Persistent data backup — the volumes

The persistent data backup is the volumes protection. The CSI snapshots, the Velero backup, the cloud-provider snapshots are the components. This lesson walks the persistent data backup, the CSI snapshots, the Velero, and the production patterns.

The CSI volume snapshots

The CSI volume snapshots:

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: csi-aws-vsc
driver: ebs.csi.aws.com
deletionPolicy: Delete
parameters:
  tagSpecification: "true"
---
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata:
  name: my-snapshot
spec:
  volumeSnapshotClassName: csi-aws-vsc
  source:
    persistentVolumeClaimName: my-pvc

The CSI snapshots are the per-volume snapshots.

The Velero backup

The Velero backup:

# Install Velero
velero install \
  --provider aws \
  --bucket k8s-backups \
  --prefix velero \
  --secret-file ./credentials-velero \
  --use-restic

# Take a backup
velero backup create my-backup --include-namespaces=default

# Verify the backup
velero backup describe my-backup --details

# Restore the backup
velero restore create --from-backup my-backup

The Velero is the cluster-wide backup.

The Velero with Restic

The Velero with Restic:

# Install Velero with Restic
velero install \
  --provider aws \
  --bucket k8s-backups \
  --prefix velero \
  --secret-file ./credentials-velero \
  --use-restic

# The Restic is the file-level backup
# The Restic is used for PVCs that don't support CSI snapshots

The Velero with Restic is the file-level backup.

The cloud-provider snapshots

The cloud-provider snapshots:

# AWS EBS snapshot
aws ec2 create-snapshot --volume-id vol-12345

# GCP persistent disk snapshot
gcloud compute disks snapshot my-pd

# Azure disk snapshot
az snapshot create --resource-group my-rg --name my-snapshot

The cloud-provider snapshots are the cloud-native.

The cross-region snapshot copy

The cross-region snapshot copy:

# AWS cross-region snapshot copy
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-12345 \
  --region us-west-2 \
  --description "Cross-region copy"

# Or use the CSI driver
apiVersion: snapshot.storage.k8s.io/v1alpha1
kind: VolumeSnapshotContent
metadata:
  name: cross-region-snapshot
spec:
  volumeSnapshotRef:
    name: cross-region-snapshot
    namespace: default
  source:
    snapshotHandle: cross-region/snap-12345

The cross-region copy is the 3-2-1 rule.

The backup encryption

The backup encryption:

# Velero with encryption
velero backup create my-backup \
  --include-namespaces=default \
  --encryption-secret-file ./encryption-secret

# The secret is encrypted with KMS

The encryption is the data protection.

The backup verification

The backup verification:

# Verify the backup
velero backup describe my-backup --details

# Verify the snapshot
kubectl get volumesnapshot my-snapshot -o yaml

# Verify the data
velero restore create --from-backup my-backup --dry-run

The verification is the operational discipline.

The production patterns

The production patterns:

flowchart LR
    A[PV] --> B[CSI snapshot]
    B --> C[Cloud storage]
    C --> D[Cross-region copy]
    D --> E[3-2-1 rule]
    A --> F[Velero]
    F --> G[S3]
    G --> H[Velero backup]
    H --> E

The pattern is the production discipline.

The cross-course references

• The CSI course covers the volume snapshots.
• The Velero course covers the cluster-wide backup.
• The cloud-provider course covers the cloud-native snapshots.

Quiz

Production discipline

• Use the CSI snapshots. The per-volume snapshots.
• Use the Velero. The cluster-wide backup.
• Use the Restic. The file-level backup.
• Use the cross-region copy. The 3-2-1 rule.
• Encrypt the backup. The KMS encryption.
• Test the restore. The verification.

The persistent data backup is the cluster’s data protection. Operating it well is the CSI snapshots, the Velero, the Restic, and the production patterns.