Senin, 16 September 2024

KUBERNETES-backup dg velero

 https://medium.com/@ithesadson/how-to-use-velero-installation-backup-and-restore-guide-with-minio-7e2c907d0a44

How to Use Velero: Installation, Backup, and Restore Guide

Emircan Agac
5 min read

Read this blog for free.

Kubernetes is the leading platform for managing containerized applications. However, protecting your data and ensuring business continuity is crucial. Velero offers a powerful solution for Kubernetes backup and disaster recovery.

This guide will walk you through setting up Velero on Linux, using MinIO as your object storage. We’ll cover the entire process, from installation to creating and restoring backups. Let’s get started!

Prerequisites

  • A running Kubernetes cluster on Linux
  • Docker installed
  • Basic understanding of Kubernetes concepts
  • MinIO object storage setup (or any S3-compatible storage)
  • velero and mc (MinIO client) command-line tools installed (follow the installation commands from the beginning of your provided code)

Step 1: Install Velero and MinIO Client (mc)

  • Install Velero:
# Download and install Velero
wget https://github.com/vmware-tanzu/velero/releases/download/v1.14.0/velero-v1.14.0-linux-amd64.tar.gz
tar -xvf velero-v1.14.0-linux-amd64.tar.gz
sudo mv velero-v1.14.0-linux-amd64/velero /usr/local/bin/
velero version
  • Install MinIO Client (mc):
# Download and install MinIO Client (mc)
wget https://dl.min.io/client/mc/release/linux-amd64/mc
chmod +x mc
sudo mv mc /usr/local/bin/

Step 2: Configure MinIO and Test the Connection

i) Start the MinIO container (adjust the IP address and credentials):

# Run MinIO server in a Docker container with port mappings and volume mount
# Exposes ports 9000 for object storage and 9001 for console access
# Uses ~/minio/data on the host as the persistent data directory
# Sets MINIO_ROOT_USER to 'minio' and MINIO_ROOT_PASSWORD to 'minio123'
# Starts the MinIO server with /data as the storage directory and console on port 9001

docker run -p 9000:9000 -p 9001:9001 --name minio \
-v ~/minio/data:/data \
-e "MINIO_ROOT_USER=minio" \
-e "MINIO_ROOT_PASSWORD=minio123" \
quay.io/minio/minio server /data --console-address ":9001"

ii) Create a bucket for Velero backups:

# Retrieve MinIO server IP address
MINIO_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' minio)

# Configure MinIO client (mc) alias for Velero bucket
mc alias set minio http://${MINIO_IP}:9000 minio_accesskey minio_secretkey

# Create a bucket for Velero backups
mc mb minio/velero-bucket

Step 3: Install Velero on Kubernetes

i) Create a credentials file for Velero:

# Create credentials file for Velero with MinIO credentials

cat <<EOF > credentials-velero
[default]
aws_access_key_id=minio
aws_secret_access_key=minio123
EOF

ii) Install Velero using the provided command, replacing placeholders with your actual values:

# Install Velero on Kubernetes with AWS as the provider and MinIO as the backup location
# Uses Velero version v1.14.0 and Velero plugin for AWS version v1.10.0
# Configures Velero to use 'velero-bucket' as the backup bucket and 'credentials-velero' for MinIO credentials
# Enables node-agent for handling backup and restore operations
# Disables volume snapshots and uses kopia as the uploader type (u can pref restic)
# Sets default volumes to filesystem backups
# Installs Velero in the 'velero' namespace with MinIO configuration (replace <minio_ip> with your MinIO server's IP)

velero install \
--provider aws \
--image velero/velero:v1.14.0 \
--plugins velero/velero-plugin-for-aws:v1.10.0 \
--bucket velero-bucket \
--secret-file ./credentials-velero \
--use-node-agent \
--use-volume-snapshots=false \
--uploader-type kopia \
--default-volumes-to-fs-backup \
--namespace velero \
--backup-location-config region=minio,s3ForcePathStyle="true",s3Url=http://<minio_ip>:9000
Velero Namespace Pods should look like this. (K9S monitoring)

Step 4: Create and Restore Backups

Backup & Restore

i) Create a backup:

# Set the backup name based on current date and time
BACKUP_NAME="full-cluster-backup-$(date +%Y.%m.%d-%H.%M)"
# Create a Velero backup with the specified name and wait for completion
velero backup create $BACKUP_NAME --wait

# Describe the details of the created backup
velero backup describe $BACKUP_NAME
# View the logs of the backup creation process
velero backup logs $BACKUP_NAME

# List all Velero backups
velero get backup
This should be the output of the Velero Backup Create command

ii) Restore from the backup:

# Restore from a Velero backup using the specified backup name
velero restore create $BACKUP_NAME --from-backup $BACKUP_NAME --wait

# Describe the details of the restore operation
velero restore describe $BACKUP_NAME
# View the logs of the restore process
velero restore logs $BACKUP_NAME
This should be the output of the Velero Restore Create command

Uninstall Velero

You can uninstall Velero from your Kubernetes cluster using the following command:

velero uninstall
How to uninstall Velero

Velero UI

If you’re looking to access the Velero UI, I recommend checking out the plugin at seriohub/velero-ui. It’s still in development but shows promise in many aspects.

Velero-UI Dashboard

Conclusion

Congratulations! You’ve successfully set up Velero with MinIO for Kubernetes backup and restore operations. This setup ensures your Kubernetes applications and data are protected and recoverable. Experiment with different backup strategies and enjoy the reliability and peace of mind Velero brings to your Kubernetes environment.

For more information and advanced configurations, please refer to the Velero documentation.

You can refer to the CNCF document for more detailed information. It is informative and provides insights about Velero. Here is the link: CNCF Webinar: Backup and recovery best practices with Project Velero.

=====================================

🚀 For my My GitHub @ithesadson🚀

Knowledge should be Free and Disseminated.

=====================================

KUBERNETES-menggabungkan node master

 

Cara menggabungkan node master atau bidang kontrol ke kluster Kubernetes

Iklan Amir

Mengikuti

Waktu baca 5 menit
tambahkan node master tambahan ke Kubernetes

Anda mungkin ingin menambahkan node master baru ke klaster Kubernetes baru atau yang sudah ada, atau mengubah peran node pekerja menjadi master, namun tidak tahu caranya. Dalam artikel ini, Anda akan mempelajari cara memiliki beberapa node bidang kontrol di klaster Kubernetes Anda untuk mencegah failover apa pun di klaster operasional Anda.

Dalam artikel ini, kita akan membahas dua skenario untuk klaster Anda. Dalam skenario pertama, Anda akan menginisialisasi klaster Anda. Dan, dalam skenario kedua, Anda sudah memiliki klaster dan ingin menambahkan 2 atau lebih node master.

Skenario 1 — Inisialisasi klaster:

Kami berasumsi Anda menginstal kluster kubeadm untuk pertama kalinya dan akan menjalankan perintah kubeadm init, tetapi jika Anda sudah memiliki kluster, Anda juga dapat menggunakan kubeadm reset dan menginisialisasi ulang kluster Anda untuk menggunakan pendekatan ini, tetapi Anda harus tahu bahwa hal itu memiliki konsekuensi. Pertama-tama, kami menjalankan perintah di bawah ini pada node target Anda sebagai master atau control plane:

kubeadm init --control-plane-endpoint <ip-simpul-master> \ 
--pod-network-cidr 11.0.0.0/16 \
--apiserver-advertise-address=<ip-simpul-master> \
--service-cidr 10.0.0.1/16 \
--upload-certs
  • - -upload certs: Seperti yang Anda ketahui, koneksi antara node master adalah mTLS, jadi kedua node harus diotorisasi dalam protokol ini. Tanda ini membantu Anda mengambil modul sertifikat Kubernetes pada node master Anda sehingga menjalankannya adalah suatu keharusan.
  • - -control-plan-endpoint : Bendera berguna lainnya yang berguna saat Anda menambahkan master baru ke kluster yang sudah ada sehingga node master baru akan mengenali node master pertama dan utama.
  • - -service-cidr : Anda akan mengalokasikan rentang IP layanan Kubernetes yang Anda inginkan di sini. cobalah untuk menghindari penggunaan rentang IP yang sama dengan jaringan pod.
  • - -pod-network-cidr : Seperti disebutkan sebelumnya, IP pod dialokasikan dari rentang yang Anda tentukan di sini.
  • - -apiserver-advertise-address = Alamat IP yang akan diiklankan oleh Server API untuk mendengarkannya. Jika tidak ditetapkan, antarmuka jaringan default akan digunakan.
bergabung dengan kluster kubernetes

Ini adalah hasil yang akan Anda lihat di terminal setelah menginisialisasi klaster Anda. Seperti yang Anda lihat, perintah pertama adalah untuk menggabungkan rencana kontrol tambahan dan perintah kedua adalah untuk menggabungkan simpul pekerja.

Bergabunglah dengan node master:

Untuk bergabung dengan node master baru di kluster yang sudah ada, cukup salin dan tempel perintah pertama yang Anda lihat di terminal:

kubeadm join <ip-anda>:6443 --token <token-anda> \ 
--discovery-token-ca-cert-hash <hash-sertifikat-anda> \
--control-plane \
--certificate-key <kunci-sertifikat>
  • -certificate-key : Kunci yang digunakan untuk mengenkripsi sertifikat bidang kontrol dalam Rahasia kubeadm-certs. Kunci sertifikat adalah string berkode heksadesimal yang merupakan kunci AES berukuran 32 byte.
  • - -discovery-token-ca-cert-hash: digunakan untuk memverifikasi keaslian cluster yang Anda ikuti

Saat Anda melihat halaman ini, master baru telah bergabung. Anda mungkin menghadapi kesalahan etcd tetapi Anda dapat mengabaikannya dan membuat file .kube di direktori home Anda dengan petunjuk yang ditampilkan.

Bergabunglah dengan simpul pekerja:

kubeadm join <master-ip>:6443 \ 
--token <token-anda> \
--discovery-token-ca-cert-hash <hash-sertifikat-anda>

Bergabung dengan node pekerja mudah, cukup salin dan tempel perintah di atas yang Anda lihat di terminal.

Setelah menggabungkan kedua node dan memasang plugin jaringan kubernetes, klaster Anda dengan 2 node utama dan 1 node pekerja sudah siap.

Skenario 2 — Klaster yang ada:

Jika Anda tidak bermaksud menginisialisasi ulang klaster yang sudah ada dan beroperasi, kami punya solusi lain untuk Anda.

  1. Pastikan Anda telah menginstal openssl dan menjalankan perintah di bawah ini pada node master Anda:
openssl x509 -pubkey - dalam /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

Perintah ini mengekstrak kunci publik dari sertifikat CA, mengonversinya ke format DER, lalu menghitung hash SHA-256 dari kunci publik. Hash yang dihasilkan adalah yang Anda perlukan untuk bendera --discovery-token-ca-cert-hash. Anda juga harus menambahkan “sha256:” sebelum string yang Anda ambil pada perintah Anda.

2. Jika Anda belum menjalankan perintah kubeadm init dengan flag - -upload-certs, Anda harus menyalin sertifikat klaster secara manual ke node master tambahan. Salin sertifikat dari direktori /etc/Kubernetes/pki.

Berikut ini adalah sertifikat yang Anda perlukan:

·ca.crt

· ca.kunci

· kunci sa

· sa.pub

· proxy-depan-ca.crt

· proxy-depan-ca.key

Ini adalah instruksi yang harus Anda ikuti:

buat direktori yang diperlukan dan salin ke tujuan:

Bahasa Indonesia: sudo mkdir -p /etc/kubernetes/pki 
sudo chown -R root:root /etc/kubernetes/pki
sudo chmod -R 700 /etc/kubernetes/pki
scp /etc/kubernetes/admin.conf <pengguna>@<ip-node-master-baru> :/etc/kubernetes/
scp /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key /etc/kubernetes/pki/sa.key /etc/kubernetes/pki/sa.pub /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.key <pengguna>@<ip-simpul-master-baru>:/etc/kubernetes/pki/

jika Anda sudah menjalankan flag --upload-certs pada kubeadm init sebelumnya, Anda tidak perlu menyalin sertifikat secara manual tetapi Anda harus menggunakan --certificate-key pada perintah join dan mengetahui nilainya dari inisialisasi pertama.

Hasilkan token gabung baru:

pembuatan token kubeadm

Sekarang semuanya siap untuk menggabungkan bidang kontrol baru Anda ke kluster kubeadm dengan perintah di bawah ini, salin token dan sertifikat hash di sini:

kubeadm join <master-ip>:6443 \ 
--token <token-anda> \
--discovery-token-ca-cert-hash sha256:<hash-sertifikat-anda> \
--bidang-kendali \

Dengan sertifikat yang disalin secara manual, kita tidak perlu menyetel tanda --certificate-key.
Jika Anda menjalankan “kubectl get nodes”, Anda akan melihat master node yang baru saja Anda tambahkan.

===================================================================

How to join master node or control plane to Kubernetes cluster

Amir Ad
5 min read

add additional master node to Kubernetes

You might want to add a new master node to your new or existing Kubernetes cluster or change a worker node role to master but do not know how it is done, in this article, you will learn how to have multiple control plane nodes on your Kubernetes cluster to prevent any failover on your operational cluster.

In this article, we are going to talk about two scenarios for your cluster, in the first scenario you are about to initialize your cluster, and in the second scenario you already have a cluster and want to add 2 or additional master nodes.

Scenario 1 — Initialize cluster:

We assume you are installing kubeadm cluster for the first time and about to run kubeadm init command but if you have already an existing cluster you can also use kubeadm reset and reinitialize your cluster to use this approach but you should know it does have consequences. First of all, we run the below command on your target node as master or control plane:

kubeadm init --control-plane-endpoint <master-node-ip> \
--pod-network-cidr 11.0.0.0/16 \
--apiserver-advertise-address=<master-node-ip> \
--service-cidr 10.0.0.1/16 \
--upload-certs
  • - -upload certs: As you might know, the connection between master nodes is mTLS, so both nodes must be authorized in this protocol. This flag helps you to retrieve Kubernetes certificate modules on your master nodes so executing it is necessary.
  • - -control-plan-endpoint: Another useful flag that comes in handy when you add a new master to an existing cluster so the new master nodes would recognize the first and primary master node.
  • - -service-cidr: You will allocate your desired Kubernetes service IP rang here. try to avoid using the same IP rang pod network.
  • - -pod-network-cidr: As it mentioned before, pods IPs get allocated from the range you define here.
  • - -apiserver-advertise-address= The IP address the API Server will advertise it’s listening on. If not set the default network interface will be used.
join kubernetes cluster

This is the result you are going to see on your terminal after initializing your cluster. As you see the the first command is for joining the additional control plan and the second one is for joining worker node.

Join master node:

To join a new master node on your existing cluster just copy and paste the first command you see on the terminal:

kubeadm join <your-ip>:6443 --token <your-token> \
--discovery-token-ca-cert-hash <your-cert-hash> \
--control-plane \
--certificate-key <certificate-key>
  • - -certificate-key: Key used to encrypt the control-plane certificates in the kubeadm-certs Secret. The certificate key is a hex encoded string that is an AES key of size 32 bytes.
  • - -discovery-token-ca-cert-hash: is used to verify the authenticity of the cluster you are joining

When you see this page, the new master is joined. You might face the etcd error but you can ignore it anyway and make your .kube file on your home directory by the instruction that is shown.

Join worker node:

kubeadm join <master-ip>:6443 \
--token <your-token> \
--discovery-token-ca-cert-hash <your-cert-hash>

Joining worker node is easy, just copy and paste the above command which you saw on the terminal.

After joining both nodes and installing your kubernetes network plugin, your cluster with 2 master nodes and 1 worker node is ready.

Scenario 2 — Existing cluster:

If you do not intend to reinitialize your existing and operational cluster, we have another solution for you.

  1. Make sure to have openssl installed and run the below command on your master node:
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

This command extracts the public key from the CA certificate, converts it to DER format, and then calculates the SHA-256 hash of the public key. The resulting hash is what you need for the --discovery-token-ca-cert-hash flag. You should also add “sha256:” before the string you retrieved on your command.

2. If you have not run your kubeadm init command with - -upload-certs flag, you should copy your cluster certificates manually to your additional master node. Copy certificates from /etc/Kubernetes/pki directory.

These are the certificates you will need:

·ca.crt

· ca.key

· sa.key

· sa.pub

· front-proxy-ca.crt

· front-proxy-ca.key

This is the instruction you have to follow:

make necessary directories and copy to the destination:

sudo mkdir -p /etc/kubernetes/pki
sudo chown -R root:root /etc/kubernetes/pki
sudo chmod -R 700 /etc/kubernetes/pki
scp /etc/kubernetes/admin.conf <user>@<new-master-node-ip>:/etc/kubernetes/
scp /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key /etc/kubernetes/pki/sa.key /etc/kubernetes/pki/sa.pub /etc/kubernetes/pki/front-proxy-ca.crt /etc/kubernetes/pki/front-proxy-ca.key <user>@<new-master-node-ip>:/etc/kubernetes/pki/

if you already have run --upload-certs flag on kubeadm init before, you do not need to copy certs manually but you have to use --certificate-key on your join command and know the value from first initialization.

Generate new join token:

kubeadm token generate

Now everything is ready to join your new control plane to kubeadm cluster with below command, copy token and hash cert here:

kubeadm join <master-ip>:6443 \
--token <your-token> \
--discovery-token-ca-cert-hash sha256:<your-cert-hash> \
--control-plane \

With certificates copied manually, we do not need to set --certificate-key flag.
if you run “kubectl get nodes”you must see you your newly added master node.