Skip to content

Commit ef65eea

Browse files
kcantrelkcantrel
committed
Initial Version.
1 parent b911f08 commit ef65eea

File tree

7 files changed

+376
-0
lines changed

7 files changed

+376
-0
lines changed

‎EKS/PV-Migrate-with-Trident-Protect/README.md‎

Lines changed: 312 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,312 @@
1+
# Migrate Kubernates PVs with Trident Protect
2+
3+
This is a sample for setting up your Kubernetes application to be migrated to a different storage class using Trident Protect.
4+
5+
## Prerequisites:
6+
The following items should be already be deployed before install Trident Protect.
7+
- An AWS EKS cluster. If you don't already have one, refer to the [FSx for NetApp ONTAP as persistent storage](https://github.com/NetApp/FSx-ONTAP-samples-scripts/tree/main/EKS/FSxN-as-PVC-for-EKS)
8+
GitHub repo for an example of how to not only deploy an EKS cluster, but also deploy an FSx for ONTAP file system with
9+
Trident installed with its backend and storage classes configured. If you follow it, it will provide the rest of the prerequisites listed below.
10+
- Trident installed. Please refer to this [Trident installation documentation](https://docs.netapp.com/us-en/trident/trident-get-started/kubernetes-deploy-helm.html) for the easiest way to do that.
11+
- Configure Trident Backend. Refer to the NetApp Trident documentation for guidance on creating [TridentBackendConfig resources](https://docs.netapp.com/us-en/trident/trident-use/backend-kubectl.html).
12+
- Install the Trident CSI drivers for SAN and NAS type storage. Refer to NetApp documentation for [installation instructions](https://docs.netapp.com/us-en/trident/trident-use/trident-fsx-storage-backend.html).
13+
- Configure a StorageClass Trident for SAN and/or NAS type storage. Refer to NetApp documentation for [instructions](https://docs.netapp.com/us-en/trident/trident-use/trident-fsx-storageclass-pvc.html).
14+
- kubectl installed - Refer to [this documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/) on how to install it.
15+
- helm installed - Refer to [this documentation](https://helm.sh/docs/intro/install/) on how to install it.
16+
17+
## Preparation
18+
The following are the steps required before you can use Trident Protect to backup or migrate your EKS application.
19+
20+
1. [Configure Trident Backend](#1-make-sure-trident-backend-is-configured-correctly)
21+
1. [Configure Storage Classes for Trident storage types](#2-make-sure-trident-csi-drivers-for-nas-and-san-are-installed)
22+
1. [Install the Kubernetes external snapshotter](#3-install-the-kubernetes-external-snapshotter)
23+
1. [Create VolumeStoraeClass for Storage Provider](#4-create-volumestorageclasses-for-your-storage-provider)
24+
1. [Install Trident Protect](#5-install-trident-protect)
25+
1. [Create S3 Bucket](#6-create-private-s3-bucket-for-backup-data-and-metadata)
26+
1. [Create Kubernetes secret for S3 bucket](#7-create-a-kubernetes-secret-for-the-s3-bucket)
27+
28+
### 1. Make sure Trident Backend is configured correctly
29+
30+
Run the following kubectl commands to confirm that the TridentBackendConfig for ontap-san and ontap-nas exist and are configured correctly. These commands should output the name of any matching TridentBackendConfigs:
31+
32+
#### SAN Backend
33+
```bash
34+
kubectl get tbc -n trident -o jsonpath='{.items[?(@.spec.storageDriverName=="ontap-san")].metadata.name}'
35+
```
36+
37+
### NAS Backend
38+
```bash
39+
kubectl get tbc -n trident -o jsonpath='{.items[?(@.spec.storageDriverName=="ontap-nas")].metadata.name}'
40+
```
41+
42+
If no matching TridentBackendConfig resources are found, you will need to create them. Refer to the prerequisites section above for more information on how to do that.
43+
44+
### 2. Make Sure Trident CSI Drivers for NAS and SAN are Installed
45+
Run the following kubectl commands to check that a storage class exist for both SAN and NAS type storage.
46+
47+
#### SAN StorageClass
48+
Checks for storage classes in Kubernetes that use 'ontap-san' as their backend type. It outputs the name of any matching StorageClass:
49+
```bash
50+
kubectl get storageclass -o jsonpath='{.items[?(@.parameters.backendType=="ontap-san")].metadata.name}'
51+
```
52+
53+
#### NAS Driver
54+
Checks for storage classes in Kubernetes that use 'ontap-nas' as their backend type. It outputs the name of any matching StorageClass:
55+
```bash
56+
kubectl get storageclass -o jsonpath='{.items[?(@.parameters.backendType=="ontap-nas")].metadata.name}'
57+
```
58+
59+
If one or both are not found, you will need to create them. Refer to the prerequisites section above for more information on how to do that.
60+
61+
### 3. Install the Kubernetes External Snapshotter
62+
Trident Protect depends on the Snapshotter CRDs and controller. Please run the following commands to install the Kubernetes External Snapshotter.
63+
For more information please consult the official [external-snapshotter documentation](https://github.com/kubernetes-csi/external-snapshotter).
64+
65+
```bash
66+
kubectl kustomize https://github.com/kubernetes-csi/external-snapshotter/client/config/crd | kubectl create -f -
67+
kubectl -n kube-system kustomize deploy/kubernetes/snapshot-controller | kubectl create -f -
68+
kubectl kustomize https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/csi-snapshotter | kubectl create -f -
69+
```
70+
71+
### 4. Create VolumeSnapshotClasses for your storage provider.
72+
Trident Protect requires a VolumeSnapshotClass to be created for the storage CSI driver you are using. You can use the following command to see if you already one defined:
73+
```
74+
kubectl get VolumeSnapshotClass
75+
```
76+
If you don't have one defined you'll need to create one. Here is an example of a yaml file that defines a VolumeSnapshotClass for Trident CSI driver:
77+
```
78+
apiVersion: snapshot.storage.k8s.io/v1
79+
kind: VolumeSnapshotClass
80+
metadata:
81+
name: trident-csi-snapclass
82+
annotations:
83+
snapshot.storage.kubernetes.io/is-default-class: "true"
84+
driver: csi.trident.netapp.io
85+
deletionPolicy: Delete
86+
```
87+
88+
Here is an example of a yaml file that defines a VolumeSnapshotClass for EBS CSI driver:
89+
```
90+
apiVersion: snapshot.storage.k8s.io/v1
91+
kind: VolumeSnapshotClass
92+
metadata:
93+
name: ebs-csi-snapclass
94+
driver: ebs.csi.aws.com
95+
deletionPolicy: Delete
96+
```
97+
98+
After creating the yaml file with the VolumeSnapshotClass for your CSI driver, run the following command to create the VolumeSnapshotClass:
99+
100+
```bash
101+
kubectl apply -f <VolumeSnapshotClass.yaml>
102+
```
103+
104+
### 5. Install Trident Protect
105+
Execute the following commands to install Trident Protect. For more information please consult official [Trident Protect documentation](https://docs.netapp.com/us-en/trident/trident-protect/trident-protect-installation.html).
106+
107+
```markdown
108+
helm repo add netapp-trident-protect https://netapp.github.io/trident-protect-helm-chart
109+
helm install trident-protect-crds netapp-trident-protect/trident-protect-crds --create-namespace --namespace trident-protect
110+
helm install trident-protect netapp-trident-protect/trident-protect --set autoSupport.enabled=false --set clusterName=trident-protect-cluster --namespace trident-protect
111+
```
112+
Note that the above commands should install the latest version. If you want to install a specific version add the --version option and provide the version you want to use. Please use version `100.2410.1` or later.
113+
114+
### 6. Create Private S3 Bucket for Backup Data and Metadata
115+
116+
If you don't already have an S3 bucket, you can create one with the following command:
117+
118+
```markdown
119+
aws s3 mb s3://<bucket_name> --region <aws_region>
120+
```
121+
122+
Replace:
123+
- `<bucket_name>` with the name you want to assign to the bucket. Note it must be a unique name.
124+
- `<aws_region>` the AWS region you want the bucket to reside.
125+
126+
### 7. Create a Kubernetes secret for the S3 bucket
127+
If required, create a service account within AWS IAM that has rights to read and write to the S3 bucket create. Then, create an access key.
128+
Once you have the Access Key Id and Secret Access Key, create a Kubernetes secret with the following command:
129+
130+
```markdown
131+
kubectl create secret generic -n trident-protect s3 --from-literal=accessKeyID=<AccessKeyID> --from-literal=secretAccessKey=<secretAccessKey>
132+
```
133+
134+
Replace:
135+
- `<AccessKeyID>` with the Access Key ID.
136+
- `<secretAccessKey>` with the Secret Access Key.
137+
138+
## Configure Trident Protect to backup your application
139+
Preform these steps to configure Trident Protect to backup your application:
140+
- [Define Trident Vault](#define-a-trident-vault-to-store-the-backup)
141+
- [Create Trident Application](#create-a-trident-application)
142+
- [Run Backup](#run-backup-for-application)
143+
- [Check Backup Status](#check-backup-status)
144+
145+
### Define a Trident Vault to store the backup
146+
147+
First create a file name `trident-vault.yaml` with the following contents:
148+
149+
```markdown
150+
apiVersion: protect.trident.netapp.io/v1
151+
kind: AppVault
152+
metadata:
153+
name: <APP VAULT NAME>
154+
namespace: trident-protect
155+
spec:
156+
providerType: AWS
157+
providerConfig:
158+
s3:
159+
bucketName: <APP VAULT BUCKET NAME>
160+
endpoint: <S3 ENDPOINT>
161+
providerCredentials:
162+
accessKeyID:
163+
valueFromSecret:
164+
key: accessKeyID
165+
name: s3
166+
secretAccessKey:
167+
valueFromSecret:
168+
key: secretAccessKey
169+
name: s3
170+
```
171+
172+
Replace:
173+
- `<APP VAULT NAME>` with the name you want assigned to the Trident Vault.
174+
- `<APP VAULT BUCKET NAME>` with the name of the bucket you created in step 6 above.
175+
- `<S3 ENDPOINT>` the hostname of the S3 endpoint. For example: `s3.us-west-2.amazonaws.com`.
176+
177+
Now run the following command to create the Trident Vault:
178+
179+
```markdown
180+
kubectl apply -f trident-vault.yaml
181+
```
182+
183+
### Create a Trident Application
184+
You create a Trident application with the specification of your application in order to back it up. You do that by creating a file named `trident-application.yaml` with the following contents:
185+
186+
```markdown
187+
apiVersion: protect.trident.netapp.io/v1
188+
kind: Application
189+
metadata:
190+
name: <APP NAME>
191+
namespace: <APP NAMESPACE>
192+
spec:
193+
includedNamespaces:
194+
- namespace: <APP NAMESPACE>
195+
```
196+
197+
Replace:
198+
- `<APP NAME>` with the name you want to assign to the Trident Application
199+
- `<APP NAMESPACE>` with the namespace where the application that you want to backup resides.
200+
201+
Run the following command to create the Trident Application:
202+
203+
```markdown
204+
kubectl apply -f trident-application.yaml
205+
```
206+
207+
### Run Backup for Application
208+
Before you can migrate the data to a new store class you must back up the data first. You do that by first creating a backup configuration file named `trident-backup.yaml` with the following contents:
209+
210+
```markdown
211+
apiVersion: protect.trident.netapp.io/v1
212+
kind: Backup
213+
metadata:
214+
namespace: <APP NAMESPACE>
215+
name: <APP BACKUP NAME>
216+
spec:
217+
applicationRef: <APP NAME>
218+
appVaultRef: <APP VAULT NAME>
219+
```
220+
221+
Replace:
222+
- `<APP NAMESPACE>` with the namespace where the application resides.
223+
- `<APP BACKUP NAME>` with the name you want assigned to the backup. This has to be different from any other backup ever run.
224+
- `<APP NAME>` with the name of the application defined in the step above.
225+
- `<APP VAULT NAME>` with the name of the Trident Vault created in the step above.
226+
227+
Now run the following command to start the backup:
228+
229+
```markdown
230+
kubectl apply -f trident-backup.yaml
231+
```
232+
233+
### Check Backup Status
234+
To check the status of the backup run the following command:
235+
236+
```markdown
237+
kubectl get backup -n <APP NAMESPACE> <APP BACKUP NAME>
238+
```
239+
240+
- If status is `Completed` Backup completed successfully .
241+
- If status is `Running` run the command again in a few minutes to check status.
242+
- If status is `Failed` the error message will give you a clue as to what went wrong. If you need more information, try using `kubectl describe` instead of `kubectl get` to get more information.
243+
244+
## Perform the migration
245+
To restore the backup to a storage class, you first need to create a restore configuration file named `trident-restore-diff-sc.yaml` with the following contents:
246+
247+
```markdown
248+
apiVersion: protect.trident.netapp.io/v1
249+
kind: BackupRestore
250+
metadata:
251+
name: <APP RESTORE NAME>
252+
namespace: <DESTINATION NAMESPACE>
253+
spec:
254+
appArchivePath: <APP ARCHIVE PATH>
255+
appVaultRef: <APP VAULT NAME>
256+
namespaceMapping:
257+
- source: <SOURCE NAMESPACE>
258+
destination: <DESTINATION NAMESPACE>
259+
storageClassMapping:
260+
- source: <SOURCE STORAGE CLASS>
261+
destination: <DESTINATION STORAGE CLASS>
262+
```
263+
264+
Replace:
265+
- `<APP RESTORE NAME>` with the name you want to assign the restore configuration.
266+
- `<DESTINATION NAMESPACE>` with the namespace where you want to restore the application.
267+
- `<APP VAULT NAME>` with the name of the Trident Vault used when creating the backup.
268+
- `<SOURCE NAMESPACE>` with the namespace where the application was backed up from.
269+
- `<DESTINATION NAMESPACE>` with the namespace where you want the application to be restored to.
270+
- `<SOURCE STORAGE CLASS>` with the storage class that the application was backed up from.
271+
- `<DESTINATION STORAGE CLASS>` with the storage class that you want the application to be restored to.
272+
- `<APP ARCHIVE PATH>` with the path to the backup archive. You can get this by running the following command:
273+
274+
```markdown
275+
kubectl get backup -n <APP NAMESPACE> <APP BACKUP NAME> -o jsonpath='{.status.appArchivePath}'
276+
```
277+
278+
Once the yaml file has been created, run the following command to start the restore:
279+
280+
```markdown
281+
kubectl apply -f trident-restore-diff-ns.yaml
282+
```
283+
284+
You can check the status of the restore by running the following command:
285+
286+
```markdown
287+
kubectl get backuprestore -n <DESTINATION NAMESPACE> <APP RESTORE NAME>
288+
```
289+
290+
## Final Notes
291+
There are a lot of other features and options available with Trident Protect that are not covered here, for example:
292+
- Creating zero space snapshots of your application.
293+
- Scheduling backups.
294+
- Replicating backups to another FSxN file system with SnapMirror.
295+
296+
For more information please refer to the official [Trident Protect documentation](https://docs.netapp.com/us-en/trident/trident-protect/trident-protect-installation.html).
297+
298+
## Author Information
299+
300+
This repository is maintained by the contributors listed on [GitHub](https://github.com/NetApp/FSx-ONTAP-samples-scripts/graphs/contributors).
301+
302+
## License
303+
304+
Licensed under the Apache License, Version 2.0 (the "License").
305+
306+
You may obtain a copy of the License at [apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0).
307+
308+
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an _"AS IS"_ basis, without WARRANTIES or conditions of any kind, either express or implied.
309+
310+
See the License for the specific language governing permissions and limitations under the License.
311+
312+
© 2025 NetApp, Inc. All Rights Reserved.

‎EKS/PV-Migrate-with-Trident-Protect/ebs-volume-storage-class.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: snapshot.storage.k8s.io/v1
2+
kind: VolumeSnapshotClass
3+
metadata:
4+
name: ebs-csi-snapclass
5+
driver: ebs.csi.aws.com
6+
deletionPolicy: Delete

‎EKS/PV-Migrate-with-Trident-Protect/trident-application.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: protect.trident.netapp.io/v1
2+
kind: Application
3+
metadata:
4+
name: <APP NAME>
5+
namespace: <APP NAMESPACE>
6+
spec:
7+
includedNamespaces:
8+
- namespace: <APP NAMESPACE>

‎EKS/PV-Migrate-with-Trident-Protect/trident-backup.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: protect.trident.netapp.io/v1
2+
kind: Backup
3+
metadata:
4+
namespace: <APP NAMESPACE>
5+
name: <APP BACKUP NAME>
6+
spec:
7+
applicationRef: <APP NAME>
8+
appVaultRef: <APP VAULT NAME>

‎EKS/PV-Migrate-with-Trident-Protect/trident-restore-diff-ns.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: protect.trident.netapp.io/v1
2+
kind: BackupRestore
3+
metadata:
4+
name: <APP RESTORE NAME>
5+
namespace: <DESTINATION NAMESPACE>
6+
spec:
7+
appArchivePath: <APP ARCHIVE PATH>
8+
appVaultRef: <APP VAULT NAME>
9+
namespaceMapping:
10+
- source: <SOURCE NAMESPACE>
11+
destination: <DESTINATION NAMESPACE>
12+
storageClassMapping:
13+
- source: <SOURCE SC>
14+
destination: <DESTINATION SC>

‎EKS/PV-Migrate-with-Trident-Protect/trident-vault.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: protect.trident.netapp.io/v1
2+
kind: AppVault
3+
metadata:
4+
name: <APP VAULT NAME>
5+
namespace: trident-protect
6+
spec:
7+
providerType: AWS
8+
providerConfig:
9+
s3:
10+
bucketName: <APP VAULT BUCKET NAME>
11+
endpoint: <S3 ENDPOINT>
12+
providerCredentials:
13+
accessKeyID:
14+
valueFromSecret:
15+
key: accessKeyID
16+
name: s3
17+
secretAccessKey:
18+
valueFromSecret:
19+
key: secretAccessKey
20+
name: s3

‎EKS/PV-Migrate-with-Trident-Protect/trident-volume-storage-class.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: snapshot.storage.k8s.io/v1
2+
kind: VolumeSnapshotClass
3+
metadata:
4+
name: trident-csi-snapclass
5+
annotations:
6+
snapshot.storage.kubernetes.io/is-default-class: "true"
7+
driver: csi.trident.netapp.io
8+
deletionPolicy: Delete

0 commit comments

Comments
 (0)