diff --git a/README.md b/README.md index 525151d85..6f031dfd0 100644 --- a/README.md +++ b/README.md @@ -16,12 +16,12 @@ UDS Core establishes a secure baseline for cloud-native systems and ships with c - [Pepr](https://pepr.dev) - UDS policy engine & operator - [Prometheus Stack](https://github.com/prometheus-operator/kube-prometheus) - Monitoring - [Promtail](https://grafana.com/docs/loki/latest/send-data/promtail/) - Log Aggregation +- [Velero](https://velero.io/) - Backup & Restore #### Future Applications - [Kiali](https://kiali.io/) - Service Mesh Observability - [Tempo](https://grafana.com/docs/tempo/latest/getting-started/) - Tracing -- [Velero](https://velero.io/) - Backup & Restore --- diff --git a/packages/standard/zarf.yaml b/packages/standard/zarf.yaml index e0e5f8367..d2c4355ca 100644 --- a/packages/standard/zarf.yaml +++ b/packages/standard/zarf.yaml @@ -89,3 +89,9 @@ components: required: true import: path: ../../src/authservice + + # Velero + - name: velero + required: true + import: + path: ../../src/velero diff --git a/src/velero/README.md b/src/velero/README.md index 555b6d1fe..81d0fc4d2 100644 --- a/src/velero/README.md +++ b/src/velero/README.md @@ -1 +1,99 @@ ## Velero + +https://velero.io/ + +## Deployment Prerequisites + +### Resources + +- k3d installed on machine + +#### Object Storage + +S3 compatible object storage must be available in order to use this package. Bucket information and access credentials can be provided via configuration values / env vars: + +- Bucket ID: `ZARF_VAR_VELERO_BUCKET` +- Bucket Region: `ZARF_VAR_VELERO_BUCKET_REGION` +- Bucket Provider URL: `ZARF_VAR_VELERO_BUCKET_PROVIDER_URL` +- Access Key: `ZARF_VAR_VELERO_BUCKET_KEY` +- Access Key Secret: `ZARF_VAR_VELERO_BUCKET_KEY_SECRET` + +As an alternative to providing the access key and secret via variable, you can reference a secret with the following format +``` +apiVersion: v1 +kind: Secret +metadata: + name: ###ZARF_VAR_VELERO_BUCKET_CREDENTIALS_SECRET### + namespace: velero +type: kubernetes.io/opaque +stringData: + cloud: |- + [default] + aws_access_key_id=###ZARF_VAR_ACCESS_KEY### + aws_secret_access_key=###ZARF_VAR_SECRET_KEY### +``` + +By overriding the velero values in the bundle as follows: +``` + - name: core + overrides: + velero: + velero: + values: + - path: "credentials.existingSecret" + value: "velero-bucket-credentials" +``` + +## Plugin Compatability +This package currently assumes the availability of S3 API compatible object storage. As such, only the AWS specific plugin image is included. More information about all available plugins [can be found in the upstream docs](https://velero.io/plugins/). Ironbank includes images for Azure and the generic CSI driver, but those are currently excluded from this package. We may revisit package defaults at some point in the future depending on usage and user requests. + +## Deploy + +### Build and Deploy Everything locally via UDS tasks + +```bash +# build the bundle for testing +UDS_PKG=velero uds run create-single-package + +# setup a k3d test env +uds run setup-test-cluster + +# deploy the bundle +UDS_PKG=velero uds run deploy-single-package +``` + +### Test the package via UDS tasks +Running the following will check that the velero deployment exists in the cluster and attempt to execute a backup: +```bash +uds run -f src/velero/tasks.yaml validate +``` +> Alternatively, you can combine package creation, cluster setup, package deploy and the test command with a simple `UDS_PKG=velero uds run test-single-package` + +## Manually trigger the default backup for testing purposes +``` +velero backup create --from-schedule velero-udsbackup -n velero +``` +> NOTE: requires [the velero CLI](https://velero.io/docs/v1.3.0/velero-install/) + +Alternatively, manually create a `backup` object with `kubectl`: +```bash +uds zarf tools kubectl apply -f - <<-EOF + apiVersion: velero.io/v1 + kind: Backup + metadata: + name: test-backup + namespace: velero + spec: + csiSnapshotTimeout: 0s + excludedNamespaces: + - kube-system + - flux + - velero + hooks: {} + includeClusterResources: true + itemOperationTimeout: 0s + metadata: {} + snapshotVolumes: false + ttl: 240h0m0s +EOF +``` diff --git a/src/velero/chart/.helmignore b/src/velero/chart/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/src/velero/chart/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/src/velero/chart/Chart.yaml b/src/velero/chart/Chart.yaml new file mode 100644 index 000000000..751f5e64a --- /dev/null +++ b/src/velero/chart/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v2 +name: uds-velero-config +description: Velero configuration for UDS + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 diff --git a/src/velero/chart/templates/_helpers.tpl b/src/velero/chart/templates/_helpers.tpl new file mode 100644 index 000000000..938e69f8b --- /dev/null +++ b/src/velero/chart/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "uds-velero-config.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "uds-velero-config.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "uds-velero-config.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "uds-velero-config.labels" -}} +helm.sh/chart: {{ include "uds-velero-config.chart" . }} +{{ include "uds-velero-config.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "uds-velero-config.selectorLabels" -}} +app.kubernetes.io/name: {{ include "uds-velero-config.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "uds-velero-config.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "uds-velero-config.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/src/velero/chart/templates/uds-package.yaml b/src/velero/chart/templates/uds-package.yaml new file mode 100644 index 000000000..b43e6232b --- /dev/null +++ b/src/velero/chart/templates/uds-package.yaml @@ -0,0 +1,27 @@ +apiVersion: uds.dev/v1alpha1 +kind: Package +metadata: + name: velero + namespace: {{ .Release.Namespace }} +spec: + network: + allow: + # Todo: wide open for now for pushing to s3 + - direction: Egress + podLabels: + app.kubernetes.io/name: velero + remoteGenerated: Anywhere + + - direction: Egress + podLabels: + batch.kubernetes.io/job-name: "velero-upgrade-crds" + remoteGenerated: KubeAPI + + - direction: Ingress + remoteNamespace: monitoring + remoteSelector: + app: prometheus + selector: + app.kubernetes.io/name: velero + port: 8068 + description: "Prometheus Metrics" \ No newline at end of file diff --git a/src/velero/chart/values.yaml b/src/velero/chart/values.yaml new file mode 100644 index 000000000..e69de29bb diff --git a/src/velero/common/zarf.yaml b/src/velero/common/zarf.yaml new file mode 100644 index 000000000..a68ad3040 --- /dev/null +++ b/src/velero/common/zarf.yaml @@ -0,0 +1,40 @@ +kind: ZarfPackageConfig +metadata: + name: uds-core-velero-common + description: "UDS Core Velero Common" + url: https://velero.io/ + +variables: + - name: VELERO_BUCKET_PROVIDER_URL + description: "S3 compatible object storage service for use with Velero" + default: "http://minio.uds-dev-stack.svc.cluster.local:9000" + - name: VELERO_BUCKET + description: "S3 compatible object storage bucket for use with Velero" + default: "uds" + - name: VELERO_BUCKET_REGION + description: "Region of the bucket for use with Velero" + default: "uds-dev-stack" + - name: VELERO_BUCKET_KEY + description: "Key to use when connecting to the Velero bucket" + default: "uds" + - name: VELERO_BUCKET_KEY_SECRET + sensitive: true + description: "Key secret to use when connecting to the Velero bucket" + default: "uds-secret" + +components: + - name: velero + required: true + charts: + - name: uds-velero-config + namespace: velero + version: 0.1.0 + localPath: ../chart + - name: velero + namespace: velero + url: https://vmware-tanzu.github.io/helm-charts + version: 5.4.1 + repoName: velero + releaseName: velero + valuesFiles: + - ../values/values.yaml diff --git a/src/velero/oscal-component.yaml b/src/velero/oscal-component.yaml new file mode 100644 index 000000000..5aee4da8f --- /dev/null +++ b/src/velero/oscal-component.yaml @@ -0,0 +1,119 @@ +component-definition: + uuid: D73CF4E6-D893-4BDE-A195-C4DE782DF63B + metadata: + title: Velero Component + last-modified: '2022-04-08T12:00:00Z' + version: "20220408" + oscal-version: 1.1.1 + parties: + # Should be consistent across all of the packages, but where is ground truth? + - uuid: 72134592-08C2-4A77-8BAD-C880F109367A + type: organization + name: Platform One + links: + - href: https://p1.dso.mil + rel: website + components: # for BB, this would be all the pieces of big bang + - uuid: 3127D34A-517B-473B-83B0-6536179ABE38 + type: software + title: Velero + description: | + Velero is an open source tool to safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes + purpose: Provides backup and restore capabilities to a Kubernetes cluster + responsible-roles: + - role-id: provider + party-uuids: + - 72134592-08C2-4A77-8BAD-C880F109367A # matches parties entry for p1 + control-implementations: + - uuid: 5108E5FC-C45F-477B-8542-9C5611A92485 + source: https://raw.githubusercontent.com/usnistgov/oscal-content/master/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json + description: + Controls implemented by velero for inheritance by applications + implemented-requirements: + - uuid: 2ADA7512-E0D5-4CAE-81BC-C889C640AF93 + control-id: cp-6 + description: >- + Velero can take backups of your application configuration/data and store them off-site in either an approved cloud environment or on-premise location. + - uuid: 6C3339A0-9636-4E35-8FA8-731CF900B326 + control-id: "cp-6.1" + description: >- + Velero can take backups of your application configuration/data and store them off-site in either an approved cloud environment or on-premise location. + - uuid: 2799CCBF-C48D-4451-85BA-EBD9B949C361 + control-id: cp-6.2 + description: >- + Velero can restore application configuration/data from an approved cloud provider or on-premise location on-demand. + - uuid: 0AE59B43-50A7-4420-881B-E0635CCB8424 + control-id: cp-6.3 + description: >- + Velero supports back-ups to multiple cloud environments (including geo-separated locations for high availibility) and on-premise environments in the event of an accessibility disruptions. + - uuid: B11B38B8-8744-4DFD-8C1A-4A4EDD7F9574 + control-id: cp-7 + description: >- + Velero can restore application configuration/data from an approved cloud provider or on-premise location to an alternative deployment environment on-demand. + - uuid: D74C3A8C-E5B0-4F81-895D-FB2A318D723B + control-id: cp-7.1 + description: >- + Velero supports back-ups to and restores from multiple cloud environments (including geo-separated locations for high availibility) and on-premise environments in the event of an accessibility disruptions. + - uuid: 72D7145F-7A3F-47AF-835F-7E3D6EFAE1CC + control-id: cp-7.2 + description: >- + Velero supports back-ups to and restores from multiple cloud environments (including geo-separated locations for high availibility) and on-premise environments in the event of an accessibility disruptions. + - uuid: 5B0AA4CB-9C49-4D32-8242-5631788BD941 + control-id: cp-9 + description: >- + "Velero gives you tools to back up and restore your Kubernetes cluster resources and persistent volumes. You can run Velero with a cloud provider or on-premises. This includes: + - System components/data. + - User-level information/application metadata. + - User-level storage/data. + - Scheduled back-ups with configurable scopes. + - Multi-cloud and on-premise support for availability of backup." + - uuid: 8E5917F3-3E45-46C1-8585-48550E19AFFB + control-id: cp-9.1 + description: >- + Velero provides feedback/logging of back-up status for configuration/data via kubectl or the Velero CLI tool. + Velero can restore your production configuration/data to validation environment to ensure reliability/integrity. + - uuid: 51191D0E-0C7B-4D2D-861D-202AC8C505CF + control-id: cp-9.2 + description: >- + Velero can be configured to restore only certain components of a back-up when necessary. + - uuid: C650411C-33FD-4B59-8899-AC34B43C860F + control-id: cp-9.3 + description: >- + Velero supports back-ups to multiple cloud environments (including geo-separated locations for high availibility) and on-premise environments. + - uuid: 8AB09B17-301B-4836-835B-9CE22A9E2300 + control-id: cp-9.5 + description: >- + Velero gives you tools to back up and restore your Kubernetes cluster resources and persistent volumes. You can run Velero with a cloud provider or on-premises. This includes: + - System components/data. + - User-level information/application metadata. + - User-level storage/data. + - Scheduled back-ups with configurable scopes. + - Multi-cloud and on-premise support for availability of backup. + - uuid: 7FACB782-C183-4585-8C0B-17824438FEA6 + control-id: cp-9.8 + description: >- + Velero supports encryption of backups via its supported providers' encryption support/mechanisms. + + - uuid: 26B3D98B-0C9D-434B-8DE5-06CBBC46A38C + control-id: cp-10 + description: >- + Velero can restore application configuration/data from an approved cloud provider or on-premise location on-demand. + - uuid: 3EA444B7-61ED-43DD-8B3D-24B55F286E59 + control-id: cp-10.4 + description: >- + Velero gives you tools to back up and restore your Kubernetes cluster resources and persistent volumes. You can run Velero with a cloud provider or on-premises. This includes: + - System components/data. + - User-level information/application metadata. + - User-level storage/data. + - Scheduled back-ups with configurable scopes. + - Multi-cloud and on-premise support for availability of backup. + back-matter: + resources: + - uuid: DDC5B579-87DE-41FE-8D87-B4422A7F0A98 + title: Github Repo - Velero + rlinks: + - href: https://github.com/vmware-tanzu/velero + - uuid: BB87D415-A459-4778-BCDB-B33B4579C00F + title: Big Bang Velero package + rlinks: + - href: https://repo1.dso.mil/platform-one/big-bang/apps/cluster-utilities/velero diff --git a/src/velero/tasks.yaml b/src/velero/tasks.yaml index e3b314c9b..467adaab0 100644 --- a/src/velero/tasks.yaml +++ b/src/velero/tasks.yaml @@ -1,7 +1,82 @@ tasks: - name: validate actions: - - description: Validate... - cmd: "echo Replace Me" - # wait: - # cluster: + - task: health-check + - task: execute-backup + + - name: health-check + actions: + - description: Velero StatefulSet Health Check + wait: + cluster: + kind: Deployment + name: velero + namespace: velero + + - name: execute-backup + actions: + - description: generates a unique backup name + cmd: "echo \"velero-test-$(date +'%Y%m%d%H%M%S')\"" + mute: true + setVariables: + - name: BACKUP_NAME + - description: "creates a velero backup object (equivilent of `velero backup create --from-schedule ...`)" + cmd: |- + uds zarf tools kubectl apply -f - <<-EOF + apiVersion: velero.io/v1 + kind: Backup + metadata: + name: ${BACKUP_NAME} + namespace: velero + spec: + csiSnapshotTimeout: 0s + excludedNamespaces: + - kube-system + - flux + - velero + hooks: {} + includeClusterResources: true + itemOperationTimeout: 0s + metadata: {} + snapshotVolumes: false + ttl: 240h0m0s + EOF + - description: wait for the backup object + wait: + cluster: + kind: Backup + name: ${BACKUP_NAME} + namespace: velero + - description: check the status of the backup object + cmd: |- + STATUS=$(uds zarf tools kubectl get backups -n velero ${BACKUP_NAME} -o jsonpath='{.status.phase}') + if [ ${STATUS} != "Completed" ]; then + echo "Status is '$STATUS'... waiting to see if it changes" + + # local testing indicates the status is "Finalizing" for a few seconds after completion + sleep 15 + + # check again... + STATUS=$(uds zarf tools kubectl get backups -n velero ${BACKUP_NAME} -o jsonpath='{.status.phase}') + if [ ${STATUS} != "Completed" ]; then + echo "Status is $STATUS... something isn't right.." + + # get backup object + uds zarf tools kubectl get backups -n velero ${BACKUP_NAME} -o yaml + zarf tools kubectl get backups -A -o yaml + echo "::endgroup::" + + # get backupstoragelocations + uds zarf tools kubectl get backupstoragelocation -A -o yaml + + # describe backup + uds zarf tools kubectl describe backup -n velero ${BACKUP_NAME} + + # velero pod logs + uds zarf tools kubectl logs -n velero -l name=velero + + # be a quitter + exit 1 + fi + fi + echo "Status is Complete! Great success!" diff --git a/src/velero/values/registry1-values.yaml b/src/velero/values/registry1-values.yaml new file mode 100644 index 000000000..184f7f727 --- /dev/null +++ b/src/velero/values/registry1-values.yaml @@ -0,0 +1,16 @@ +image: + repository: registry1.dso.mil/ironbank/opensource/velero/velero + tag: v1.13.0 + +kubectl: + image: + repository: registry1.dso.mil/ironbank/big-bang/base + tag: 2.1.0 + +initContainers: + - name: velero-plugin-for-aws + image: registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.9.0 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /target + name: plugins diff --git a/src/velero/values/upstream-values.yaml b/src/velero/values/upstream-values.yaml new file mode 100644 index 000000000..663d7f496 --- /dev/null +++ b/src/velero/values/upstream-values.yaml @@ -0,0 +1,16 @@ +image: + repository: velero/velero + tag: v1.13.0 + +kubectl: + image: + repository: docker.io/bitnami/kubectl + tag: 1.28.6 + +initContainers: + - name: velero-plugin-for-aws + image: velero/velero-plugin-for-aws:v1.9.0 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /target + name: plugins diff --git a/src/velero/values/values.yaml b/src/velero/values/values.yaml new file mode 100644 index 000000000..d55bfce80 --- /dev/null +++ b/src/velero/values/values.yaml @@ -0,0 +1,44 @@ +credentials: + useSecret: true + name: "velero-bucket-credentials" + secretContents: + cloud: | + [default] + aws_access_key_id=###ZARF_VAR_VELERO_BUCKET_KEY### + aws_secret_access_key=###ZARF_VAR_VELERO_BUCKET_KEY_SECRET### +configuration: + backupStorageLocation: + - name: default + provider: aws + bucket: "###ZARF_VAR_VELERO_BUCKET###" + config: + region: "###ZARF_VAR_VELERO_BUCKET_REGION###" + s3ForcePathStyle: true + s3Url: "###ZARF_VAR_VELERO_BUCKET_PROVIDER_URL###" + credential: + name: "velero-bucket-credentials" + key: "cloud" + # volumeSnapshotLocation: + # - name: default + # provider: aws + # config: + # region: "###ZARF_VAR_VELERO_BUCKET_REGION###" + # s3ForcePathStyle: true + # s3Url: "###ZARF_VAR_VELERO_BUCKET_PROVIDER_URL###" + # credential: + # name: "velero-bucket-credentials" + # key: "cloud" +snapshotsEnabled: false +schedules: + udsbackup: + disabled: false + schedule: "0 3 * * *" + useOwnerReferencesInBackup: false + template: + csiSnapshotTimeout: 0s + includeClusterResources: true + snapshotVolumes: false + excludedNamespaces: + - kube-system + - velero + ttl: "240h" diff --git a/src/velero/zarf.yaml b/src/velero/zarf.yaml index 6b45dee16..9d63d247e 100644 --- a/src/velero/zarf.yaml +++ b/src/velero/zarf.yaml @@ -1,11 +1,36 @@ kind: ZarfPackageConfig metadata: name: uds-core-velero - description: "Example description" + description: "UDS Core Velero" + url: https://velero.io/ components: - - name: test - actions: - onCreate: - after: - - cmd: echo "What can Doug do for you?" + - name: velero + required: true + only: + flavor: upstream + import: + path: common + charts: + - name: velero + valuesFiles: + - values/upstream-values.yaml + images: + - velero/velero:v1.13.0 + - velero/velero-plugin-for-aws:v1.9.0 + - docker.io/bitnami/kubectl:1.28.6 + + - name: velero + required: true + only: + flavor: registry1 + import: + path: common + charts: + - name: velero + valuesFiles: + - values/registry1-values.yaml + images: + - registry1.dso.mil/ironbank/opensource/velero/velero:v1.13.0 + - registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws:v1.9.0 + - registry1.dso.mil/ironbank/big-bang/base:2.1.0