you are using only CSI volumes, deploy a Data Protection Application by entering the following command:

      $ cat << EOF | oc create -f -
        apiVersion: oadp.openshift.io/v1alpha1
        kind: DataProtectionApplication
        metadata:
          name: ${CLUSTER_NAME}-dpa
          namespace: openshift-adp
        spec:
          backupImages: true
          features:
            dataMover:
              enable: false
          backupLocations:
          - bucket:
              cloudStorageRef:
                name: ${CLUSTER_NAME}-oadp
              credential:
                key: credentials
                name: cloud-credentials
              prefix: velero
              default: true
              config:
                region: ${REGION}
          configuration:
            velero:
              defaultPlugins:
              - openshift
              - aws
              - csi
            nodeAgent:
              enable: false
              uploaderType: kopia
      EOF

      where:

      backupImages

      Red Hat OpenShift Service on AWS supports internal image backup. Set this field to false if you do not want to use image backup.

      nodeAgent

      See the important note regarding the nodeAgent attribute at the end of this procedure.

      uploaderType

      Specifies the type of uploader. The built-in Data Mover uses Kopia as the default uploader mechanism regardless of the value of the uploaderType field.

   2. If you are using CSI or non-CSI volumes, deploy a Data Protection Application by entering the following command:

      $ cat << EOF | oc create -f -
        apiVersion: oadp.openshift.io/v1alpha1
        kind: DataProtectionApplication
        metadata:
          name: ${CLUSTER_NAME}-dpa
          namespace: openshift-adp
        spec:
          backupImages: true
          backupLocations:
          - bucket:
              cloudStorageRef:
                name: ${CLUSTER_NAME}-oadp
              credential:
                key: credentials
                name: cloud-credentials
              prefix: velero
              default: true
              config:
                region: ${REGION}
          configuration:
            velero:
              defaultPlugins:
              - openshift
              - aws
            nodeAgent:
              enable: false
              uploaderType: restic
          snapshotLocations:
            - velero:
                config:
                  credentialsFile: /tmp/credentials/openshift-adp/cloud-credentials-credentials
                  enableSharedConfig: "true"
                  profile: default
                  region: ${REGION}
                provider: aws
      EOF

      where:

      backupImages

      Red Hat OpenShift Service on AWS supports internal image backup. Set this field to false if you do not want to use image backup.

      nodeAgent

      See the important note regarding the nodeAgent attribute at the end of this procedure.

      credentialsFile

      Specifies the mounted location of the bucket credential on the pod.

      enableSharedConfig

      Specifies whether the snapshotLocations can share or reuse the credential defined for the bucket.

      profile

      Specifies the profile name set in the AWS credentials file.

      region

      Specifies your AWS region. This must be the same as the cluster region.

      You are now ready to back up and restore Red Hat OpenShift Service on AWS applications, as described in Backing up applications.

      중요

      The enable parameter of restic is set to false in this configuration, because OADP does not support Restic in Red Hat OpenShift Service on AWS environments.

   If you want to use two different clusters for backing up and restoring, the two clusters must have the same AWS S3 storage names in both the cloud storage CR and the OADP DataProtectionApplication configuration.

Procedure

1. To verify that the OADP subscription has the wrong IAM role ARN environment variable set, run the following command:

   $ oc get sub -o yaml redhat-oadp-operator

   Example subscription

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     annotations:
     creationTimestamp: "2025-01-15T07:18:31Z"
     generation: 1
     labels:
       operators.coreos.com/redhat-oadp-operator.openshift-adp: ""
     name: redhat-oadp-operator
     namespace: openshift-adp
     resourceVersion: "77363"
     uid: 5ba00906-5ad2-4476-ae7b-ffa90986283d
   spec:
     channel: stable-1.4
     config:
       env:
       - name: ROLEARN
         value: arn:aws:iam::11111111:role/wrong-role-arn
     installPlanApproval: Manual
     name: redhat-oadp-operator
     source: prestage-operators
     sourceNamespace: openshift-marketplace
     startingCSV: oadp-operator.v1.4.2

   where:

   ROLEARN

   Verify the value of ROLEARN you want to update.

2. Update the ROLEARN field of the subscription with the correct role ARN by running the following command:

   $ oc patch subscription redhat-oadp-operator -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "<role_arn>"}]}}}' --type='merge'

   where:

   <role_arn>

   Specifies the IAM role ARN to be updated. For example, arn:aws:iam::160…​..6956:role/oadprosa…​..8wlf.

3. Verify that the secret object is updated with correct role ARN value by running the following command:

   $ oc get secret cloud-credentials -o jsonpath='{.data.credentials}' | base64 -d

   Example output

   [default]
   sts_regional_endpoints = regional
   role_arn = arn:aws:iam::160.....6956:role/oadprosa.....8wlf
   web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

4. Configure the DataProtectionApplication custom resource (CR) manifest file as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: test-rosa-dpa
     namespace: openshift-adp
   spec:
     backupLocations:
     - bucket:
         config:
           region: us-east-1
         cloudStorageRef:
           name: <cloud_storage>
         credential:
           name: cloud-credentials
           key: credentials
         prefix: velero
         default: true
     configuration:
       velero:
         defaultPlugins:
         - aws
         - openshift

   where:

   <cloud_storage>

   Specifies the CloudStorage CR.

5. Create the DataProtectionApplication CR by running the following command:

   $ oc create -f <dpa_manifest_file>

6. Verify that the DataProtectionApplication CR is reconciled and the status is set to "True" by running the following command:

   $  oc get dpa -n openshift-adp -o yaml

   Example DataProtectionApplication

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   ...
   status:
       conditions:
       - lastTransitionTime: "2023-07-31T04:48:12Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled

7. Verify that the BackupStorageLocation CR is in an available state by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Example BackupStorageLocation

   NAME       PHASE       LAST VALIDATED   AGE   DEFAULT
   ts-dpa-1   Available   3s               6s    true