Container Service for Kubernetes:Back up and restore applications with Terraform

Create an instant backup task

1. Add the following to csdr.tf, replacing placeholders:

   If your ACK cluster uses Velero, join DingTalk group 35532895 for technical support.

   Parameter	Required	Description
   csdr.alibabacloud.com/backuplocations	Yes	The backup vault annotation. Must match the BackupLocation configuration exactly.
   name	Yes	Name of the instant backup task.
   includedNamespaces	Yes	Namespaces to back up.
   includedResources	No	Resource types to include. Specify only one of includedResources or excludedResources. If both are empty, all resource types are backed up.
   excludedResources	No	Resource types to exclude. See includedResources.
   matchLabels	No	Labels of the resources to back up.
   includeClusterResources	No	Controls cluster-scoped resources. true: all cluster-scoped resources. false or unset: only those referenced by the specified namespaces. Default in the ACK console: false.
   defaultPvBackup	No	true: back up applications and volumes. false: back up applications only.
   storageLocation	Yes	Name of the backup vault (BackupLocation).
   ttl	Yes	Backup validity period. Format: 720h0m0s. Valid range: 24h0m0s to 1572864h0m0s. Expired backups cannot be restored.

   resource "kubernetes_manifest" "applicationbackup-demo" {
     manifest = {
       apiVersion = "csdr.alibabacloud.com/v1beta1"
       kind       = "ApplicationBackup"
       metadata = {
         name      = "<your-backup-task-name>"
         namespace = "csdr"
         annotations = {
           # Must match the backup vault configuration exactly
           "csdr.alibabacloud.com/backuplocations" = "{\"name\":\"<your-backup-vault-name>\",\"region\":\"cn-beijing\",\"bucket\":\"<cnfs-oss-your-bucket-name>\",\"prefix\":\"<sub-directory>\",\"provider\":\"alibabacloud\"}"
         }
       }
       spec = {
         includedNamespaces = ["default", "default1"]  # Namespaces to back up
   
         # Specify only one of includedResources or excludedResources.
         # If both are empty, all resource types are backed up.
         includedResources = ["statefulset"]
         excludedResources = ["excludedResources"]
   
         labelSelector = {
           matchLabels = {
             "app" = "mysql-sts"  # Optional: back up only resources with these labels
           }
         }
   
         pvBackup = {
           defaultPvBackup = "false"  # "true": back up apps and volumes; "false": apps only
         }
   
         storageLocation = "<your-backup-vault-name>"  # Must match the BackupLocation name
   
         ttl = "720h0m0s"  # Backup validity period. Format: 720h0m0s
                           # Valid range: 24h0m0s to 1572864h0m0s
                           # Expired backups cannot be restored
   
         # includeClusterResources controls whether cluster-scoped resources are included:
         # "true"  — include all cluster-scoped resources (StorageClasses, CRDs, webhooks, etc.)
         # "false" — include only cluster-scoped resources referenced by the specified namespaces
         #           (for example, if a pod uses a service account with a cluster role,
         #            that cluster role is automatically included)
         # Unset  — same behavior as "false" when namespace filtering is used
         includeClusterResources = "false"
       }
     }
   
     # Uncomment to wait for backup completion (recommended for scripted workflows).
     # Backup duration depends on the number of applications and volume data size.
     #wait {
     #  fields = {
     #    "status.phase" = "Completed"
     #  }
     #}
     #timeouts {
     #  create = "60m"
     #}
   }

2. Preview the changes:

   terraform plan

3. Create the instant backup task:

   terraform apply

   Expand to view the output

   kubernetes_manifest.applicationbackup-demo: Creating...
   kubernetes_manifest.applicationbackup-demo: Creation complete after 1s
   
   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Create a scheduled backup task

1. Add the following to csdr.tf, replacing placeholders:

   Expand to view the configuration file

   resource "kubernetes_manifest" "backupschedule-demo" {
     manifest = {
       apiVersion = "csdr.alibabacloud.com/v1beta1"
       kind       = "BackupSchedule"
       metadata = {
         name      = "<your-schedule-name>"
         namespace = "csdr"
         annotations = {
           "csdr.alibabacloud.com/backuplocations" = "{\"name\":\"<your-backup-vault-name>\",\"region\":\"cn-beijing\",\"bucket\":\"<cnfs-oss-your-bucket-name>\",\"prefix\":\"<sub-directory>\",\"provider\":\"alibabacloud\"}"
         }
       }
       spec = {
         # Cron expression for the backup schedule (server time zone).
         # Format:  minute  hour  day-of-month  month  day-of-week
         # Example: "1 4 * * *" runs at 04:01 every day.
         schedule = "1 4 * * *"
   
         template = {
           includedNamespaces = ["default", "default1"]
           includedResources  = ["statefulset"]
           excludedResources  = ["excludedResources"]
           labelSelector = {
             matchLabels = {
               "app" = "mysql-sts"
             }
           }
           pvBackup = {
             defaultPvBackup = "false"  # Required for BackupSchedule
           }
           storageLocation         = "<your-backup-vault-name>"
           ttl                     = "720h0m0s"
           includeClusterResources = "false"
         }
       }
     }
   
     wait {
       fields = {
         "status.phase" = "Enabled"
       }
     }
   
     timeouts {
       create = "10m"
     }
   }

   Parameter	Required	Description
   csdr.alibabacloud.com/backuplocations	Yes	The backup vault annotation. Must match the BackupLocation configuration exactly.
   name	Yes	Name of the scheduled backup task.
   schedule	Yes	Backup frequency as a cron expression. Format: minute hour day-of-month month day-of-week. Example: "1 4 * * *" runs at 04:01 every day.
   includedNamespaces	Yes	Namespaces to back up.
   includedResources	No	Resource types to include. Specify only one of includedResources or excludedResources. If both are empty, all resource types are backed up.
   excludedResources	No	Resource types to exclude. See the note for includedResources.
   matchLabels	No	Labels of the resources to back up.
   includeClusterResources	No	Controls cluster-scoped resources. true: all cluster-scoped resources. false or unset: only those referenced by the specified namespaces.
   defaultPvBackup	Yes	true: back up applications and volumes. false: back up applications only.
   storageLocation	Yes	Name of the backup vault (BackupLocation).
   ttl	Yes	Backup validity period. Format: 720h0m0s. Valid range: 24h0m0s to 1572864h0m0s.

2. Preview the changes:

   terraform plan

3. Create the scheduled backup task:

   terraform apply

   Expand to view the output

   kubernetes_manifest.backupschedule-demo: Creating...
   kubernetes_manifest.backupschedule-demo: Creation complete after 1s
   
   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Manage scheduled backup tasks

Find backups created by a schedule

List backups from a specific schedule:

data "kubernetes_resources" "list-applicationbackup" {
  api_version    = "csdr.alibabacloud.com/v1beta1"
  kind           = "ApplicationBackup"
  namespace      = "csdr"
  label_selector = "csdr/schedule-name=<your-schedule-name>"
}

output "applicationbackup-name" {
  value = data.kubernetes_resources.list-applicationbackup.objects
}

Modify a scheduled backup task

To change parameters such as schedule frequency:

1. Set spec.paused to "true" to pause the schedule, then update parameters. Example:

   Expand to view the configuration file

   resource "kubernetes_manifest" "backupschedule-demo" {
     manifest = {
       apiVersion = "csdr.alibabacloud.com/v1beta1"
       kind       = "BackupSchedule"
       metadata = {
         name      = "<your-schedule-name>"
         namespace = "csdr"
         annotations = {
           "csdr.alibabacloud.com/backuplocations" = "{\"name\":\"<your-backup-vault-name>\",\"region\":\"cn-beijing\",\"bucket\":\"<cnfs-oss-your-bucket-name>\",\"prefix\":\"<sub-directory>\",\"provider\":\"alibabacloud\"}"
         }
       }
       spec = {
         paused   = "true"        # Pause the schedule before modifying
         schedule = "0 5 * * *"   # Updated backup frequency
         template = {
           includedNamespaces      = ["default", "default1"]
           includedResources       = ["statefulset"]
           excludedResources       = ["excludedResources"]
           labelSelector = {
             matchLabels = {
               "app" = "mysql-sts"
             }
           }
           pvBackup = {
             defaultPvBackup = "false"
           }
           storageLocation         = "<your-backup-vault-name>"
           ttl                     = "720h0m0s"
           includeClusterResources = "false"
         }
       }
     }
     wait {
       fields = {
         "status.phase" = "Paused"  # Confirm the schedule is paused before applying further changes
       }
     }
     timeouts {
       create = "10m"
     }
   }

2. Preview the changes:

   terraform plan

3. Apply the updated configuration:

   terraform apply

   Expected output:

   kubernetes_manifest.backupschedule-demo: Modifying...
   kubernetes_manifest.backupschedule-demo: Modifications complete after 1s
   
   Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Data protection (PvBackup)

Set backupType to PvBackup to back up volume data only. Specify pvcList to back up specific PVCs, or storageClassList to back up volumes of specific StorageClasses. If you set both, storageClassList is ignored. If you set neither, all volumes in the included namespaces are backed up.

Delete a scheduled backup task

Run terraform destroy to remove the BackupSchedule and stop the schedule.

Delete a backup task or restoration task

Use a DeleteRequest CR to safely remove backup or restoration tasks and associated cloud resources.

Deleting a backup task does not affect existing backups. Deleting a restoration task does not affect restored data.

1. Add the following to csdr.tf:

   Parameter	Required	Description
   name	Yes	Name of the deletion request. Format: <ApplicationBackup-name>-dbr to delete a backup task, or <ApplicationRestore-name>-dbr to delete a restoration task.
   deleteObjectName	Yes	Name of the resource to delete.
   deleteObjectType	Yes	"Backup": deletes the ApplicationBackup CR and related resources. "Restore": deletes the ApplicationRestore CR and related resources.

   resource "kubernetes_manifest" "deleterequest-demo" {
     manifest = {
       apiVersion = "csdr.alibabacloud.com/v1beta1"
       kind       = "DeleteRequest"
       metadata = {
         name      = "<object-name>-dbr"  # Format: <ApplicationBackup-or-ApplicationRestore-name>-dbr
         namespace = "csdr"
       }
       spec = {
         deleteObjectName = "<object-name>"   # Name of the backup or restoration task to delete
         deleteObjectType = "Backup"          # "Backup": deletes ApplicationBackup and related resources
                                              # "Restore": deletes ApplicationRestore and related resources
       }
     }
   }

2. Preview the changes:

   terraform plan

3. Apply the deletion:

   terraform apply

   Expand to view the output

   kubernetes_manifest.deleterequest-demo: Creating...
   kubernetes_manifest.deleterequest-demo: Creation complete after 0s
   
   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

   After deleting the target resource, the system also deletes the DeleteRequest CR.