Deploying Velero with AWS S3 bucket

You can deploy Velero on Kubernetes with AWS S3 as the backup storage backend. Using AWS S3 provides a reliable, scalable, and secure solution for backing up and restoring your Kubernetes Clusters, including Persistent Volume Claims (PVCs).

Before you begin

Before you can Deploy Velero with AWS S3, you must first have the following:

Amazon Web Services (AWS) Command Line Interface (CLI)

For installation information, see Installing or updating to the latest version of the AWS CLI.

To verify installation, run the following command:

aws --version

Velero CLI

For installation information, see Velero Basic Install.

To verify installation, run the following command:

velero version --client-only

Procedure

Create an AWS S3 bucket.

You can create an S3 bucket through the GUI or throught the CLI.

Through AWS GUI
1. Login to the AWS Console. Search S3 and click Create bucket.
2. Assign a unique name to the bucket. Buckets must be named using lowercase.
3. Select an AWS region.
4. Under Object Ownership, ensure that Keep ACLs disabled is selected.
5. Under Block ALL public access, accept the default values that keep all four checkboxes selected.
6. Under Bucket versioning, select Enable It > Create bucket.
7. Click your new bucket and select Properties tab > Bucket Versioning > Edit > Enable > Save.
8. Click the Permissions tab > Block public access > Edit > Confirm all 4 checkboxes > Save changes
9. Under the Permissions tab, in Bucket Policy, click Edit and paste the following JSON:
```
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "VeleroBucketPolicy",
    "Effect": "Allow",
    "Principal": {"AWS": "*"},
    "Action": ["s3:GetObject","s3:DeleteObject","s3:PutObject","s3:AbortMultipartUpload","s3:ListMultipartUploadParts"],
    "Resource": "arn:aws:s3:::<BUCKET-NAME>*"
  },{
    "Sid": "VeleroListBucket",
    "Effect": "Allow",
    "Principal": {"AWS": "*"},
    "Action": "s3:ListBucket",
    "Resource": "arn:aws:s3:::<BUCKET-NAME>"
  }]
}
```
10. Click Save changes > Done!.
Your Velero-ready S3 bucket is complete and you are ready to configure Velero for your BackupStorageLocation configuration.

Through AWS CLI

Create a bucket in an AWS region:

aws s3api create-bucket \
  --bucket <Bucket Name> \
  --region <Bucket Region>

Enable public access block:

aws s3api put-public-access-block \
  --bucket <Bucket Name> \
  --public-access-block-configuration \
  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

Enable versioning:

aws s3api put-bucket-versioning \
  --bucket <Bucket Name> \
  --versioning-configuration Status=Enabled

Enable bucket policy for Velero:

cat > bucket-policy.json <<EOF
{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "VeleroBucketPolicy",
        "Effect": "Allow",
        "Principal": {"AWS": "*"},
        "Action": ["s3:GetObject", "s3:DeleteObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts"],
        "Resource": "arn:aws:s3:::<Bucket Name>/*"
    }, {
        "Sid": "VeleroListBucket",
        "Effect": "Allow", 
        "Principal": {"AWS": "*"},
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::<Bucket Name>"
    }]
}
EOF
aws s3api put-bucket-policy \
    --bucket <Bucket Name> \
    --policy file://bucket-policy.json

Create IAM Policies.

Create IAM Policy #1 (Velero EC2/S3 Permissions)

Paste the shared policy into the JSON tab:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVolumes",
                "ec2:DescribeSnapshots",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:CreateSnapshot",
                "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::<Bucket Name>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<Bucket Name>"
            ]
        }
    ]
}

Name the policy and then click Create policy.

Create IAM Policy #2 (Assume Role policy)

Paste the shared policy into the JSON tab:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSvcUsertoDescEC2Roles",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "iam:ListRoles"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowSvcUser2assumeEKSRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<Account ID>:role/<Role Name i.e, HCLSW_AWS_AMBER_EKS_VELERO_BACKUP_SVC_ROLE>"
        }
    ]
}

Name the policy and then click Create policy.

Create the IAM Role.
1. Click IAM > Roles > Create Role.
2. Under Trusted entity, select Another AWS Account and enter the Account ID.
3. Click Permissions > Attach policies. For Policy Name, select the Velero EC2/S3 Permissions policy.
4. Under Name, select Role Name.
5. Under Role ARN, enter arn:aws:iam::<Account ID>:role/<Role Name>
6. Click Create Role.
Create the IAM User
1. Click IAM > Users > Create User.
2. Click Permissions > Attach policies. For Policy Name, select the Assume Role policy.
3. Under Access, select Programmatic Access
4. Under Name, select User Name.
5. Click Create User.

Create the Kubernetes secret.

Use the secret_gen.sh script to create the Kubernetes secret.

sh hcl-devopsplan-prod/files/secret_gen.sh

After running the script, it will prompt for shared details.

Namespace: <Namespace where installing velero i.e., backup>
AWS Access Key ID: <AWS Access Key ID>
AWS Secret Access Key: <AWS Secret Access Key>
Role ARN: <AWS Role ARN i.e., arn:aws:iam::<Account ID>:role/<Role Name i.e, HCLSW_AWS_AMBER_EKS_VELERO_BACKUP_SVC_ROLE>

Modify the values file.

Modify the values-s3bucket.yaml file. That is located at hcl-devopsplan-prod/values-s3bucket.yaml.

velero:
  bucket: "<Bucket Name>"
  region: "<Bucket Region i.e., us-east-1>"
  configuration:
    uploaderType: "kopia"

  initContainers:
    - name: velero-plugin-for-aws
      image: velero/velero-plugin-for-aws:v1.9.1
      volumeMounts:
        - mountPath: /target
          name: plugins

  credentials:
    existingSecret: credentials-velero

  awsAccessKeyId: "<Access key ID>"
  awsSecretAccessKey: "<Secret access key>"
  roleARN: "<Role ARN of the Role>"


  minioEnabled: false

backupRestore:
  minio:
    enabled: false

Install Velero

Use the helm upgrade command to install Velero.

helm upgrade --install backup ./hcl-devopsplan-prod \
  -f hcl-devopsplan-prod/values-backup.yaml \
  -f hcl-devopsplan-prod/values-s3bucket.yaml \
  --set global.imagePullSecrets={hcl-entitlement-key} \
  -n backup

Verify the installation:

To verify installation, run the following command:
```
kubectl get pods -n backup
velero backup-location get -n backup
```