Skip to content

Commit f43b5cb

Browse files
kcantrelkcantrel
committed
Initial Version.
1 parent 8b75215 commit f43b5cb

File tree

1 file changed

+232
-0
lines changed

1 file changed

+232
-0
lines changed

‎EKS/Trident-Protect/README.md‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
# Trident Protect Migrate PVC Storage Class
2+
3+
A simple sample for setting up your application to be backed up by Trident Protect with an option for in place migration from EBS to FSx for ONTAP.
4+
5+
## Prerequisites:
6+
The following items should be already be deployed before install Trident Protect.
7+
- EKS cluster. If you don't already have one, refer to the [FSx for NetApp ONTAP as persistent storage](https://github.com/NetApp/FSx-ONTAP-samples-scripts/tree/main/EKS/FSxN-as-PVC-for-EKS) GitHub repo for an example of how to not only deploy an EKS cluster, but also deploy an FSx for ONTAP file system with Tident installed and its backend and storage classes configured.
8+
- Trident installed. Please refer to this [Trident installation documentation](https://docs.netapp.com/us-en/trident/trident-get-started/kubernetes-deploy-helm.html) for the easiest way to do that.
9+
- Configure Trident Backend. Refer to the NetApp Trident documentation for guidance on creating [TridentBackendConfig resources](https://docs.netapp.com/us-en/trident/trident-use/backend-kubectl.html)
10+
- Install the Trident CSI drivers for SAN and NAS type storage. Refer to NetApp documentation for [installation instructions](https://docs.netapp.com/us-en/trident/trident-use/ontap-san-examples)
11+
This guide provides steps to set up and configure a StorageClass using ONTAP NAS backends with Trident.
12+
- kubectl installed - Refer to [this documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/) on how to install it.
13+
- helm installed - Refer to [this documentation](https://helm.sh/docs/intro/install/) on how to install it.
14+
15+
## Preperation
16+
The following are the steps required before you can use Trident Protect to backup your EKS application.
17+
18+
1. [Install Trident Protect](#1-install-trident-protect)
19+
2. [Configure Trident Backend](#2-make-sure-trident-backend-is-configured-correctly)
20+
3. [Install Trident CSI Drivers](#3-make-sure-trident-csi-drivers-for-nas-and-san-are-installed)
21+
4. [Create S3 Bucket](#4-create-private-s3-bucket-for-backup-data-and-metadata)
22+
23+
### 1. Install Trident Protect
24+
Execute the following commands to install Trident Protect. For more info please consult official [Trident Protect documentation](https://docs.netapp.com/us-en/trident/trident-protect/trident-protect-installation.html).
25+
26+
```markdown
27+
helm repo add netapp-trident-protect https://netapp.github.io/trident-protect-helm-chart
28+
helm install trident-protect-crds netapp-trident-protect/trident-protect-crds --version 100.2410.1 --create-namespace --namespace trident-protect
29+
helm install trident-protect netapp-trident-protect/trident-protect --set autoSupport.enabled=false --set clusterName=<name_of_cluster> --version 100.2410.1 --create-namespace --namespace trident-protect
30+
```
31+
32+
### 2. Make sure Trident Backend is configured correctly
33+
34+
Run the follwing kubectl commands to check if TridentBackendConfig for ontap-san and ontap-nas exists and configured correctly, It outputs the name of any matching TridentBackendConfig:
35+
36+
#### SAN Backend
37+
```bash
38+
kubectl get tbc -n trident -o jsonpath='{.items[?(@.spec.storageDriverName=="ontap-san")].metadata.name}'
39+
```
40+
41+
### NAS Backend
42+
```bash
43+
kubectl get tbc -n trident -o jsonpath='{.items[?(@.spec.storageDriverName=="ontap-san")].metadata.name}'
44+
```
45+
46+
If no matching TridentBackendConfig resources are found, you may need to create one. Refer to the prerequisites section above for more information on how to do that.
47+
### 3. Make Sure Trident CSI Drivers for NAS and SAN are Installed
48+
Run the follwing kubectl commands to check that a storageclass exist for both SAN and NAS type storage.
49+
50+
#### SAN Driver
51+
Checks for StorageClasses in Kubernetes that use 'ontap-san' as their backend type. It outputs the name of any matching StorageClass:
52+
```bash
53+
kubectl get storageclass -o jsonpath='{.items[?(@.parameters.backendType=="ontap-san")].metadata.name}'
54+
```
55+
56+
#### NAS Driver
57+
Checks for StorageClasses in Kubernetes that use 'ontap-nas' as their backend type. It outputs the name of any matching StorageClass:
58+
```bash
59+
kubectl get storageclass -o jsonpath='{.items[?(@.parameters.backendType=="ontap-nas")].metadata.name}'
60+
```
61+
62+
If one or both are not found, you may need to create them. Refer to the prerequisites section above for more information on how to do that.
63+
64+
65+
### 4. Create Private S3 Bucket for Backup Data and Metadata
66+
67+
```markdown
68+
aws s3 mb s3://<bucket_name> --region <aws_region>
69+
```
70+
71+
Replace:
72+
- `<bucket_name>` with the name you want to assign to the bucket. Note it must be a unique name.
73+
- `<aws_region>` the AWS region you want the bucket to reside.
74+
75+
## Configure Trident Protect to backup your application
76+
Preform these steps to configure Trident Protect to backup your application:
77+
- [Define Trident Vault](#define-a-trident-vault-to-store-the-backup)
78+
- [Create Trident Application](#create-a-trident-application)
79+
- [Run Backup](#run-backup-for-application)
80+
- [Check Backup Status](#check-backup-status)
81+
82+
### Define a Trident Vault to store the backup
83+
84+
First create a file name `trident-vault.yaml` with the following contents:
85+
86+
```markdown
87+
apiVersion: protect.trident.netapp.io/v1
88+
kind: AppVault
89+
metadata:
90+
name: <APP VAULT NAME>
91+
namespace: trident-protect
92+
spec:
93+
providerType: AWS
94+
providerConfig:
95+
s3:
96+
bucketName: <APP VAULT BUCKET NAME>
97+
endpoint: <AWS REGION>
98+
providerCredentials:
99+
accessKeyID:
100+
valueFromSecret:
101+
key: <accessKeyID>
102+
name: s3
103+
secretAccessKey:
104+
valueFromSecret:
105+
key: <secretAccessKey>
106+
name: s3
107+
```
108+
109+
Replace:
110+
- `<APP VAULT NAME>` with the name you want assigned to the Trident Vault
111+
- `<APP VAULT BUCKET NAME>` with the name of the bucket you created in step 5 above.
112+
- `<AWS_REGION>` with the AWS region the s3 bucket was created in.
113+
- `<accessKeyID>` with the access key ID that has access to the S3 bucket.
114+
- `<secretAccessKey>` with the secret that is associated with the access key ID.
115+
116+
Now run the following command to create the Trident Vault:
117+
118+
```markdown
119+
kubectl apply -f trident-vault.yaml
120+
```
121+
122+
SECURITY NOTE:
123+
124+
If you want to avoid storing AWS credentials explicitly in Kubernetes secrets, a more secure approach would be to use IAM roles for service accounts (IRSA):
125+
- Create an IAM policy with minimal S3 access permissions for the specific bucket.
126+
- Create an IAM role and attach the policy to it.
127+
- Configure your EKS cluster to use IAM roles for service accounts (IRSA).
128+
- Create a Kubernetes service account in the trident-protect namespace and associate it with the IAM role
129+
130+
### Create a Trident Application
131+
Create a Trident application to backup your application by first creating a file named `trident-application.yaml` with the following contents:
132+
133+
```markdown
134+
apiVersion: protect.trident.netapp.io/v1
135+
kind: Application
136+
metadata:
137+
name: <APP NAME>
138+
namespace: trident-protect
139+
spec:
140+
includedNamespaces:
141+
- namespace: <APP NAMESPACE>
142+
```
143+
144+
Replace:
145+
- `<APP NAME>` with the name you want to assign to the Trident Application
146+
- `<APP NAMESPACE>` with the namespace where the application that you want to backup resides.
147+
148+
Run the following command to create the Trident Application:
149+
150+
```markdown
151+
kubectl apply -f trident-application.yaml
152+
```
153+
154+
### Run Backup for Application
155+
To backup the application first create a backup configuration file named `trident-backup.yaml` with the following contents:
156+
157+
```markdown
158+
apiVersion: protect.trident.netapp.io/v1
159+
kind: Backup
160+
metadata:
161+
namespace: trident-protect
162+
name: <APP BACKUP NAME>
163+
spec:
164+
applicationRef: <APP NAME>
165+
appVaultRef: <APP VAULT NAME>
166+
dataMover: Kopia
167+
```
168+
169+
Replace:
170+
- `<APP BACKUP NAME>` with the name you want assigned to the backup.
171+
- `<APP NAME>` with the name of the application defined in the step above.
172+
- `<APP VAULT NAME>` with the name of the Trident Vault created in the step above.
173+
174+
Now run the following command to start the backup:
175+
176+
```markdown
177+
kubectl apply -f trident-backup.yaml
178+
```
179+
180+
### Check Backup Status
181+
To check the status of the backup run the following command:
182+
183+
```markdown
184+
kubectl get snapshot -n trident-protect <APP BACKUP NAME> -o jsonpath='{.status.state}'
185+
```
186+
187+
- If status is `Completed` Backup completed successfully
188+
- If status is `Running` run the command again in a few minutes to check status
189+
- If status is `Failed` check the error message:
190+
191+
```markdown
192+
kubectl get snapshot -n trident-protect <APP BACKUP NAME> -o jsonpath='{.status.error}'
193+
```
194+
195+
## Perform an in place restore with volume migration (from gp3 to FSxN/trident-csi)
196+
Before running the Restore command get appArchivePath by running:
197+
198+
```markdown
199+
kubectl get backup -n trident-protect <APP BACKUP NAME> -o jsonpath='{.status.appArchivePath}'
200+
```
201+
202+
Run the restore by first creating an in place restore configuration file named `backupinplacerestore.yaml` with the following contents:
203+
204+
```markdown
205+
apiVersion: protect.trident.netapp.io/v1
206+
kind: BackupInplaceRestore
207+
metadata:
208+
name: <APP BACKUP RESTORE NAME>
209+
namespace: trident-protect
210+
spec:
211+
appArchivePath: <BACKUP PATH>
212+
appVaultRef: <APP VAULT NAME>
213+
storageClassMapping: [{"source": "gp3", "destination": "trident-csi-nas"}]
214+
```
215+
216+
Replace:
217+
- `<APP BACKUP RESTORE NAME>` with the name you want to assign the restore configuration
218+
- `<BACKUP PATH>` with the appArchivePath obtained from the step above.
219+
- `<APP VAULT NAME>` with the name of the backup configuration used to create the backup you want to restore from.
220+
221+
Run the following command to keep the application in place while migrating application's PVC from gp3 to trident-csi-nas
222+
223+
```markdown
224+
kubectl apply -f backupinplacerestore.yaml
225+
```
226+
227+
Verify application restore was successful and check PVC storage class:
228+
229+
```markdown
230+
kubectl get <APP BACKUP RESTORE NAME> -n trident-protect -o jsonpath='{.status.state}'
231+
kubectl get pvc <PVC NAME> -n <NAMESPACE> -o jsonpath='{.spec.storageClassName}'
232+
```

0 commit comments

Comments
 (0)