Protecting OpenShift Virtualization VMs

OpenShift Virtualization is an add-on to OpenShift Container Platform that allows the creation and execution of Virtual Machine workloads alongside container workloads. Once installed on the OpenShit Container Platform, OpenShift Virtualization introduces some custom resources that can be used to manage Virtual Machine workloads. Read the official documentation to learn more about OpenShift Virtualization.

Virtual Machines as Workloads in K10

If OpenShift Virtualization is enabled in the OpenShift cluster and there are some Virtual Machines created, K10 will automatically discover those Virtual Machines and treat them as workloads.

Backup the Virtual Machines

Since K10 is able to discover the Virtual Machines running on the cluster and treat them as workloads, they can be easily backed up like any other application. To protect a Virtual Machine present in a namespace, a policy should be created and run for that namespace.

If there is a need to freeze the guest filesystem of the Virtual Machine before backing up the disks, K10 can be instructed to freeze/thaw the guest filesystem before and after the disk snapshots by annotating the virtual machine with a specific annotation before running the policy.

The Virtual Machine resource can be annotated using below command.

kubectl annotate virtualmachine -n <namespace> <virtualmachine-name> k10.kasten.io/freezeVM=true

After annotating the Virtual Machine, if the policy that protects this application is run, the Virtual Machine will be frozen before a snapshot is taken and unfrozen after the snapshot has been taken.

If it's not acceptable to have the Virtual Machine's guest filesystem frozen for the time that creating the snapshot takes, K10 can be instructed to abort the snapshot operation and unfreeze the Virtual Machine. The helm flag below can be used to specify the maximum time duration that is allowed for K10 to take to snapshot the Virtual Machine's volumes.

helm install ... --set kubeVirtVMs.snapshot.unfreezeTimeout="3m"

If this field is not specified, it defaults to 5 minutes. The format of how this value can be written is documented here.

Note

If there is more than one Virtual Machines to protect, all of them must be annotated with the same annotation mentioned above.

Restore the Virtual Machines

Restoring the backed up Virtual Machines will require K10 transforms to be applied. These transforms are used to instruct the OpenShift Virtualization operator to not handle data import/population activities and let K10 restore the data.

If the Virtual Machine instance involves any DataVolume references, transforms in the DataVolume and respective PersistentVolumeClaim resources must be applied. Read more about K10 transforms here.

Note

This transform is applicable for all the DataVolume resources referenced by in the Virtual Machine.

These are the three transforms that must be applied before restoring the application that has Virtual Machines. The transforms must be applied either while creating the import+restore policy or while restoring the application from a local restore point.

Annotate DataVolume

Resource that the transform must be applied on should be DataVolume

And below is the transform that should be applied

op: add
key: /metadata/annotations/cdi.kubevirt.io~1storage.prePopulated
value: <datavolume-name>

Annotate PVC

Resource that the transform must be applied on should be PersistentVolumeClaim

And below is the transform that should be applied

op: add
key: /metadata/annotations/cdi.kubevirt.io~1storage.populatedFor
value: <datavolume-name>

Remove MAC Address from Virtual Machine resource

The MAC address must be removed from Virtual Machine resource as it is assigned by the OpenShift Virtualization Operator.

And below is the transform that should be applied

op: remove
path: /spec/template/spec/domain/devices/interfaces/0/macAddress

Once all these transforms are applied, run the restore action and wait for the action to complete. Once the restore action succeeds, make sure the Virtual Machine is running in the target namespace/cluster.