Add a backup repository

Console

1. Sign in to the GDC console.
2. In the navigation menu, click Backup for Clusters. Ensure no project is selected in the project selector.
3. Click Repository > Create Repository.
4. Enter a repository name. The description is optional.
5. In the S3 URI endpoint field, enter an endpoint containing the fully-qualified domain name of your object storage site.
6. In the Bucket name field, enter the name of the fully qualified name of the bucket, found from the status of the GDC bucket custom resource.
7. In the Bucket region field, enter the region where the bucket was created.
8. In the Access Key ID list, enter the access key ID from the bucket Secret.
9. In the Access key field, enter the access key from the bucket Secret.
10. Click Create.

API

To use the backup and restore APIs, you must configure a valid ClusterBackupRepository custom resource and supply the required credentials. You must also use a service identity, often referred to as a service account to create repositories with the API.

1. Get the name of the secret that contains S3 credentials:

   export PROJECT_NAME=PROJECT_NAME
   export SA_NAME=SA_NAME
   kubectl get secrets --namespace $PROJECT_NAME -o json | jq -r --arg USER_NAME "${SA_NAME:?}" '.items[] | select( (.metadata.annotations."object.gdc.goog/subject"==$USER_NAME)) | .metadata.name'
   

   Make sure to record the secret name returned by the command and use it as the SECRET_NAME value when you create your ClusterBackupRepository custom resource.

   Replace the following:

   • PROJECT_NAME: the name of your project.
   • SA_NAME: the name of the service account used to access object storage.

2. To get bucket details like FQDN and endpoints, extract the fullyQualifiedName and zonalEndpoints values from the output:

   kubectl get buckets -n PROJECT_NAME BUCKET_NAME -o yaml
   

3. Add a ClusterBackupRepository custom resource to use these credentials and apply the new resource to the Management API server. Backup repositories are cluster-scoped:

   apiVersion: backup.gdc.goog/v1
   kind: ClusterBackupRepository
   metadata:
     name: CLUSTER_BACKUP_REPOSITORY
     namespace: PROJECT_NAME
   spec:
     secretReference:
       namespace: PROJECT_NAME
       name: SECRET_NAME
     endpoint: END_POINT
     type: "S3"
     s3Options:
       bucket: BUCKET_FQDN
       region: REGION
       forcePathStyle: FORCE_PATH_STYLE
     importPolicy: IMPORT_POLICY
   

   Replace the following:

   • CLUSTER_BACKUP_REPOSITORY: the name of the cluster backup repository.
   • PROJECT_NAME: the name of your project.
   • SA_NAME: the name of the service account used to access object storage.
   • SECRET_NAME: the name of the secret returned from the kubectl get secrets command.
   • ENDPOINT: the fully qualified domain name for the storage system, for example, https://objectstorage.google.gdch.test. For the type field, only a value of S3 is supported.
   • BUCKET_FQDN: the fully qualified name of the bucket.
   • REGION: the region where the bucket was created.
   • FORCE_PATH_STYLE: use the forcePathStyle field to force path style URLs for objects. This field must have a value of true or false.
   • IMPORT_POLICY: set to one of the following:
     • ReadWrite: This repository can be used to schedule or create backups, backup plans, and restores.
     • ReadOnly: This repository can only be used to import and view backups. You can't create new backups or resources in this repository, but restores can use and reference read-only backups for restoration. There is no restriction on how often you can use a backup repository as ReadOnly.