Backup and Restore in a Kubernetes Cluster with Velero

Before you begin, ensure your environment meets the following requirements:

MinIO is a high-performance, S3-compatible object storage system that serves as the backend where Velero stores all backup data. Installing MinIO within your cluster gives you a self-hosted, lightweight storage target.

helm repo add minio https://charts.min.io/
helm repo update

mode: standalone
persistence:
  enabled: true
  size: 50Gi
resources:
  requests:
    memory: 512Mi
    cpu: 250m
rootUser: "minioadmin"
rootPassword: "minioadmin"
service:
  type: ClusterIP
replicas: 1
console:
  enabled: false

helm upgrade --install minio minio/minio \
  -n minio --create-namespace \
  -f minio-values.yaml \
  --version 5.4.0

kubectl exec -it deploy/minio -n minio -- bash
# Inside pod:
mc alias set localminio http://minio:9000 minioadmin minioadmin
mc mb localminio/velero
mc admin user add localminio velero-user vP@assWoRd
mc admin policy attach localminio readwrite --user velero-user
mc ls localminio

Configuring cloud credentials enables Velero to authenticate to the MinIO object storage in order to write backups and read them back during restores. Create a Kubernetes Secret named cloud-credentials.yaml containing the access key and secret key in the AWS credential format that Velero expects.

apiVersion: v1
kind: Secret
metadata:
  name: cloud-credentials
  namespace: velero
stringData:
  cloud: |
    [default]
    aws_access_key_id = velero-user
    aws_secret_access_key = vP@assWoRd

The following table defines each field of the above configuration:

Run the command to apply the cloud-credentials.yaml so that Velero can use these credentials to access the MinIO S3 bucket for backups and restores.

kubectl apply -f cloud-credentials.yaml

This step creates a pod that runs the Velero CLI, which you use to execute backup and restore commands. The pod mounts the cloud credentials secret so Velero can authenticate with MinIO.

Create the velero-client.yaml configuration file:

apiVersion: v1
kind: Pod
metadata:
  name: velero-client
  namespace: velero
spec:
  containers:
  - name: velero
    image: velero/velero:v1.12.0
    command: ["/bin/sh"]
    args: ["-c", "sleep infinity"]
    volumeMounts:
    - name: cloud-credentials
      mountPath: /credentials
      readOnly: true
  volumes:
  - name: cloud-credentials
    secret:
      secretName: cloud-credentials

The following table defines each field of the above configuration:

Run the command to apply the manifest to deploy the Velero client pod, which will mount the cloud credentials and remain running for you to execute backup and restore commands.

kubectl apply -f velero-client.yaml

The Velero configuration uses the information to know where backups are stored and how to connect to that storage. The BSL points Velero to the MinIO S3-compatible service and the velero bucket, so backups and restore artifacts are consistently written to the correct location.

Create a tuned BSL for faster uploads, backup-storage-location.yaml.

apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: default
  namespace: velero
spec:
  provider: aws
  objectStorage:
    bucket: velero
    prefix: backups
  config:
    region: minio
    s3ForcePathStyle: 'true'
    s3Url: 'http://minio.minio.svc.cluster.local:9000'
    maxParallel: "10"
    maxRetries: "5"
    maxRetriesBackoff: "2s"
    partSize: "104857600"
  credential:
    name: cloud-credentials
    key: cloud
  default: true

The following table defines each field of the above configuration:

Run the command to apply the manifest, registering MinIO as Velero's default backup storage location with the configured connection and performance settings.

kubectl apply -f backup-storage-location.yaml

Creating a backup is the step where you define what data and Kubernetes resources Velero should capture and how the backup should be executed and retained.

Create a backup:

velero backup create virtana-io-backup-16sep-01 \
  --include-namespaces virtana-io \
  --ttl 72h

Adjust parameters as required. See Velero Backup Reference for more details.

Run the command to check the backup status:

velero backup get
velero backup describe virtana-io-backup-16sep-01

When you need to recover workloads, Velero can restore all resources from a previously created backup. This recreates the Kubernetes objects and restores persistent volume data.

Run the command to restore from backup:

velero restore create virtana-io-restore-16sep-01 \
  --from-backup virtana-io-backup-16sep-01

Adjust parameters as required. See Velero Restore Reference for more details.

Run the command to check the restore status:

velero restore get
velero restore describe virtana-io-restore-16sep-01

After a backup or restore operation, verify that it completed successfully by checking the status of both the Velero operations and the restored workloads.

Run the command to check the backup and restore status:

velero backup get
-and-
velero restore get

As a final step, confirm that all pods, persistent volume claims, and services in the restored namespace are running as expected.

Run the following command to verify the workload:

kubectl get pods -n virtana-io
kubectl get pvc -n virtana-io
kubectl get svc -n virtana-io