Chapter 4. OADP Application backup and restore

Procedure

1. Create an OBC manifest file to request a NooBaa MCG bucket as shown in the following example:

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket

   Copy to Clipboard Toggle word wrap

   where:

   test-obc

   Specifies the name of the object bucket claim.

   test-backup-bucket

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

   Copy to Clipboard Toggle word wrap

   where:

   <obc_file_name>

   Specifies the file name of the object bucket claim manifest.

3. When you create an OBC, ODF creates a secret and a config map with the same name as the object bucket claim. The secret has the bucket credentials, and the config map has information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc

   Copy to Clipboard Toggle word wrap

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard Toggle word wrap

4. To get the bucket credentials from the generated secret, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard Toggle word wrap

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard Toggle word wrap

5. Get the public URL for the S3 endpoint from the s3 route in the openshift-storage namespace by running the following command:

   $ oc get route s3 -n openshift-storage

   Copy to Clipboard Toggle word wrap

6. Create a cloud-credentials file with the object bucket credentials as shown in the following command:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard Toggle word wrap

7. Create the cloud-credentials secret with the cloud-credentials file content as shown in the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard Toggle word wrap

8. Configure the Data Protection Application (DPA) as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name>
             prefix: oadp

   Copy to Clipboard Toggle word wrap

   where:

   defaultSnapshotMoveData

   Set to true to use the OADP Data Mover to enable movement of Container Storage Interface (CSI) snapshots to a remote object storage.

   s3Url

   Specifies the S3 URL of ODF storage.

   <bucket_name>

   Specifies the bucket name.

9. Create the DPA by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard Toggle word wrap

10. Verify that the DPA is created successfully by running the following command. In the example output, you can see the status object has type field set to Reconciled. This means, the DPA is successfully created.

    $ oc get dpa -o yaml

    Copy to Clipboard Toggle word wrap

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard Toggle word wrap

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard Toggle word wrap

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard Toggle word wrap

12. Configure a backup CR as shown in the following example:

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace>

    Copy to Clipboard Toggle word wrap

    where:

    <application_namespace>

    Specifies the namespace for the application to back up.

13. Create the backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard Toggle word wrap

Procedure

1. Create a restore CR as shown in the following example:

   apiVersion: velero.io/v1
   kind: Restore
   metadata:
     name: test-restore
     namespace: openshift-adp
   spec:
     backupName: <backup_name>
     restorePVs: true
     namespaceMapping:
       <application_namespace>: test-restore-application

   Copy to Clipboard Toggle word wrap

   where:

   test-restore

   Specifies the name of the restore CR.

   <backup_name>

   Specifies the name of the backup.

   <application_namespace>

   Specifies the target namespace to restore to. namespaceMapping maps the source application namespace to the target application namespace. test-restore-application is the name of target namespace where you want to restore the backup.

2. Apply the restore CR by running the following command:

   $ oc apply -f <restore_cr_filename>

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the restore is in the Completed phase by running the following command:

   $ oc describe restores.velero.io <restore_name> -n openshift-adp

   Copy to Clipboard Toggle word wrap

2. Change to the restored namespace test-restore-application by running the following command:

   $ oc project test-restore-application

   Copy to Clipboard Toggle word wrap

3. Verify the restored resources such as persistent volume claim (pvc), service (svc), deployment, secret, and config map by running the following command:

   $ oc get pvc,svc,deployment,secret,configmap

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                          STATUS   VOLUME
   persistentvolumeclaim/mysql   Bound    pvc-9b3583db-...-14b86
   
   NAME               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   service/mysql      ClusterIP   172....157     <none>        3306/TCP   2m56s
   service/todolist   ClusterIP   172.....15     <none>        8000/TCP   2m56s
   
   NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/mysql   0/1     1            0           2m55s
   
   NAME                                         TYPE                      DATA   AGE
   secret/builder-dockercfg-6bfmd               kubernetes.io/dockercfg   1      2m57s
   secret/default-dockercfg-hz9kz               kubernetes.io/dockercfg   1      2m57s
   secret/deployer-dockercfg-86cvd              kubernetes.io/dockercfg   1      2m57s
   secret/mysql-persistent-sa-dockercfg-rgp9b   kubernetes.io/dockercfg   1      2m57s
   
   NAME                                 DATA   AGE
   configmap/kube-root-ca.crt           1      2m57s
   configmap/openshift-service-ca.crt   1      2m57s

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an OBC manifest to request a NooBaa bucket as shown in the following example:

   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: test-obc
     namespace: openshift-adp
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: test-backup-bucket

   Copy to Clipboard Toggle word wrap

   where:

   test-obc

   Specifies the name of the object bucket claim.

   test-backup-bucket

   Specifies the name of the bucket.

2. Create the OBC by running the following command:

   $ oc create -f <obc_file_name>

   Copy to Clipboard Toggle word wrap

3. When you create an OBC, ODF creates a secret and a ConfigMap with the same name as the object bucket claim. The secret object contains the bucket credentials, and the ConfigMap object contains information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:

   $ oc extract --to=- cm/test-obc

   Copy to Clipboard Toggle word wrap

   test-obc is the name of the OBC.

   Example output

   # BUCKET_NAME
   backup-c20...41fd
   # BUCKET_PORT
   443
   # BUCKET_REGION
   
   # BUCKET_SUBREGION
   
   # BUCKET_HOST
   s3.openshift-storage.svc

   Copy to Clipboard Toggle word wrap

4. To get the bucket credentials from the secret object, run the following command:

   $ oc extract --to=- secret/test-obc

   Copy to Clipboard Toggle word wrap

   Example output

   # AWS_ACCESS_KEY_ID
   ebYR....xLNMc
   # AWS_SECRET_ACCESS_KEY
   YXf...+NaCkdyC3QPym

   Copy to Clipboard Toggle word wrap

5. Create a cloud-credentials file with the object bucket credentials by using the following example configuration:

   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

   Copy to Clipboard Toggle word wrap

6. Create the cloud-credentials secret with the cloud-credentials file content by running the following command:

   $ oc create secret generic \
     cloud-credentials \
     -n openshift-adp \
     --from-file cloud=cloud-credentials

   Copy to Clipboard Toggle word wrap

7. Extract the service CA certificate from the openshift-service-ca.crt config map by running the following command. Ensure that you encode the certificate in Base64 format and note the value to use in the next step.

   $ oc get cm/openshift-service-ca.crt \
     -o jsonpath='{.data.service-ca\.crt}' | base64 -w0; echo

   Copy to Clipboard Toggle word wrap

   Example output

   LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0...
   ....gpwOHMwaG9CRmk5a3....FLS0tLS0K

   Copy to Clipboard Toggle word wrap

8. Configure the DataProtectionApplication CR manifest file with the bucket name and CA certificate as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "false"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name>
             prefix: oadp
             caCert: <ca_cert>

   Copy to Clipboard Toggle word wrap

   where:

   insecureSkipTLSVerify

   Specifies whether SSL/TLS security is enabled. If set to true, SSL/TLS security is disabled. If set to false, SSL/TLS security is enabled.

   <bucket_name>

   Specifies the name of the bucket extracted in an earlier step.

   <ca_cert>

   Specifies the Base64 encoded certificate from the previous step.

9. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard Toggle word wrap

10. Verify that the DataProtectionApplication CR is created successfully by running the following command:

    $ oc get dpa -o yaml

    Copy to Clipboard Toggle word wrap

    Example output

    apiVersion: v1
    items:
    - apiVersion: oadp.openshift.io/v1alpha1
      kind: DataProtectionApplication
      metadata:
        namespace: openshift-adp
        #...#
      spec:
        backupLocations:
        - velero:
            config:
              #...#
      status:
        conditions:
        - lastTransitionTime: "20....9:54:02Z"
          message: Reconcile complete
          reason: Complete
          status: "True"
          type: Reconciled
    kind: List
    metadata:
      resourceVersion: ""

    Copy to Clipboard Toggle word wrap

11. Verify that the backup storage location (BSL) is available by running the following command:

    $ oc get backupstoragelocations.velero.io -n openshift-adp

    Copy to Clipboard Toggle word wrap

    Example output

    NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
    dpa-sample-1   Available   3s               15s   true

    Copy to Clipboard Toggle word wrap

12. Configure the Backup CR by using the following example:

    apiVersion: velero.io/v1
    kind: Backup
    metadata:
      name: test-backup
      namespace: openshift-adp
    spec:
      includedNamespaces:
      - <application_namespace>

    Copy to Clipboard Toggle word wrap

    where:

    <application_namespace>

    Specifies the namespace for the application to back up.

13. Create the Backup CR by running the following command:

    $ oc apply -f <backup_cr_filename>

    Copy to Clipboard Toggle word wrap

Procedure

1. Configure the DataProtectionApplication CR to use the legacy-aws Velero plugin as shown in the following example:

   apiVersion: oadp.openshift.io/v1alpha1
   kind: DataProtectionApplication
   metadata:
     name: oadp-backup
     namespace: openshift-adp
   spec:
     configuration:
       nodeAgent:
         enable: true
         uploaderType: kopia
       velero:
         defaultPlugins:
           - legacy-aws
           - openshift
           - csi
         defaultSnapshotMoveData: true
     backupLocations:
       - velero:
           config:
             profile: "default"
             region: noobaa
             s3Url: https://s3.openshift-storage.svc
             s3ForcePathStyle: "true"
             insecureSkipTLSVerify: "true"
           provider: aws
           default: true
           credential:
             key: cloud
             name:  cloud-credentials
           objectStorage:
             bucket: <bucket_name>
             prefix: oadp

   Copy to Clipboard Toggle word wrap

   where:

   legacy-aws

   Specifies to use the legacy-aws plugin.

   <bucket_name>

   Specifies the bucket name.

2. Create the DataProtectionApplication CR by running the following command:

   $ oc apply -f <dpa_filename>

   Copy to Clipboard Toggle word wrap

3. Verify that the DataProtectionApplication CR is created successfully by running the following command. In the example output, you can see the status object has the type field set to Reconciled and the status field set to "True". That status indicates that the DataProtectionApplication CR is successfully created.

   $ oc get dpa -o yaml

   Copy to Clipboard Toggle word wrap

   Example output

   apiVersion: v1
   items:
   - apiVersion: oadp.openshift.io/v1alpha1
     kind: DataProtectionApplication
     metadata:
       namespace: openshift-adp
       #...#
     spec:
       backupLocations:
       - velero:
           config:
             #...#
     status:
       conditions:
       - lastTransitionTime: "20....9:54:02Z"
         message: Reconcile complete
         reason: Complete
         status: "True"
         type: Reconciled
   kind: List
   metadata:
     resourceVersion: ""

   Copy to Clipboard Toggle word wrap

4. Verify that the backup storage location (BSL) is available by running the following command:

   $ oc get backupstoragelocations.velero.io -n openshift-adp

   Copy to Clipboard Toggle word wrap

   You should see an output similar to the following example:

   NAME           PHASE       LAST VALIDATED   AGE   DEFAULT
   dpa-sample-1   Available   3s               15s   true

   Copy to Clipboard Toggle word wrap

5. Configure a Backup CR as shown in the following example:

   apiVersion: velero.io/v1
   kind: Backup
   metadata:
     name: test-backup
     namespace: openshift-adp
   spec:
     includedNamespaces:
     - <application_namespace>

   Copy to Clipboard Toggle word wrap

   where:

   <application_namespace>

   Specifies the namespace for the application to back up.

6. Create the Backup CR by running the following command:

   $ oc apply -f <backup_cr_filename>

   Copy to Clipboard Toggle word wrap

Procedure

1. Set the BUCKET variable:

   $ BUCKET=<your_bucket>

   Copy to Clipboard Toggle word wrap

2. Set the REGION variable:

   $ REGION=<your_region>

   Copy to Clipboard Toggle word wrap

3. Create an AWS S3 bucket:

   $ aws s3api create-bucket \
       --bucket $BUCKET \
       --region $REGION \
       --create-bucket-configuration LocationConstraint=$REGION

   Copy to Clipboard Toggle word wrap

   where:

   LocationConstraint

   Specifies the bucket configuration location constraint. us-east-1 does not support LocationConstraint. If your region is us-east-1, omit --create-bucket-configuration LocationConstraint=$REGION.

4. Create an IAM user:

   $ aws iam create-user --user-name velero

   Copy to Clipboard Toggle word wrap

   where:

   velero

   Specifies the user name. If you want to use Velero to back up multiple clusters with multiple S3 buckets, create a unique user name for each cluster.

5. Create a velero-policy.json file:

   $ cat > velero-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeVolumes",
                   "ec2:DescribeSnapshots",
                   "ec2:CreateTags",
                   "ec2:CreateVolume",
                   "ec2:CreateSnapshot",
                   "ec2:DeleteSnapshot"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:DeleteObject",
                   "s3:PutObject",
                   "s3:AbortMultipartUpload",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}/*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetBucketLocation",
                   "s3:ListBucketMultipartUploads"
               ],
               "Resource": [
                   "arn:aws:s3:::${BUCKET}"
               ]
           }
       ]
   }
   EOF

   Copy to Clipboard Toggle word wrap

6. Attach the policies to give the velero user the minimum necessary permissions:

   $ aws iam put-user-policy \
     --user-name velero \
     --policy-name velero \
     --policy-document file://velero-policy.json

   Copy to Clipboard Toggle word wrap

7. Create an access key for the velero user:

   $ aws iam create-access-key --user-name velero

   Copy to Clipboard Toggle word wrap

   {
     "AccessKey": {
           "UserName": "velero",
           "Status": "Active",
           "CreateDate": "2017-07-31T22:24:41.576Z",
           "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>,
           "AccessKeyId": <AWS_ACCESS_KEY_ID>
     }
   }

   Copy to Clipboard Toggle word wrap

8. Create a credentials-velero file:

   $ cat << EOF > ./credentials-velero
   [default]
   aws_access_key_id=<AWS_ACCESS_KEY_ID>
   aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
   EOF

   Copy to Clipboard Toggle word wrap

   You use the credentials-velero file to create a Secret object for AWS before you install the Data Protection Application.