Skip to content

Guance Cluster Backup and Restore

Important Notes

Velero backs up Kubernetes configuration (YAML files) as described in this document, but does not include PVC volume data.

Introduction

Velero is an open-source tool that safely backs up and restores, performs disaster recovery, and migrates Kubernetes cluster resources and persistent volumes.

  • Disaster Recovery
    Velero reduces recovery time in the event of infrastructure loss, data corruption, and/or service interruption.

  • Data Migration
    Velero enables cluster portability by easily migrating Kubernetes resources from one cluster to another.

  • Data Protection
    Provides critical data protection features such as scheduled backups, retention policies, and pre/post-backup hooks for custom actions.

  • Backup Clusters
    Back up Kubernetes resources and volumes for the entire cluster or a subset using namespace resources or label selectors.

  • Scheduled Backups
    Set up schedules to automatically start backups at regular intervals.

  • Backup Hooks
    Configure pre- and post-backup hooks to execute custom actions before and after the Velero backup.

Basic Information and Compatibility

Name Description
Velero Version 1.13.0
Offline Installation Yes
Supported Architectures amd64 / arm64

Offline Download List

Name Download URL
Velero CLI Amd Download
Arm Download
Velero Image Amd Download
Arm Download

Import Images

gunzip -c velero-amd64.tar.gz | docker load

gunzip velero-amd64.tar.gz
ctr -n=k8s.io images import velero-amd64.tar

gunzip -c velero-arm64.tar.gz | docker load

gunzip velero-arm64.tar.gz
ctr -n=k8s.io images import velero-arm64.tar

Prerequisites

  • A Kubernetes cluster must be deployed and accessible via kubectl. If not yet deployed, refer to Kubernetes Deployment.

Install Velero

Object Storage Settings

Create an S3 Bucket

Velero requires an object storage bucket to store backups. It is recommended to use a bucket unique to the Kubernetes cluster (see FAQ for details). Create an S3 bucket, replacing the placeholders as appropriate:

BUCKET=<YOUR_BUCKET>
REGION=<YOUR_REGION>
aws s3api create-bucket \
    --bucket $BUCKET \
    --region $REGION \
    --create-bucket-configuration LocationConstraint=$REGION

us-east-1 does not support LocationConstraint. If your region is us-east-1, omit the bucket configuration:

aws s3api create-bucket \
    --bucket $BUCKET \
    --region us-east-1

Set Up Permissions for Velero

The following method sets up permissions via an IAM user. For other methods, refer to Set Permissions Using kube2iam.

For more information, see the AWS IAM User Guide.

  1. Create an IAM user:
aws iam create-user --user-name velero

If you plan to back up multiple clusters with multiple S3 buckets, it is recommended to create a unique user name for each cluster instead of the default velero.

  1. Attach a policy to grant the necessary permissions to velero:
cat > velero-policy.json <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVolumes",
                "ec2:DescribeSnapshots",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:CreateSnapshot",
                "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::${BUCKET}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::${BUCKET}"
            ]
        }
    ]
}
EOF

aws iam put-user-policy \
  --user-name velero \
  --policy-name velero \
  --policy-document file://velero-policy.json
  1. Create an access key for the user:
aws iam create-access-key --user-name velero

Expected output:

{
  "AccessKey": {
        "UserName": "velero",
        "Status": "Active",
        "CreateDate": "2017-07-31T22:24:41.576Z",
        "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>,
        "AccessKeyId": <AWS_ACCESS_KEY_ID>
  }
}
  1. Create a Velero-specific credentials file (credentials-velero) in the local directory:
[default]
aws_access_key_id=<AWS_ACCESS_KEY_ID>
aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>

Create an OSS Bucket

Velero requires an object storage bucket to store backups. It is recommended to use a bucket unique to the cluster. Create an OSS bucket, replacing the placeholders as appropriate:

BUCKET=<YOUR_BUCKET>
REGION=<YOUR_REGION>
ossutil mb oss://$BUCKET \
        --storage-class Standard \
        --acl=private

Create a RAM User

  1. Create a user

Refer to the Alibaba Cloud documentation: RAM User Guide.

If you plan to back up multiple clusters with multiple OSS buckets, it is recommended to create a unique user name for each cluster instead of the default velero.

  1. Attach a policy to grant the necessary permissions to velero:

Note: For security reasons, it is recommended to revoke the Delete permissions after completing backup or restore tasks.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:DescribeSnapshots",
                "ecs:CreateSnapshot",
                "ecs:DeleteSnapshot",
                "ecs:DescribeDisks",
                "ecs:CreateDisk",
                "ecs:Addtags",
                "oss:PutObject",
                "oss:GetObject",
                "oss:DeleteObject",
                "oss:GetBucket",
                "oss:ListObjects",
                "oss:ListBuckets"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        }
    ]
}
  1. Create an access key for the user:

Refer to the Alibaba Cloud documentation: Create an AccessKey.

  1. Create a Velero-specific credentials file (credentials-velero) in your installation directory:
ALIBABA_CLOUD_ACCESS_KEY_ID=<ALIBABA_CLOUD_ACCESS_KEY_ID>
ALIBABA_CLOUD_ACCESS_KEY_SECRET=<ALIBABA_CLOUD_ACCESS_KEY_SECRET>

Install Velero CLI and Configure

Install CLI

wget https://static.guance.com/dataflux/package/velero-v1.13.0-linux-amd64.tar.gz && tar -xvf velero-v1.13.0-linux-amd64.tar.gz && mv velero-v1.13.0-linux-amd64/velero /bin

wget https://static.guance.com/dataflux/package/velero-v1.13.0-linux-arm64.tar.gz && tar -xvf velero-v1.13.0-linux-arm64.tar.gz && mv velero-v1.13.0-linux-arm64/velero /bin

Offline Installation (Optional) CLI

tar -xvf velero-v1.13.0-linux-amd64.tar.gz && mv velero-v1.13.0-linux-amd64/velero /bin

tar -xvf velero-v1.13.0-linux-arm64.tar.gz && mv velero-v1.13.0-linux-arm64/velero /bin

Verify Installation

velero -h

Start Velero

Set some environment variables:

BUCKET=<YOUR_BUCKET>
REGION=<YOUR_REGION>
BUCKETPATH=<YOUR_BUCKETPATH>

Run the initialization command:

velero install \
    --provider aws \
    --image pubrepo.guance.com/googleimages/velero:v1.13.0 \
    --plugins pubrepo.guance.com/googleimages/velero-plugin-for-aws:v1.9.0 \
    --bucket $BUCKET \
    --backup-location-config region=$REGION \
    --snapshot-location-config region=$REGION \
    --secret-file ./credentials-velero \
    --prefix $BUCKETPATH \
    --backup-location-config s3ForcePathStyle="true",s3Url=https://s3.$BUCKET.amazonaws.com.cn

For overseas nodes, change s3Url to https://s3.$BUCKET.amazonaws.com.

Set some environment variables:

BUCKET=<YOUR_BUCKET>
REGION=<YOUR_REGION>
BUCKETPATH=<YOUR_BUCKETPATH>

Run the initialization command:

velero install \
  --provider alibabacloud \
  --image pubrepo.guance.com/googleimages/velero:v1.13.0 \
  --bucket $BUCKET \
  --secret-file ./credentials-velero \
  --use-volume-snapshots=false \
  --backup-location-config region=$REGION \
  --prefix $BUCKETPATH \
  --plugins pubrepo.guance.com/googleimages/velero-plugin-alibabacloud:v1.9.6-581f313-aliyun

Verify Installation

Create a Test Service
kubectl create deployment demo --image=nginx
kubectl get pod
Backup

Run the backup command:

velero backup create demo

View the backup:

$ velero get backup
NAME   STATUS      ERRORS   WARNINGS   CREATED                         EXPIRES   STORAGE LOCATION   SELECTOR
demo   Completed   0        0          2024-03-04 18:31:28 +0800 CST   29d       default            <none>
Delete and Restore Test

Delete the service:

$ kubectl delete -n default deploy demo

deployment.apps "demo" deleted

Restore:

$ velero restore create --from-backup demo --include-namespaces default --selector app=demo

Restore request "demo-20240304184105" submitted successfully.
Run `velero restore describe demo-20240304184105` or `velero restore logs demo-20240304184105` for more details.

velero restore create --from-backup {{backup_name}} --restore-volumes --include-namespaces {{namespace_name}} --selector app={{app_label}}

Verify:

$ kubectl get pod
NAME                    READY   STATUS    RESTARTS   AGE
demo-68b4b4d5bf-qxr26   1/1     Running   0          46s

Set Up Scheduled Backups

Backup daily at 1:00 AM (without PVC data), retain for 7 days.

$ velero create schedule all-guance  --schedule="0 01 * * *"  --ttl 168h
$ velero get schedule

NAME         STATUS    CREATED                         SCHEDULE    BACKUP TTL   LAST BACKUP   SELECTOR   PAUSED
all-guance   Enabled   2024-03-04 18:44:55 +0800 CST   0 1 * * *   168h0m0s     n/a           <none>     false

Uninstall

rm -f /bin/velero
velero uninstall

Other

velero get backup                                         # View backups
velero get schedule                                       # View scheduled backups
velero get restore                                        # View existing restores
velero get plugins                                        # View plugins
velero restore create --from-backup all-ns-backup         # Restore all cluster backups (does not overwrite existing services)
velero restore create --from-backup all-ns-backup --include-namespaces default,nginx-example  # Restore only default and nginx-example namespaces

# Velero can restore resources to a different namespace from the original backup. Use the --namespace-mappings flag:
velero restore create RESTORE_NAME --from-backup BACKUP_NAME --namespace-mappings old-ns-1:new-ns-1,old-ns-2:new-ns-2
# Example: restore resources from namespace test-velero to test-velero-1:
velero restore create restore-for-test --from-backup everyday-1-20210203131802 --namespace-mappings test-velero:test-velero-1

# Scheduled backup
velero create schedule prd-aws-df --schedule="0 1 * * *" --ttl 168h

Feedback

Is this page helpful?