Creating an online backup with the Cloud Pak for Data OADP backup and restore utility

You can create online backups of a Cloud Pak for Data instance with the Cloud Pak for Data OpenShift® APIs for Data Protection (OADP) backup and restore utility.

1. If you are running the backup and restore utility in Kubernetes mode, log in to Red Hat® OpenShift Container Platform as a cluster administrator:

   ${OC_LOGIN}

   Remember: OC_LOGIN is an alias for the oc login command.
2. Ensure that the expected EDB Postgres replica PVCs are included in the backup:

   oc label pvc,pods -l k8s.enterprisedb.io/cluster,velero.io/exclude-from-backup=true velero.io/exclude-from-backup- -n ${PROJECT_CPD_INST_OPERANDS}

3. Check that the primary instance of every EDB Postgres cluster is in sync with its replicas.
   1. Run the following command:

      cpd-cli oadp backup precheck \
      --tenant-operator-namespace=${PROJECT_CPD_INST_OPERATORS} \
      --verbose

   2. If the output of the command shows that a primary instance is not in sync with a replica, delete the replica and its associated PVC.

   For more information about the command, see oadp backup precheck.

4. If you did not set up installation environment variables, set the environment variable for the Cloud Pak for Data version that you are using:

   export VERSION=<Cloud Pak for Data_version>

5. 5.0.0- 5.0.2 If watsonx Orchestrate is installed, back up the MongoDB database.
   1. Specify a name for the backup.
      For example:

      export MONGO_BACKUP_NAME='mongodb-backup-01'

   2. Run the backup job:

      cat <<EOF | oc apply -n ${PROJECT_CPD_INST_OPERANDS} -f  -
      apiVersion: batch/v1
      kind: Job
      metadata:
        name: mongo-backup
        namespace: ${PROJECT_CPD_INST_OPERANDS}
      spec:
        template:
          metadata:
            labels:
              wo.watsonx.ibm.com/cr-name: wo
          spec:
            containers:
            - name: backup
              image: cp.icr.io/cp/watsonx-orchestrate/ibm-watsonx-orchestrate-onprem-utils@sha256:d3adacdcb34824faa845ade0880bdbc984f7caa311f0460f7ad16b9e4f7b4d1c
              workingDir: /mongodb-backup-restore
              command: ["./mongo.sh", "backup", "--name", $MONGO_BACKUP_NAME]
              volumeMounts:
                - name: mongo-backups
                  mountPath: /mongodb-backup-restore/dumps
                - name: mongo-credentials
                  mountPath: /secrets/mongo
            restartPolicy: Never
            volumes:
              - name: mongo-backups
                persistentVolumeClaim: 
                  claimName: pvc-wo-mongo-backups
              - name: mongo-credentials
                secret:
                  secretName: wo-watson-orchestrate-mongo-secret
        backoffLimit: 4
      EOF

   3. Validate that the backup is complete.

      oc get job mongo-backup -n ${PROJECT_CPD_INST_OPERANDS}

   4. Patch the MongoDB secret:

      oc label secret -n ${PROJECT_CPD_INST_OPERATORS} ${PROJECT_CPD_INST_OPERANDS}-mongodb-wo-mongo-ops-manager-admin-key icpdsupport/ignore-on-nd-backup=true

      oc label secret -n ${PROJECT_CPD_INST_OPERATORS} ${PROJECT_CPD_INST_OPERANDS}-mongodb-wo-mongo-ops-manager-admin-key velero.io/exclude-from-backup=true

6. Generate the cpd-operators ConfigMap.

   This ConfigMap captures the required Kubernetes objects that you will need when you restore the operators.

   ./cpd-operators.sh backup \
   --foundation-namespace ${PROJECT_CPD_INST_OPERATORS} \
   --operators-namespace ${PROJECT_CPD_INST_OPERATORS} \
   --backup-iam-data

   Note: IBM Cloud Pak foundational services operators are installed in the same namespace as Cloud Pak for Data operators.
7. Run checkpoint hooks.

   The --tenant-operator-namespace parameter specifies the instance (tenant) operator project, and will implicitly include other instance projects (control plane and any tethered projects). If you want to back up only specific projects, use the --include-namespaces parameter instead, and specify the list of projects that you want to back up.

   Note: The --tenant-operator-namespace and --include-namespaces parameters are mutually exclusive.

   cpd-cli oadp checkpoint create \
   --tenant-operator-namespace ${PROJECT_CPD_INST_OPERATORS} \
   --log-level=debug \
   --verbose

8. Create a backup of Cloud Pak for Data Persistent Volume Claims (PVCs) and volume data, and provide a name for the backup:

   cpd-cli oadp backup create <volume-backup-name> \
   --tenant-operator-namespace ${PROJECT_CPD_INST_OPERATORS} \
   --include-resources='namespaces,persistentvolumeclaims,persistentvolumes,volumesnapshot,volumesnapshotcontent,customresourcedefinitions.apiextensions.k8s.io' \
   --selector='icpdsupport/empty-on-nd-backup notin (true),icpdsupport/ignore-on-nd-backup notin (true)' \
   --hook-kind=checkpoint \
   --snapshot-volumes \
   --log-level=debug \
   --verbose

9. Create a backup of Kubernetes resources, and provide a name for the backup:

   cpd-cli oadp backup create <kub-resource-backup> \
   --tenant-operator-namespace ${PROJECT_CPD_INST_OPERATORS} \
   --exclude-resources='event,event.events.k8s.io,imagetags.openshift.io,pod,subscriptions.operators.coreos.com,clusterserviceversions.operators.coreos.com,installplans.operators.coreos.com,clients.oidc.security.ibm.com,authentication.operator.ibm.com,challenges.acme.cert-manager.io,orders.acme.cert-manager.io,certificaterequests.cert-manager.io' \
   --selector='icpdsupport/empty-on-nd-backup notin (true),icpdsupport/ignore-on-nd-backup notin (true)' \
   --hook-kind=checkpoint \
   --skip-hooks \
   --log-level=debug \
   --verbose

10. If watsonx Orchestrate is installed, back up App Connect resources.
    1. If you haven't already done so, download and extract the contents of backup-script.zip.

       For details, see Downloading the Cloud Pak for Data backup and restore scripts.

    2. Open the backup-script.sh file in an editor.
    3. Change spec.storageLocation to the object storage where you are storing your Cloud Pak for Data backups.
       Tip: To obtain the backup storage location, run the following command:

       oc get backupStorageLocation -n <OADP_operator_project>

    4. Run the following command, specifying a name for the backup:

       ./backup-script.sh ${PROJECT_IBM_APP_CONNECT} <appconnect_backup_name>

11. Check the status of the backup:

    cpd-cli oadp backup status <backup-name> \
    --details

    In the output, check that the Phase is Completed, and that the Resource List contains a VolumeSnapshot for each PVC.

12. To view a list of existing checkpoints, run the following command:

    cpd-cli oadp checkpoint list

13. To view a list of existing backups, run the following command:

    cpd-cli oadp backup list

14. To view backup logs, run the following command:

    cpd-cli oadp backup logs <backup-name>

15. To delete a backup for cleanup purposes, run the following command:

    cpd-cli oadp backup delete <backup-name>

cpd-cli oadp backup posthooks --hook-kind=checkpoint --tenant-operator-namespace=${PROJECT_CPD_INST_OPERATORS}