Backing up and restoring data on different clusters

To integrate your backup PVC with IBM Cloud Object Storage, you need to make sure that you have an IBM Cloud account with an instance of IBM Cloud Object Storage. Follow these steps:

1. Create an instance of IBM Cloud Object Storage in IBM Cloud. This step requires an IBM Cloud account.
2. Create a bucket in IBM Cloud Object Storage.

   1. Log in to IBM Cloud, and in the menu, click Resource list.

   2. If you do not have an instance of IBM Cloud Object Storage, create one by accessing the Catalog in the dashboard.
   3. Locate your IBM Cloud Object Storage instance. In the menu, click Instances > Create bucket > Create a Custom Bucket, then click Create.
   4. Click Customize your bucket. Specify a unique bucket name. Select the type of Resiliency, Location, and type of Storage class, then click Create bucket.
   5. Select the bucket that you created and click Permissions. In the Access policies panel, select Service ID for Policy Type and for Role for this bucket, select Writer. Click Create access policy. If you do not have a Service ID, click the Create service ID in the Access policies panel to create one.
   6. To establish a connection with IBM Cloud Object Storage, a bucket endpoint name is needed. Click Configuration, then click Endpoints. Scroll to the Endpoints panel and locate the endpoint name that suits your requirements. Copy the endpoint name to a location where you can retrieve it later.
   7. Authentication with IBM Cloud Object Storage requires an access key and secret key. From the IBM Cloud Navigation menu, click Resource list and click your Cloud Object Storage instance under Storage. Click the Service credentials tab. If you have not created a service credential yet, do so by using the New Credential tab and enabling the Include HMAC Credential toggle switch. Save the cos_hmac_keys block from your credential, which contains the access key and secret key for later use.

To implement data protection for your applications across both source and target clusters, follow these steps:

1. Install the OADP Operator in the openshift-adp project from the Red Hat OpenShift OperatorHub.

2. Create a cloud-credentials secret within the openshift-adp project.

   1. Create a cloud-credentials secret within the openshift-adp project by using credentials sourced from the IBM Cloud Object Storage bucket. This secret facilitates secure access to the storage resources needed for backup and restoration operations.

   2. To create the cloud-credentials secret, go to the Red Hat OpenShift web console and access Workloads > Secrets from the menu.

      Click Create within the Secrets window and select Key/value secret from the drop down list.

      Specify the required details including Secret name, Key, and corresponding cloud access credentials.

      
      Specify the following values in the Create key/value secret panel:
      
      Secret name: cloud-credentials 
      Key: cloud 
      Value: [Enter the access key and secret key that you created previously.]
      
      [default]
      aws_access_key_id=<KEY_ID_VALUE>
      aws_secret_access_key=<SECRET_ACCESS_KEY_VALUE>

      
      Note: Do not use quotation marks or brackets in the key values.

   3. To finalize the creation of the cloud-credentials secret, click Create.

3. Create DataProtectionApplication custom resource.

   1. Access the Red Hat OpenShift web console and go to Operators > Installed Operators from the menu.

   2. Select the OADP Operator and proceed to configure the DataProtectionApplication resource.

   3. Click Create DataProtectionApplication and opt to configure via the YAML view.

   4. Update the fields with the provided specifications for the DataProtectionApplication custom resource.

      For spec.backupLocations.objectStorage.bucket, use the bucket name you added in a previous step. For spec.backupLocations.config.s3Url, use the bucket endpoint desired, that you added in a previous step.

      
      kind: DataProtectionApplication
      apiVersion: oadp.openshift.io/v1alpha1
      metadata:
        name: velero-dpa
        namespace: openshift-adp
      spec:
        backupLocations:
          - velero:
              config:
                profile: default
                region: ams03
                s3Url: https://s3.ams03.cloud-object-storage.appdomain.cloud
                insecureSkipTLSVerify: "true"
                s3ForcePathStyle: "true"
              credential:
                key: cloud
                name: cloud-credentials
              default: true
              objectStorage:
                bucket: wsabucket
                prefix: velero
              provider: aws
        configuration:
          restic:
            enable: true
          velero:
            defaultPlugins:
              - openshift
              - csi
              - aws
              - kubevirt
            featureFlags:
              - EnableCSI
        snapshotLocations:
          - velero:
              config:
                profile: default
                region: ams03
              provider: aws
      

      Note: If you enable your cluster to run pods on the primary nodes, use the following YAML section for spec.configuration.

      
       spec:
          ...
          configuration:
              nodeAgent:
                enable: true
                uploaderType: restic
          velero:
          ...
      

      Note: The object storage that is used is s3-compatible storage that is provided by the IBM Cloud Object Storage instance. The custom s3Url capability from the aws velero plugin is used to access the IBM Cloud Object Storage endpoint in Velero.

   5. To finalize the creation process, click Create.

   6. From the menu, select All instances. Verify that the status of DataProtectionApplication is Condition: Reconciled and the status of BackupStorageLocation is Phase: Available.

4. Update VolumeSnapshotClass Deletion Policy.
   When the deletionPolicy attribute of the VolumeSnapshotClass is set to Delete, the associated storage snapshot is removed concurrently with the VolumeSnapshotContent object. To maintain the integrity of volume snapshots within the storage system during the Velero backup lifecycle, consider updating the deletion policy to Retain. This adjustment makes sure that the preservation of volume snapshots, even in scenarios such as namespace loss during a disaster event.

   The OADP/Velero CSI plug-in autonomously selects the appropriate VolumeSnapshotClass within the cluster, matching both the driver name and the value of velero.io/csi-volumesnapshot-class, which must be set to true.

   To update the VolumeSnapshotClass deletion policy:

   1. In the Red Hat OpenShift web console, goto Storage > VolumeSnapshotClasses.

   2. Click csi-cephfsplugin-snapclass, and switch to the YAML tab.

   3. Update the deletionPolicy values and add relevant labels in the metadata section with the following values:

      
      apiVersion: snapshot.storage.k8s.io/v1
      deletionPolicy: Retain
      driver: rook-ceph.cephfs.csi.ceph.com
      kind: VolumeSnapshotClass
      metadata:
        labels:
          velero.io/csi-volumesnapshot-class: 'true'
      ......        
      

1. To verify the default storage class configuration, in the Red Hat OpenShift web console menu, go to Storage > StorageClasses.

2. Confirm that rook-cephfs is designated as the default storage class for both the source and target clusters.

3. Or run the following command to verify the default storage class.

   oc get StorageClasses

   The output resembles the following:

   
       NAME                    PROVISIONER                     RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
       rook-ceph-block         rook-ceph.rbd.csi.ceph.com      Delete          Immediate           true                   18d
       rook-cephfs (default)   rook-ceph.cephfs.csi.ceph.com   Delete          Immediate           true                   18d
   

To download and install IBM Catalog Management Plug-in for IBM Cloud Paks, see Backing up and restoring data.

Ensure that you download and install the plug-in on both the source and target clusters. This configuration enables the integration of the plug-in into your infrastructure and facilitates efficient management and backup processes across your environment.