Skip to content

Velero

Velero provides Kubernetes backup and restore capabilities. This package wraps the upstream Velero chart 12.2.0 and supplies Big Bang integration for hardened images, networking, Istio, monitoring, OpenShift, CSI snapshot classes, and backup/restore testing. See the Velero 1.18 documentation for product concepts, backup and restore workflows, and the complete configuration surface.

Configure Velero in Big Bang

Enable the package with the canonical umbrella configuration path addons.velero. Package values are supplied below addons.velero.values; the package passes upstream chart values through the upstream parent. See the upstream chart values for the complete upstream configuration surface.

The umbrella owns package source selection, credentials, provider-specific storage settings, and dependency ordering. Keep credentials out of committed values files. Supply references to secrets through your approved deployment workflow and configure the matching provider, plugin, and storage locations together. A backup storage location must become available before backups can succeed.

The wrapper includes the AWS provider plugin by default. Configure any other provider plugin and its compatible storage and snapshot locations using the upstream configuration. Verify provider, plugin, Kubernetes, and Velero compatibility before upgrading or restoring production data.

Storage and snapshots

Velero stores backup data in the configured object storage location. The object store, bucket or equivalent container, endpoint reachability, and credentials are environment-specific and are not provisioned by this package. Big Bang provides network-policy support for storage subnets; operators must ensure the selected object store is reachable from Velero.

For CSI snapshots, set the upstream CSI feature only when the cluster provides the VolumeSnapshot, VolumeSnapshotClass, and VolumeSnapshotContent APIs. The package creates a VolumeSnapshotClass only in that mode and requires a non-empty csi.driver; select a driver that matches the storage provider. Snapshot and object-storage recovery behavior remains provider-specific.

For an environment already running the AWS EBS CSI driver and all three snapshot APIs, these package values show both configuration parents:

upstream:
  configuration:
    features: EnableCSI
csi:
  driver: ebs.csi.aws.com
  defaultClass: "false"

Use the actual provider-matching driver; this does not install one or configure object storage/credentials. The wrapper’s class guard matches exactly features: EnableCSI, not a comma-separated feature list. It creates class csi-volumesnapshotclass with Velero’s selection label and deletionPolicy: Delete. defaultClass is a quoted string and here avoids making this the cluster-wide default, but Velero can still select its labeled class. Review existing snapshot classes, driver behavior, and snapshot lifetime before enabling it; do not assume provider snapshots survive deletion of their snapshot objects. For a different retention policy or combined features, use a deliberately managed class and review the upstream procedure rather than relying on this wrapper’s class creation. Validate snapshot creation and a representative restore in an isolated target.

Big Bang integration

  • Big Bang deploys Velero in the velero namespace and supplies image pull, monitoring, Istio, OpenShift, network, and test defaults.
  • When enabled, the umbrella orders Velero after Istio, Kyverno Policies, and monitoring as applicable. It also enables metrics scraping and the matching network-policy paths when monitoring is enabled.
  • The package supplies hardened Iron Bank images and security defaults. Its CRD upgrade job keeps Istio injection disabled and retains Kubernetes API egress. Do not enable upstream CRD cleanup outside disposable CI: it removes Velero custom resources from the cluster.
  • Enabling the node agent permits file-system backup but requires host paths and root execution. Review the associated provider and security implications before enabling it.

Operations and validation

Use the upstream backup documentation and restore documentation for operating Velero. A successful backup alone is not sufficient recovery evidence: test a restore using representative data and resources in an isolated environment.

This repository includes a deployed backup/restore test that waits for the default backup storage location, creates a test workload and PVC, backs it up, deletes it, restores it, and verifies that the restored workload responds. It requires configured object storage and credentials; it is not a substitute for provider-specific disaster-recovery validation.

See the existing backup guidance for repository-local examples. Do not run destructive backup, delete, restore, or CRD-cleanup operations against production without an approved recovery plan.