Deploy a Reliable Backup Solution for On-Prem Kubernetes with Velero and S3

In the dynamic world of container orchestration, Kubernetes reigns supreme. However, the importance of data backup and disaster recovery is often overlooked—especially in on-premises Kubernetes environments. In this guide, we’ll deploy a reliable backup solution using Velero with Amazon S3 as the storage backend. This ensures that even your on-prem Kubernetes clusters enjoy cloud-grade resilience and data recovery.

---

Why Use Velero for Kubernetes Backup?

Velero is an open-source tool that offers:

• Backup and restore of Kubernetes resources and persistent volumes
  
  

• Disaster recovery across clusters and environments
  
  

• Migration capabilities between clusters
  
  

It supports multiple storage backends, including Amazon S3, making it ideal for hybrid or on-prem environments where you want the reliability and scalability of the cloud.

---

 Prerequisites

To follow this guide, ensure the following:

• A running on-prem Kubernetes cluster (K8s v1.20+ recommended)
  
  

• kubectl is configured to access the cluster
  
  

• An AWS S3 bucket
  
  

• An IAM user with appropriate S3 access credentials
  
  

• A machine (local or VM) from which to install and configure Velero
  
  

---

Step-by-Step Deployment Guide

1. Create an S3 Bucket for Backups

Log in to your AWS console and create an S3 bucket (e.g., my-k8s-backups). Enable versioning and configure encryption (SSE-S3 or SSE-KMS).

aws s3api create-bucket --bucket my-k8s-backups --region us-east-1

aws s3api put-bucket-versioning --bucket my-k8s-backups --versioning-configuration Status=Enabled

---

2. Create an IAM User and Generate Access Keys

Create an IAM user with Programmatic Access and attach the following policy:

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Action": [

        "s3:PutObject",

        "s3:GetObject",

        "s3:DeleteObject",

        "s3:ListBucket"

      ],

      "Resource": [

        "arn:aws:s3:::my-k8s-backups",

        "arn:aws:s3:::my-k8s-backups/*"

      ]

    }

  ]

}

Save the Access Key ID and Secret Access Key securely.

---

3. Install Velero CLI

Download and install Velero on your local machine:

curl -L https://github.com/vmware-tanzu/velero/releases/download/v1.13.0/velero-v1.13.0-linux-amd64.tar.gz | tar -xz

sudo mv velero-v1.13.0-linux-amd64/velero /usr/local/bin/

---

4. Install Velero in the Cluster

Use Velero to install the backup system into your Kubernetes cluster with your S3 bucket:

velero install \

    --provider aws \

    --plugins velero/velero-plugin-for-aws:v1.7.0 \

    --bucket my-k8s-backups \

    --backup-location-config region=us-east-1,s3ForcePathStyle=true,s3Url=https://s3.amazonaws.com \

    --secret-file ./credentials-velero

The credentials-velero file should contain:

[default]

aws_access_key_id = YOUR_ACCESS_KEY

aws_secret_access_key = YOUR_SECRET_KEY

---

5. Verify Velero Installation

Check that all components are running:

kubectl get pods -n velero

velero backup-location get

---

6. Create Your First Backup

velero backup create cluster-backup-01 --include-namespaces default

velero backup get

You can also schedule recurring backups:

velero schedule create daily-backup --schedule="0 1 * * *"

---

7. Restore a Backup

In case of disaster or migration:

velero restore create --from-backup cluster-backup-01

---

 Testing the Backup and Restore Process

Always validate:

1. Backup data consistency
   
   

2. Persistent volume snapshot functionality
   
   

3. Successful restoration into a clean or separate namespace
   
   

Simulate a deletion and restore cycle to verify disaster readiness.

---

Security and Best Practices

• Enable S3 encryption (SSE-KMS) for sensitive data.
  
  

• Use dedicated IAM roles with least privilege.
  
  

• Monitor backups with Velero logs and alerts.
  
  

• Enable log retention policies and object lifecycle management in S3.
  
  

• Consider Velero Restic integration for volume backups without CSI.
  
  

---

Conclusion

Deploying Velero with S3 brings enterprise-grade backup and disaster recovery capabilities to your on-prem Kubernetes setup. With minimal setup and powerful features, it ensures your critical workloads remain protected and portable.

Whether operating in a hybrid cloud environment or aiming for regulatory compliance, this solution is robust, flexible, and cost-effective.