Velero

Velero is an open source tool to safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes.

— velero.io

This module deploys Velero with CSI Snapshot Data Mover support to backup Kubernetes resources and persistent volumes to an S3-compatible backend. Volume snapshots are taken via Longhorn CSI and moved to the S3 bucket, enabling off-site disaster recovery and cluster migration.

The base layer configures the shared Velero settings (CSI feature gate, data mover, schedules, monitoring alerts). Cluster-specific overrides supply the S3 endpoint, credentials, the AWS plugin init container, and the CSI volume snapshot class.

Prerequisites

• The kubernetes-backups bucket must exist in the S3-compatible backend.
• Credentials for the S3 backup location must be provided via the cluster-specific override (release-override.yaml or a velero-credentials Secret).
• The velero-plugin-for-aws init container must be configured in the cluster-specific override to enable S3-compatible storage.
• CSI snapshot support must be available (external-snapshotter in kube-system).
• A VolumeSnapshotClass annotated with velero.io/csi-volumesnapshot-class: "true" must exist.
• Postgres PVCs (labeled application: spilo) are excluded from volume backup via a VolumePolicy rather than by excluding the resources entirely. This preserves the PVC metadata in the backup while skipping the volume data.

Cluster override

The following values must be set in the cluster-specific release-override.yaml:

initContainers:
  - name: velero-plugin-for-aws
    image: velero/velero-plugin-for-aws:v1.14.0
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: /target
        name: plugins
configuration:
  backupStorageLocation:
    - name: default
      provider: aws
      bucket: kubernetes-backups
      default: true
      config:
        region: us-east-1
        s3ForcePathStyle: "true"
        s3Url: https://minio.example.com:9000
  volumeSnapshotLocation:
    - name: default
      provider: csi

Credentials can be provided inline (useSecret + secretContents) or via a separate velero-credentials Secret.

Examples

Ad-hoc backup for a single namespace

apiVersion: velero.io/v1
kind: Backup
metadata:
  generateName: example-backup-
  namespace: velero-system
spec:
  includedNamespaces:
    - example
  storageLocation: default
  volumeSnapshotLocations:
    - default
  snapshotMoveData: true
  resourcePolicy:
    kind: ConfigMap
    name: resource-policies
  ttl: 72h

Restore a namespace from backup

apiVersion: velero.io/v1
kind: Restore
metadata:
  generateName: example-restore-
  namespace: velero-system
spec:
  backupName: example-backup-<random-suffix>
  includedNamespaces:
    - example
  restoreVolumes: true
  resourceModifier:
    kind: ConfigMap
    name: resource-modifiers

Links

• Docs
• Helm Chart
• Source Code