Using MCG or Noobaa as a backup storage location

Create an MCG or Noobaa S3 target backup storage location.

1. Log in to Red Hat® OpenShift® Container Platform.
2. Go to Storage > Object Bucket Claims.
3. In the Create ObjectBucketClaim page, create an Object Bucket claim with the following details: capture credential details.

   ObjectBucketClaim Name

   Enter the name of the Object Bucket Claim. If you do not enter a value, a generic name gets generated.

   StorageClass

   Select openshift-storage.noobaa.io class. It defines the object storage service and the bucket provision.

   BucketClass

   Select noobaa-default-bucket-class.

4. Click Create.
5. Note down the Object Bucket Claim credentials like Endpoint, Bucket Name, Access Key, Secret key.
6. Extract the certificate from an S3 compliant service to a file. Use the openssl command to extract the certificate into the file tls.crt.
   Note: Ensure that the file name must be tls.crt.

   
   openssl s_client -connect <s3-service-name>-<s3-service-namespace>.apps.<fusion-hostname>.<domainname>:443 -showcerts \ | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > tls.crt

   For example, use the opensslcommand to extract the certificate from the MCG/Noobaa service.

   
   export s3_url=$(oc get routes.route.openshift.io -n openshift-storage s3 -o jsonpath='{.spec.host}'):443
   echo $s3_url
   openssl s_client -connect $s3_url -showcerts \ | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > tls.crt

7. Run the OC command to create a generic secret in the IBM Fusion namespace by using the tls.crt file.

   oc create secret generic <secret-name> --type=opaque --from-file=tls.crt -n <fusion-namespace>

   For example, in the default IBM Fusion namespace ibm-spectrum-fusion-ns:

   oc create secret generic bsl-cert --type=opaque --from-file=tls.crt -n ibm-spectrum-fusion-ns
   

8. Log in to IBM Fusion user interface.
9. From the menu, click Backup & restore > Locations.
10. In the Locations page, click Add location.
    The Add a backup location wizard page is displayed.
11. Enter the Login credentials and Certificate settings to create a backup storage location.
    In the Secret Name for Certificate field, enter the secret name created in step 7.
12. After the backup storage location is created, go to the Locations page and check whether the status is Connected.
13. If you want to create a S3 of NooBaa type, do the following steps:

    You can add the location as a separate NooBaa type instead of the S3, but you cannot do it from the UI.

    It requires additional steps to create the credentials secret and BSL YAML.
    1. Create a secret using the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from NooBaa.

       kind: Secret
       apiVersion: v1
       metadata:
         name: <noobaa bsl secret>
         namespace: <fusion namespace>
         labels:
           dp.isf.ibm.com/ownedBy: fbsl
           dp.isf.ibm.com/provider-name: isf-backup-restore
       data:
         access-key-id: <base64-encoded AWS_ACCESS_KEY_ID>
         secret-access-key: <base64-encoded AWS_SECRET_ACCESS_KEY>
       type: Opaque

       If a YAML is used, encode the values using base64.
    2. Copy the location of the S3 route to use as the endpoint for the BSL CR. Use noobaa CLI to get the list of buckets to choose from:

       noobaa bucket list

    3. Create the BSL CR with type noobaa:

       apiVersion: data-protection.isf.ibm.com/v1alpha1
       kind: BackupStorageLocation
       metadata:
         name: <noobaa bsl>
         namespace: <fusion namespace>
         labels:
           dp.isf.ibm.com/provider-name: isf-backup-restore
       spec:
         credentialName: <noobaa bsl secret>
         params:
           bucket: <bucket name>
           endpoint: '<noobaa s3 route>'
         privateCertificateName: <optional noobaa certificate secret>
         provider: isf-backup-restore
         type: noobaa