Install migrate-controller

Step 1: Make preparations

Before you install and use migrate-controller, perform the following steps:

1. Create a Resource Access Management (RAM) user and create an AccessKey pair for the RAM user.
   Before you can install the component in a registered cluster, you must set the AccessKey information to grant the registered cluster the permissions to access Alibaba Cloud resources. Before you set the AccessKey information, create a RAM user and grant the RAM user the permissions to access Alibaba Cloud resources.
   1. Create a RAM user.

      For more information, see Create a RAM user.

   2. Create a permission policy.
      For more information, see Create a custom policy.

      The following code block shows the content of the permission policy for Velero:

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "oss:PutObject",
                      "oss:GetObject",
                      "oss:DeleteObject",
                      "oss:GetBucket",
                      "oss:ListObjects",
                      "oss:ListBuckets"
                  ],
                  "Resource": [
                      "*"
                  ],
                  "Effect": "Allow"
              }
          ]
      }

      If you want to grant the RAM user only the read and write permissions on the mybackups resource in an Object Storage Service (OSS) bucket, create a permission policy based on the following content:

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "oss:PutObject",
                      "oss:GetObject",
                      "oss:DeleteObject",
                      "oss:GetBucket",
                      "oss:ListObjects",
                      "oss:ListBuckets"
                  ],
                  "Resource": [
                      "acs:oss:*:*:mybackups",
                      "acs:oss:*:*:mybackups/*"
                  ],
                  "Effect": "Allow"
              }
          ]
      }

      For information about how to regulate finer-grained access to an OSS bucket, see Use RAM to manage OSS permissions.

   3. Grant permissions to the RAM user.

      For more information, see Grant permissions to a RAM user.

   4. Create an AccessKey pair for the RAM user.

      For more information, see Obtain an AccessKey pair.

2. Create a Secret in the registered cluster.
   To ensure that the AccessKey information is used only within the registered cluster, you must first use the AccessKey pair to deploy a Secret named alibaba-addon-secret in the cluster. This reduces the risk of information leakage. Like the Velero open source community, Container Service for Kubernetes (ACK) installs migrate-controller in the velero namespace. If the namespace does not exist, you must first create a namespace and name it velero. Then, use the AccessKey pair to create the alibaba-addon-secret Secret in the namespace. Command:

   kubectl create ns velero
   kubectl -n velero create secret generic alibaba-addon-secret --from-literal='access-key-id=<your AccessKey ID>' --from-literal='access-key-secret=<your AccessKey Secret>'

   Notice

   Replace <your AccessKey ID> and <your AccessKey Secret> in the preceding command with the AccessKey ID and AccessKey secret obtained in Step 1.

3. Install the Velero client in the registered cluster.

   Velero provides client-side binary files that enable you to submit backup and recovery tasks to the Velero server in an easy and efficient manner.

   You must install the Velero client on a machine that allows you to access your registered cluster by using the kubeconfig file. Download the Velero client based on the operating system of your machine.

After you complete the preceding steps, perform the following operations to install and use migrate-controller (the Velero server).

Step 2: Install migrate-controller

1. Log on to the ACK console.
2. In the left-side navigation pane, click Clusters.
3. On the Clusters page, find the cluster that you want to manage and choose More > Manage System Components in the Actions column.
4. On the Add-ons page, find the migrate-controller component and click Install.

Step 3: Configure an OSS bucket

You must create a resource of the BackupStorageLocation type in an OSS bucket. The resource is used to specify the storage location for Velero backups.

1. Create a file named BackupStorageLocation.yaml and copy the following content to the file:

   apiVersion: velero.io/v1
   kind: BackupStorageLocation
   metadata:
     labels:
       component: velero
     name: default
     namespace: velero
   spec:
     config:
       region: cn-hangzhou
     objectStorage:
       bucket: velero-bucket
     provider: alibabacloud

   Parameter descriptions:

   Note

   • Set spec.config.region to the region where the OSS bucket is created.
   • Set spec.objectStorage.bucket to the name of the OSS bucket.
   • If data is transmitted to an internal OSS endpoint, add spec.config.network: internal to the file. This way, ACK transmits data over the Internet by default.
   • To use a specified subdirectory of the OSS bucket, add spe.objectStorage.prefix: <your prefix> to the file. This way, ACK uses the root directory of the OSS bucket by default.
2. Run the following command to create a BackupStorageLocation resource:

   kubectl apply -f BackupStorageLocation.yaml