Backing up your Kubernetes cluster with Velero

With Velero, you can create and restore backups of Kubernetes resources and persistent volumes in a Kubernetes cluster. Velero stores the Kubernetes resources and transferred snapshots in S3-compatible object storage, ensuring the backup remains available outside the cluster.

In this guide, you install Velero with a Helm chart. You connect Velero to TransIP Object Store, enable CSI Snapshot Data Movement, and then create and restore a backup.

Requirements

To follow this guide, you need:

• A Kubernetes cluster
• kubectl: install and configure kubectl on the computer or laptop you use to manage the cluster.
• Helm: install Helm on the same computer.
• TransIP Object Store: create a container for the Velero backups and note the S3 endpoint, access key, and secret key.

Installing Velero

Step 1

Add the official Velero repository to Helm and update the local repository index:

helm repo add vmware-tanzu https://vmware-tanzu.github.io/helm-charts/
helm repo update

Check which chart and Velero versions are available:

helm search repo vmware-tanzu/velero --versions

The --versions argument displays earlier available versions in addition to the latest chart.

Step 2

Create the namespace for Velero:

kubectl create namespace velero

Step 3

Open a new file for the Object Store credentials:

nano credentials-velero

Add the following content. Replace <access-key> and <secret-key> with your Object Store credentials:

[default]
aws_access_key_id=<access-key>
aws_secret_access_key=<secret-key>

Save the changes and close the file (ctrl + x > y > enter).

Use this file to create a Kubernetes Secret, and then delete the local file:

kubectl create secret generic velero-credentials --namespace velero --from-file=cloud=credentials-velero
rm credentials-velero

The --namespace velero argument creates the Secret in the Velero namespace. The --from-file=cloud=credentials-velero argument stores the content under the key cloud, as expected by the AWS plugin.

Step 4

Open the values.yaml file:

nano values.yaml

Add the following configuration. Replace the values between angle brackets with the name of your Object Store container and your personal S3 endpoint:

image:
  tag: v1.18.1

configuration:
  backupStorageLocation:
    - name: default
      provider: aws
      bucket: <container-name>
      default: true
      credential:
        name: velero-credentials
        key: cloud
      config:
        region: EU
        s3ForcePathStyle: "true"
        s3Url: https://<personal-url>.objectstore.eu
  volumeSnapshotLocation:
    - name: default
      provider: csi
      config: {}
  defaultBackupStorageLocation: default
  defaultVolumeSnapshotLocation: default
  features: EnableCSI
  defaultSnapshotMoveData: true

credentials:
  useSecret: true
  existingSecret: velero-credentials

initContainers:
  - name: velero-plugin-for-aws
    image: velero/velero-plugin-for-aws:v1.14.2
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: /target
        name: plugins

deployNodeAgent: true

nodeAgent:
  disableHostPath: false
  containerSecurityContext:
    privileged: true
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: 500m
      memory: 1Gi

resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1Gi

Save the changes and close the file (ctrl + x > y > enter).

The AWS plugin connects Velero to the S3-compatible Object Store. The node agent transfers the data from the CSI snapshot to Object Store and therefore requires access to the volumes on the Kubernetes nodes.

Step 5

Install Velero using the values from values.yaml:

helm install velero vmware-tanzu/velero --version 12.1.0 --namespace velero --values values.yaml --wait

The arguments have the following functions:

• --version 12.1.0: installs the chart version that contains Velero 1.18.1.
• --namespace velero: installs the resources in the velero namespace.
• --values values.yaml: uses the settings from the specified file.
• --wait: waits until the resources are ready or the Helm timeout expires.

Step 6

Check the Velero server and node agent pods:

kubectl get pods --namespace velero

The --namespace velero argument limits the output to the Velero namespace. All pods must have the status ‘Running’. Then check the connection to Object Store:

kubectl get backupstoragelocations --namespace velero

The BackupStorageLocation ‘default’ must have the status ‘Available’. If it has a different status, check the Velero logs:

kubectl logs deployment/velero --namespace velero

Installing the Velero client

Use the Velero client to manage backups and restores from the command line. Install a client version that matches the server version.

Step 1

Download and extract the Linux version for AMD64:

curl -LO https://github.com/velero-io/velero/releases/download/v1.18.1/velero-v1.18.1-linux-amd64.tar.gz
tar -xzf velero-v1.18.1-linux-amd64.tar.gz

With curl, -L follows redirects and -O saves the file using its original filename. With tar, -x, -z, and -f extract the gzip archive and specify which file tar should use.

Are you using a different operating system or processor architecture? Download the appropriate file from the Velero release page.

Step 2

Install the executable in /usr/local/bin:

sudo install velero-v1.18.1-linux-amd64/velero /usr/local/bin/velero

Step 3

Check the client and server versions:

velero version

The output must show both the client and server versions.

Creating a backup

Step 1

Create a backup of a namespace. Replace the placeholders with a recognizable backup name and the namespace you want to back up:

velero backup create <backup-name> --include-namespaces <namespace> --snapshot-move-data --wait

The optional arguments have the following functions:

• --include-namespaces: limits the backup to the specified namespace. Omit this argument to include all namespaces.
• --snapshot-move-data: transfers the data from the CSI snapshot to Object Store. This setting is also enabled by default in values.yaml, but is included explicitly here.
• --wait: displays the progress until the backup is complete. Pressing ctrl + c only stops waiting; the backup continues.

Step 2

Check the status and details of the backup:

velero backup get
velero backup describe <backup-name> --details

The optional --details argument displays additional information about the included resources and volumes. Check the logs if the backup does not receive the status ‘Completed’:

velero backup logs <backup-name>

Restoring a backup

Step 1

Restore the resources and volumes from a backup. Use a unique name for the restore:

velero restore create <restore-name> --from-backup <backup-name> --wait

The optional arguments have the following functions:

• --from-backup: selects the backup that Velero restores.
• --wait: displays the progress until the restore is complete. Pressing ctrl + c only stops waiting; the restore continues.

Step 2

Check the status and details of the restore:

velero restore get
velero restore describe <restore-name> --details

Check the logs if the restore does not receive the status ‘Completed’:

velero restore logs <restore-name>

After a successful restore, also check that the application works and that the expected data is present on the persistent volumes.

You have installed Velero with Helm in Kubernetes and connected it to TransIP Object Store. Velero can now back up and restore Kubernetes resources and data from CSI snapshots.