### Installation Source: https://github.com/k8up-io/k8up/blob/master/charts/k8up/README.md Install the k8up Helm chart. ```bash helm repo add k8up-io https://k8up-io.github.io/k8up helm install k8up k8up-io/k8up ``` -------------------------------- ### PodConfig and Backup Example Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/backup.adoc Example demonstrating how to customize the podSpec for backup jobs using a PodConfig object. ```yaml apiVersion: k8up.io/v1 kind: PodConfig metadata: name: podconfig annotations: test: test spec: template: spec: containers: - name: k8up env: - name: FOO value: bar securityContext: allowPrivilegeEscalation: true --- apiVersion: k8up.io/v1 kind: Backup metadata: name: k8up-backup spec: failedJobsHistoryLimit: 1 successfulJobsHistoryLimit: 1 backend: repoPasswordSecretRef: name: backup-repo key: password s3: endpoint: http://minio.minio-e2e.svc.cluster.local:9000 bucket: backup accessKeyIDSecretRef: ``` -------------------------------- ### Start Minikube Instance Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Start a Minikube instance with increased memory, disk size, and CPU cores for better performance during the tutorial. Ensure your laptop is plugged in to power. ```bash minikube start --memory 4096 --disk-size 60g --cpus 4 ``` -------------------------------- ### Install Minio Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Install and run Minio, an S3-compatible storage service, in your Kubernetes cluster. This is used for storing backups. ```bash kubectl apply -k minio ``` -------------------------------- ### Install WordPress Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Install WordPress, a popular content management system, in your Kubernetes cluster. This application's data will be backed up. ```bash kubectl apply -k wordpress ``` -------------------------------- ### Basic Backup Configuration Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/backup.adoc This is a basic example of a Backup object configuration in YAML. ```yaml apiVersion: k8up.io/v1 kind: Backup metadata: name: backup-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 backend: s3: {} tlsOptions: caCert: /mnt/ca/ca.crt volumeMounts: - name: ca-tls mountPath: /mnt/ca/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: ca-tls secret: secretName: ca-tls defaultMode: 420 ``` -------------------------------- ### Install K8up using Helm Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Install K8up into your Minikube cluster using Helm. This command generates a unique release name for the installation. ```bash helm install k8up-io/k8up --generate-name ``` -------------------------------- ### Backup Configuration with Env Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/backup.adoc This example shows how to configure a Backup object using environment variables, specifically for CA certificates. ```yaml apiVersion: v1 kind: ConfigMap metadata: name: backup-cert data: CA_CERT_FILE: /mnt/ca/ca.crt --- apiVersion: k8up.io/v1 kind: Backup metadata: name: backup-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 backend: s3: {} envFrom: - configMapRef: name: backup-cert volumeMounts: - name: ca-tls mountPath: /mnt/ca/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: ca-tls secret: secretName: ca-tls defaultMode: 420 ``` -------------------------------- ### Verify K8up Installation Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/upgrade.adoc Commands to verify a successful K8up installation. Check if the K8up pod is running, examine logs for errors, and trigger a new backup by creating a Backup object. ```bash # See if the K8up pod came up kubectl -n ${ns} get pods # Check for errors in the logs kubectl -n ${ns} logs -l "app.kubernetes.io/name=k8up" # Trigger a new backup by creating a new Backup object kubectl create -f ``` -------------------------------- ### k8up restic Usage Example Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/references/restic-config-reference.adoc This is a general usage example for the k8up restic command. Ensure RESTIC_PASSWORD is set and --resticRepository is defined. Specific arguments like --prune and --restore have additional requirements. ```txt k8up restic --help k8up restic --prune --keepWithin 4w --keep-tags daily --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json k8up restic --restore --restoreType s3 --restoreS3Bucket mybucket --restoreS3Endpoint http://minio.default.svc.cluster.local:9000 --restoreS3ForcePathStyle --restoreS3Repository myrepo --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json k8up restic --check --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json k8up restic --prune --keep-last 5 --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json k8up restic --archive --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json k8up restic --backup --resticRepository "s3:http://minio.default.svc.cluster.local:9000/mybucket/myrepo" --json ``` -------------------------------- ### Define Volume Mounts Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Example volume mount configuration for a WordPress pod. ```yaml volumeMounts: - name: wordpress-persistent-storage mountPath: /var/www/html ``` -------------------------------- ### Install MariaDB Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Install MariaDB, a database server, in your Kubernetes cluster. This will be used by WordPress to store its data. ```bash kubectl apply -k mariadb ``` -------------------------------- ### Configure PreBackupPod Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/references/object-specifications.adoc Define a PreBackupPod to run custom commands before a backup. This example shows a MySQL dump command. ```yaml apiVersion: k8up.io/v1 kind: PreBackupPod metadata: name: mysqldump spec: backupCommand: mysqldump -u$USER -p$PW -h $DB_HOST --all-databases pod: spec: containers: - env: - name: USER value: dumper - name: PW value: topsecret - name: DB_HOST value: mariadb.example.com image: mariadb command: - sleep ``` -------------------------------- ### Backup configuration with a single label selector for AND logic Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/backup.adoc Example of a Backup resource configuration using a single label selector with multiple matchExpressions to achieve AND logic for targeting entities. ```yaml apiVersion: k8up.io/v1 kind: Backup metadata: name: backup-test spec: labelSelectors: - matchExpressions: - key: my-label-key operator: Exists - key: another-label-key operator: In values: - acceptable-value - another-acceptable-value ... ``` -------------------------------- ### Configure Open Stack Swift Authentication Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/generic-env-vars.adoc This example demonstrates how to set up Open Stack Swift authentication using a Kubernetes secret and `envFrom` configuration for a K8up backend. Ensure the Kubernetes secret contains the necessary authentication credentials. ```yaml apiVersion: k8up.io/v1 kind: Backup metadata: name: my-swift-backup spec: backend: swift: container: "my-container" secretAccessKeySecretRef: name: "openstack-credentials" key: "swift_password" accessKeyIDSecretRef: name: "openstack-credentials" key: "swift_user" envFrom: - secretRef: name: "openstack-credentials" ``` -------------------------------- ### MongoDB Restore using Port-Forward Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/application-aware-backups.adoc Example of restoring a MongoDB database from a binary archive using `kubectl port-forward` and the `mongorestore` utility. ```bash $ kubectl port-forward po/mongodb-0 27017:27017 $ ./mongorestore -u root -p mongodb://localhost:27017 --archive=mydatabase.archive 2022-02-14T18:05:28.879+0100 preparing collections to restore from 2022-02-14T18:05:28.908+0100 reading metadata for mydatabase.mydatabase_apps_scheduler from archive 'mydatabase.archive' ... 2022-02-14T18:07:17.252+0100 finished restoring mydatabase.mydatabase_federation_dns_cache (0 documents, 0 failures) 2022-02-14T18:07:17.252+0100 restoring users from archive 'mydatabase.archive' 2022-02-14T18:07:17.310+0100 restoring indexes for collection mydatabase.mydatabase_user_data_files from metadata 2022-02-14T18:07:17.310+0100 restoring indexes for collection mydatabase.mydatabase_livechat_unit_monitors from metadata ... 2022-02-14T18:07:21.711+0100 79020 document(s) restored successfully. 0 document(s) failed to restore. ``` -------------------------------- ### Install CRDs using kubectl Source: https://github.com/k8up-io/k8up/blob/master/README.md Install Custom Resource Definitions (CRDs) on your cluster using kubectl. This is the recommended approach due to an issue with `make install`. ```bash kubectl apply -f config/crd/apiextensions.k8s.io/v1 ``` -------------------------------- ### Restic Backend Configuration Example Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc This YAML snippet shows a typical `backend` configuration for Restic, commonly used in K8up schedules. It specifies S3 as the storage backend with necessary credentials. ```yaml backend: s3: endpoint: http://localhost:9000 bucket: k8up accessKeyIDSecretRef: name: backup-credentials key: username secretAccessKeySecretRef: name: backup-credentials key: password ``` -------------------------------- ### Get List of Available Snapshots Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Use `kubectl get snapshots` to list all available snapshots in a namespace. This command helps in identifying the names of existing backups. ```bash kubectl get snapshots NAME AGE 162e7a85 31m a1dc5eff 31m ``` -------------------------------- ### Backup configuration with label selectors Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/backup.adoc Example of a Backup resource configuration that uses label selectors to target specific PVCs or PreBackupPods. It demonstrates using multiple label selectors with OR logic. ```yaml apiVersion: k8up.io/v1 kind: Backup metadata: name: backup-test spec: labelSelectors: - matchExpressions: - key: my-label-key operator: Exists - matchExpressions: - key: another-label-key operator: In values: - acceptable-value - another-acceptable-value failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 backend: repoPasswordSecretRef: name: backup-repo key: password s3: endpoint: http://minio:9000 bucket: backups accessKeyIDSecretRef: name: minio-credentials key: username secretAccessKeySecretRef: name: minio-credentials key: password ``` -------------------------------- ### Pass Environment Variables in backupCommand Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/prebackuppod.adoc When passing environment variables to the `backupCommand` within a PreBackupPod, they must be wrapped in a shell command. This example shows how to securely pass a MariaDB root password using a shell. ```yaml spec: backupCommand: /bin/bash -c 'mysqldump -uroot -p "${MARIADB_ROOT_PASSWORD}" --all-databases'" --overwrite ``` -------------------------------- ### Describe Backup Object Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Provides detailed information about a specific backup resource, including its status conditions, start time, and events. Useful for in-depth troubleshooting. ```yaml #$ kubectl describe backup/demo-backup Name: demo-backup Namespace: default Labels: Annotations: API Version: k8up.io/v1 Kind: Backup Metadata: # [clipped for brevity] Spec: # [clipped for brevity] Status: Conditions: Last Transition Time: 2020-13-32T25:71:61Z Message: Deleted 1 resources Reason: Succeeded Status: True Type: Scrubbed Last Transition Time: 2020-13-32T25:61:61Z Message: the job 'default/demo-backup' was created Reason: Ready Status: True Type: Ready Last Transition Time: 2020-13-32T25:71:61Z Message: the job 'default/demo-backup' ended Reason: Finished Status: False Type: Progressing Last Transition Time: 2020-13-32T25:71:61Z Message: the job 'default/demo-backup' ended successfully Reason: Succeeded Status: True Type: Completed Last Transition Time: 2020-13-32T25:61:61Z Message: no container definitions found Reason: NoPreBackupPodsFound Status: True Type: PreBackupPodsReady Started: true Events: ``` -------------------------------- ### Open WordPress Service Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Open the WordPress service in your default browser using the minikube service command. If the browser doesn't open automatically, use the command to get the URL. ```bash minikube service wordpress ``` ```bash minikube service --url wordpress ``` -------------------------------- ### Apply K8up Sample Manifests Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/installation.adoc Use this command to apply sample manifests from the `config/samples/` directory. These are intended for testing and development. ```bash kubectl apply -k config/samples/ ``` -------------------------------- ### Get Snapshot Details Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Retrieve detailed information about a specific snapshot using `kubectl get snapshots -oyaml`. This includes the snapshot ID and its associated paths. ```bash kubectl get snapshots 162e7a85 -oyaml apiVersion: k8up.io/v1 kind: Snapshot metadata: name: 162e7a85 spec: date: "2023-03-03T07:34:42Z" id: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 paths: - /data/subject-pvc repository: s3:http://minio.minio.svc.cluster.local:9000/backup ``` -------------------------------- ### K8up CLI Restore Help Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Displays the help information for the 'k8up restore' CLI command, outlining available options and their purposes. Use this to understand all parameters for restore operations. ```bash ohmybash ~ k8up restore --help NAME: k8up restore USAGE: k8up cli restore [command options] [arguments...] CATEGORY: cli DESCRIPTION: CLI commands that can be executed everywhere OPTIONS: --snapshot kubectl get snapshots Required ; ID of the snapshot kubectl get snapshots, set, via cli or via env: [$SNAPSHOT] --secretRef value Required ; Set secret name from which You want to take S3 credentials, via cli or via env: [$SECRET_REF] --s3endpoint value Required ; Set s3endpoint from which backup will be taken, via cli or via env: [$S3ENDPOINT] --s3bucket value Required ; Set s3bucket from which backup will be taken, via cli or via env: [$S3BUCKET] --s3secretRef value Required ; Set secret name, where S3 username & password are stored from which backup will be taken, via cli or via env: [$S3SECRETREF] --restoreMethod value Required ; Set restore method [ pvc|s3 ], via cli or via env: (default: pvc) [$RESTOREMETHOD] --claimName value Required ; Set claimName field, via cli or via env: [$CLAIMNAME] --S3SecretRefUsernameKey value Optional ; Set S3SecretRefUsernameKey, key inside secret, under which S3 username is stored, via cli or via env: (default: username) [$S3SECRETREFUSERNAMEKEY] --S3SecretRefPasswordKey value Optional ; Set S3SecretRefPasswordKey, key inside secret, under which Restic repo password is stored, via cli or via env: (default: password) [$S3SECRETREFPASSWORDKEY] --restoreName value Optional ; Set restoreName - metadata.Name field, if empty, k8up will generate name, via cli or via env: [$RESTORENAME] --runAsUser value Optional ; Set user UID, via cli or via env: (default: 0) [$RUNASUSER] --restoreToS3Endpoint value Optional ; Set restore endpoint, only when using s3 restore method, via cli or via env: [$RESTORETOS3ENDPOINT] --restoreToS3Bucket value Optional ; Set restore bucket, only when using s3 restore method, via cli or via env: [$RESTORETOS3BUCKET] --restoreToS3Secret value Optional ; Set restore Secret, only when using s3 restore method, expecting secret name containing key value pair with 'username' and 'password' keys, via cli or via env: [$RESTORETOS3SECRET] --RestoreToS3SecretUsernameKey value Optional ; Set RestoreToS3SecretUsernameKey, key inside secret, under which S3 username is stored, via cli or via env: (default: username) [$RESTORETOS3SECRETUSERNAMEKEY] --RestoreToS3SecretPasswordKey value Optional ; Set RestoreToS3SecretPasswordKey, key inside secret, under which Restic repo password is stored, via cli or via env: (default: password) [$RESTORETOS3SECRETPASSWORDKEY] --namespace value Optional ; Set namespace in which You want to execute restore, via cli or via env: (default: default) [$NAMESPACE] --kubeconfig value Optional ; Set kubeconfig to connect to cluster, via cli or via env: (default: ~/.kube/config) [$KUBECONFIG] --help, -h show help (default: false) ``` -------------------------------- ### EffectiveSchedule Resource Definition Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/references/object-specifications.adoc Example of an EffectiveSchedule object used by the controller to persist translated schedule definitions. ```yaml include::example$references/effective-schedule.yaml[] ``` -------------------------------- ### Clone K8up Repository Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Clone the K8up repository to access tutorial scripts and YAML files. Navigate to the tutorial directory. ```bash git clone https://github.com/k8up-io/k8up.git --depth=1 cd k8up/docs/modules/ROOT/examples/tutorial ``` -------------------------------- ### Add K8up Helm Repository Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Add the K8up Helm repository to your Helm client. This allows you to install K8up using Helm. ```bash helm repo add k8up-io https://k8up-io.github.io/k8up ``` -------------------------------- ### Configure S3 Backend Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/references/object-specifications.adoc Set up the S3 backend for storing backups. Requires bucket name and Kubernetes secret references for credentials and encryption key. ```yaml backend: repoPasswordSecretRef: name: backup-repo key: password s3: endpoint: http://10.144.1.224:9000 bucket: k8up accessKeyIDSecretRef: name: backup-credentials key: username secretAccessKeySecretRef: name: backup-credentials key: password ``` -------------------------------- ### Generate Kubernetes Code Source: https://github.com/k8up-io/k8up/blob/master/README.md Run this command to generate Kubernetes code after making changes to CRD structs. Ensure you have make installed. ```bash make generate ``` -------------------------------- ### Restic backup initialization and execution logs Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc These logs show the Restic repository initialization, password requirement, and the process of backing up WordPress PVC data to an S3-compatible storage. ```text No repository available, initialising... created restic repository 97efa2a6bf at s3:http://minio:9000/backups Please note that knowledge of your password is required to access the repository. Losing your password means that your data is irrecoverably lost. Removing locks... created new cache in /root/.cache/restic successfully removed locks Listing all pods with annotation k8up.io/backupcommand in namespace default Listing snapshots snapshots command: 0 Snapshots backing up... Starting backup for folder wordpress-pvc done: 0.00% backup finished! new files: 1907 changed files: 0 bytes added: 45561795 Listing snapshots snapshots command: 1 Snapshots sending webhook Listing snapshots snapshots command: 1 Snapshots Removing locks... Listing snapshots snapshots command: 1 Snapshots Sending webhooks to : % ``` -------------------------------- ### Apply backup configuration Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Apply the backup configuration to your Minikube cluster to trigger a backup. ```bash kubectl apply -f backup.yaml ``` -------------------------------- ### Wait for Backup to be Progressing Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Use this command to pause execution until a backup job has started processing. Ensure the 'progressing' condition is met. ```bash kubectl wait --for condition=progressing backup/demo-backup ``` -------------------------------- ### Configure VS Code Launch Settings Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/explanations/ide.adoc Use this configuration in .vscode/launch.json to run the K8up operator with necessary environment variables. ```json { "version": "0.2.0", "configurations": [ { "name": "Launch", "type": "go", "request": "launch", "mode": "auto", "program": "${workspaceFolder}/cmd/operator/main.go", "env": { "BACKUP_IMAGE": "ghcr.io/k8up-io/k8up:latest", "BACKUP_GLOBALS3ENDPOINT": "http://somewhere.example.org", "BACKUP_GLOBALS3BUCKET": "somebucket", "BACKUP_GLOBALSECRETACCESSKEY": "replacewithaccesskey", "BACKUP_GLOBALACCESSKEYID": "replacewithkeyid", "BACKUP_GLOBALREPOPASSWORD": "somepassword" }, "args": [] } ] } ``` -------------------------------- ### Install K8up CRDs Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Apply the Custom Resource Definitions (CRDs) required by K8up to your Kubernetes cluster. This enables K8up to manage backup resources. ```bash kubectl apply -f https://github.com/k8up-io/k8up/releases/download/v2.0.0/k8up-crd.yaml --server-side ``` -------------------------------- ### Restore with custom CA cert for backend and restore method using envFrom Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore resource to use custom CA certificates for the backend and restore method by referencing a ConfigMap via `envFrom`. Ensure the certificates are mounted via volumes. ```yaml apiVersion: v1 kind: ConfigMap metadata: name: restore-cert data: CA_CERT_FILE: /mnt/ca/ca.crt RESTORE_CA_CERT_FILE: /mnt/custom-ca/ca.crt --- apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} envFrom: - configMapRef: name: restore-cert volumeMounts: - name: ca-tls mountPath: /mnt/ca/ restoreMethod: s3: {} volumeMounts: - name: custom-ca-tls mountPath: /mnt/custom-ca/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: ca-tls secret: secretName: ca-tls defaultMode: 420 - name: custom-ca-tls secret: secretName: custom-ca-tls defaultMode: 420 ``` -------------------------------- ### Get K8up Restore Objects Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Use kubectl to view restore objects, jobs, and logs. Ensure the correct namespace is specified if not using 'default'. ```bash kubectl get restores.k8up.io ``` ```bash kubectl get jobs ``` ```bash kubectl logs -f jobs/resotre-job-123 ``` -------------------------------- ### Describe Job Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Provides detailed information about a Kubernetes job, including its selector, parallelism, start and completion times, and pod statuses. Useful for diagnosing job-related issues. ```yaml #$ kubectl describe jobs Name: demo-backup Namespace: default Selector: controller-uid=1ba56104-d1de-45c7-9d29-abf4da6943a5 Labels: k8upjob=true Annotations: Controlled By: Backup/demo-backup Parallelism: 1 Completions: 1 Start Time: Fri, 32 Jeb 2020 25:61:61 +0100 Completed At: Fri, 32 Jeb 2020 25:61:61 +0100 Duration: 3m Pods Statuses: 0 Running / 1 Succeeded / 0 Failed Pod Template: Labels: controller-uid=1ba56104-d1de-45c7-9d29-abf4da6943a5 job-name=demo-backup Service Account: pod-executor Containers: demo-backup: Image: vshn/wrestic:v0.2.0 Port: Host Port: Environment: # [clipped for brevity] Mounts: Volumes: Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal SuccessfulCreate 6m job-controller Created pod: demo-backup-t2mtp Normal Completed 3m job-controller Job completed ``` -------------------------------- ### Operator Command-Line Arguments Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/references/operator-config-reference.adoc Use `k8up operator --help` to see all available command-line arguments for configuring the operator. The `BACKUP_OPERATOR_NAMESPACE` argument is required. ```txt k8up operator --operator-namespace default --log-level info --metrics-bind-address 0.0.0.0:8080 --leader-elect-enabled=true --leader-elect-namespace default ``` -------------------------------- ### Configure different certificates for backend and restore using env Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/archive.adoc Uses a ConfigMap to define separate CA certificate paths for archive and restore operations. ```yaml apiVersion: v1 kind: ConfigMap metadata: name: archive-cert data: CA_CERT_FILE: /mnt/ca/ca.crt RESTORE_CA_CERT_FILE: /mnt/custom-ca/ca.crt --- apiVersion: k8up.io/v1 kind: Archive metadata: name: archive-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 backend: s3: {} envFrom: - configMapRef: name: archive-cert volumeMounts: - name: ca-tls mountPath: /mnt/ca/ restoreMethod: s3: {} volumeMounts: - name: custom-ca-tls mountPath: /mnt/custom-ca/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: ca-tls secret: secretName: ca-tls defaultMode: 420 - name: custom-ca-tls secret: secretName: custom-ca-tls defaultMode: 420 ``` -------------------------------- ### MongoDB Application-Aware Backup Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/application-aware-backups.adoc Set up MongoDB backups using `mongodump` with the `k8up.io/backupcommand` annotation. The `k8up.io/file-extension` annotation is used to specify the archive file extension. ```yaml template: metadata: labels: app.kubernetes.io/name: mongodb annotations: k8up.io/backupcommand: sh -c 'mongodump --username=$MONGODB_ROOT_USER --password=$MONGODB_ROOT_PASSWORD --archive' k8up.io/file-extension: .archive spec: containers: - name: mongodb image: quay.io/bitnami/mongodb:4.4.11-debian-10-r12 ... ``` -------------------------------- ### Annotate Pods with backupCommand via kubectl Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/prebackuppod.adoc This command demonstrates how to add a backup command to an existing pod using `kubectl annotate`. This is useful for applying backup commands to pods that are not defined as PreBackupPod resources. ```bash kubectl -n ${YOUR_NAMESPACE} annotate pods ${YOUR_POD_NAME} "k8up.io/backupcommand=/bin/bash -c 'mysqldump -uroot -p"\" ${MARIADB_ROOT_PASSWORD}\"" --all-databases'" --overwrite ``` -------------------------------- ### Prepare and Apply CRDs for K8up Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/upgrade.adoc This script prepares and applies CRDs for K8up. It retrieves CRD definitions, removes specific metadata, and reapplies them to ensure proper annotation. This is a prerequisite for installing K8up version 1.x. ```bash for crd in archives.k8up.io backups.k8up.io checks.k8up.io prebackuppods.k8up.io prunes.k8up.io restores.k8up.io schedules.k8up.io; do # Get CRD definition in YAML kubectl get crd "${crd}" -o yaml > "${crd}.yaml" # Remove all metadata properties except `metadata.name` yq -i eval 'del(.status) | del(.metadata) | .metadata.name += "'${crd}'"' "${crd}.yaml" # Apply the CRD again (this shouldn't change anything, except adding the annotation "kubectl.kubernetes.io/last-applied-configuration") # You will also see some warnings in the output mentioning the annotation. # This is expected and actually required. kubectl apply -f "${crd}.yaml" done ``` -------------------------------- ### PostgreSQL Application-Aware Backup Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/application-aware-backups.adoc Configure PostgreSQL backups using `pg_dump` by setting the `k8up.io/backupcommand` annotation. Specify the file extension with `k8up.io/file-extension`. ```yaml template: metadata: labels: app: postgresql annotations: k8up.io/backupcommand: sh -c 'PGDATABASE="$POSTGRES_DB" PGUSER="$POSTGRES_USER" PGPASSWORD="$POSTGRES_PASSWORD" pg_dump --clean' k8up.io/file-extension: .sql spec: containers: - name: postgres image: docker.io/bitnami/postgresql:11 ... ``` -------------------------------- ### Restore with custom CA cert for backend and restore method using options Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore resource to use a custom CA certificate for both the backend and restore method by specifying `tlsOptions`. Ensure the CA certificate is mounted via a volume. ```yaml apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} tlsOptions: caCert: /mnt/ca/ca.crt volumeMounts: - name: ca-tls mountPath: /mnt/ca/ restoreMethod: s3: {} tlsOptions: caCert: /mnt/custom-ca/ca.crt volumeMounts: - name: custom-ca-tls mountPath: /mnt/custom-ca/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: ca-tls secret: secretName: ca-tls defaultMode: 420 - name: custom-ca-tls secret: secretName: custom-ca-tls defaultMode: 420 ``` -------------------------------- ### K8up Schedule and Restore Configuration Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Configure a weekly archive schedule with S3 restore method. Ensure backup credentials are provided via secrets. ```yaml schedule: '0 0 1 * *' # archive every week restoreMethod: s3: endpoint: http://minio:9000 bucket: archive accessKeyIDSecretRef: name: backup-credentials key: username secretAccessKeySecretRef: name: backup-credentials key: password ``` -------------------------------- ### List Backups Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Displays a list of all backup resources, including their status, completion, and age. Useful for a quick overview of backup jobs. ```bash $ kubectl get backup NAME SCHEDULE REF COMPLETION PREBACKUP AGE demo-backup Succeeded NoPreBackupPodsFound 3m20s schedule-test-backup-b6bxz schedule-test NoPreBackupPodsFound 20s schedule-test-backup-sj5rt schedule-test NoPreBackupPodsFound 80s schedule-test-backup-whnkl schedule-test Failed NoPreBackupPodsFound 2m20s ``` -------------------------------- ### Configure MariaDB Backup Annotation Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Annotation to instruct K8up to perform a database dump during backup. ```yaml spec: template: metadata: annotations: k8up.io/backupcommand: /bin/bash -c 'mysqldump -uroot -p"${MARIADB_ROOT_PASSWORD}" --all-databases' ``` -------------------------------- ### Set Namespace for Uninstall Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/upgrade.adoc Set the namespace variable for the K8up system before uninstalling version 0.x. ```bash # Set the namespace ns=k8up-system ``` -------------------------------- ### Restore with Different Certs via envFrom Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore job to use distinct TLS certificates for backend and restore methods by referencing different certificate paths in a ConfigMap and using `envFrom`. Note the different mount paths for backend and restore. ```yaml apiVersion: v1 kind: ConfigMap metadata: name: restore-cert data: CA_CERT_FILE: /mnt/tls/ca.crt CLIENT_CERT_FILE: /mnt/tls/tls.crt CLIENT_KEY_FILE: /mnt/tls/tls.key RESTORE_CA_CERT_FILE: /mnt/custom-tls/ca.crt RESTORE_CLIENT_CERT_FILE: /mnt/custom-tls/tls.crt RESTORE_CLIENT_KEY_FILE: /mnt/custom-tls/tls.key --- apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} envFrom: - configMapRef: name: restore-cert volumeMounts: - name: client-tls mountPath: /mnt/ca/ restoreMethod: s3: {} volumeMounts: - name: client-custom-tls mountPath: /mnt/custom-tls/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: client-tls secret: secretName: client-tls defaultMode: 420 - name: client-custom-tls secret: secretName: client-custom-tls defaultMode: 420 ``` -------------------------------- ### List Pods Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Lists all pods in the current namespace, showing their readiness, status, restart count, and age. This helps identify the pod associated with a backup job. ```bash #$ kubectl get pods NAME READY STATUS RESTARTS AGE demo-backup-t2mtp 0/1 Completed 0 3m ``` -------------------------------- ### Restore with mTLS for backend using options Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore resource for mutual TLS (mTLS) authentication with the backend storage using `tlsOptions`. This includes specifying CA certificate, client certificate, and client key. Ensure the client TLS secrets are mounted. ```yaml apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} tlsOptions: caCert: /mnt/ca/ca.crt clientCert: /mnt/tls/tls.crt clientKey: /mnt/tls/tls.key volumeMounts: - name: client-tls mountPath: /mnt/tls/ restoreMethod: s3: {} podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: client-tls secret: secretName: client-tls defaultMode: 420 ``` -------------------------------- ### Restore with Different Certs via tlsOptions Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore job to use distinct TLS certificates for the backend and restore methods by specifying different paths in `tlsOptions`. This allows for granular control over certificate usage. ```yaml apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} tlsOptions: caCert: /mnt/tls/ca.crt clientCert: /mnt/tls/tls.crt clientKey: /mnt/tls/tls.key volumeMounts: - name: client-tls mountPath: /mnt/tls/ restoreMethod: s3: {} tlsOptions: caCert: /mnt/custom-tls/ca.crt clientCert: /mnt/custom-tls/tls.crt clientKey: /mnt/custom-tls/tls.key volumeMounts: - name: custom-client-tls mountPath: /mnt/custom-tls/ podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: client-tls secret: secretName: client-tls defaultMode: 420 - name: custom-client-tls secret: secretName: custom-client-tls defaultMode: 420 ``` -------------------------------- ### Add backupCommand Annotation in Pod Manifest Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/prebackuppod.adoc This YAML snippet shows how to include the `k8up.io/backupcommand` annotation directly within a pod's manifest. This allows for defining backup commands as part of the pod's definition, similar to how it's done with PreBackupPod resources. ```yaml spec: serviceName: "mariadb" replicas: 1 template: metadata: labels: app: mariadb annotations: k8up.io/backupcommand: /bin/bash -c 'mysqldump -uroot -p "${MARIADB_ROOT_PASSWORD}" --all-databases' ``` -------------------------------- ### Configure same mTLS certs for backend and restore with options Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/archive.adoc Applies the same TLS options to both the backend and restoreMethod blocks. ```yaml apiVersion: k8up.io/v1 kind: Archive metadata: name: archive-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 backend: s3: {} tlsOptions: caCert: /mnt/tls/ca.crt clientCert: /mnt/tls/tls.crt clientKey: /mnt/tls/tls.key volumeMounts: - name: client-tls mountPath: /mnt/tls/ restoreMethod: s3: {} tlsOptions: caCert: /mnt/tls/ca.crt clientCert: /mnt/tls/tls.crt clientKey: /mnt/tls/tls.key podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: client-tls secret: secretName: client-tls defaultMode: 420 ``` -------------------------------- ### Configure Restic Environment Variables Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/tutorials/tutorial.adoc Sets the necessary environment variables for Restic to connect to the MinIO backup repository. ```bash kubectl port-forward svc/minio 9000:9000 & export MINIO_PORT=$! export KUBECONFIG="" export RESTIC_REPOSITORY=s3:http://localhost:9000/backups/ export RESTIC_PASSWORD=p@ssw0rd export AWS_ACCESS_KEY_ID=minio export AWS_SECRET_ACCESS_KEY=minio123 ``` -------------------------------- ### Define a PreBackupPod for MySQL Dump Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/prebackuppod.adoc This YAML defines a PreBackupPod resource. It specifies a `backupCommand` to execute a mysqldump and a `pod` template with an image and environment variables for the database connection. The container is set to run indefinitely with 'sleep infinity' to keep the pod alive during the backup. ```yaml apiVersion: k8up.io/v1 kind: PreBackupPod metadata: name: mysqldump spec: backupCommand: sh -c 'mysqldump -u$USER -p$PW -h $DB_HOST --all-databases' pod: spec: containers: - env: - name: USER value: dumper - name: PW value: topsecret - name: DB_HOST value: mariadb.example.com image: mariadb:10.4 command: - 'sleep' - 'infinity' imagePullPolicy: Always name: mysqldump ``` -------------------------------- ### Restore with mTLS for backend using envFrom Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/restore.adoc Configure a Restore resource for mutual TLS (mTLS) authentication with the backend storage using `envFrom` and a ConfigMap. This method injects certificate paths as environment variables. Ensure the client TLS secrets are mounted. ```yaml apiVersion: v1 kind: ConfigMap metadata: name: restore-cert data: CA_CERT_FILE: /mnt/tls/ca.crt CLIENT_CERT_FILE: /mnt/tls/tls.crt CLIENT_KEY_FILE: /mnt/tls/tls.key --- apiVersion: k8up.io/v1 kind: Restore metadata: name: restore-test spec: failedJobsHistoryLimit: 2 successfulJobsHistoryLimit: 2 snapshot: 162e7a85acbc14de93dad31a3699331cb32187ff0d7bd2227b7c4362a1d13a42 backend: s3: {} envFrom: - configMapRef: name: restore-cert volumeMounts: - name: client-tls mountPath: /mnt/tls/ restoreMethod: s3: {} podSecurityContext: fsGroup: 1000 runAsUser: 1000 volumes: - name: client-tls secret: secretName: client-tls defaultMode: 420 ``` -------------------------------- ### List Jobs Source: https://github.com/k8up-io/k8up/blob/master/docs/modules/ROOT/pages/how-tos/check-status.adoc Shows all Kubernetes jobs, including their completion status, duration, and age. This command helps to see the status of the underlying job created by K8up. ```bash #$ kubectl get jobs NAME COMPLETIONS DURATION AGE demo-backup 1/1 3m 6m ```