Skip to main content
Version: 9.0.3 (latest)

Shareable Volume Backup and Restore

In environments where supported storage snapshot capabilities are not available, Veeam Kasten provides the ability perform a live read of the the source volume. For single-access, ReadWriteOnce (RWO) PVCs, see Generic Storage Backup for complete details on configuring the required sidecar container for existing workloads.

For multi-access, ReadWriteMany (RWX) PVCs, Veeam Kasten is able to perform the live backup without requiring workload modification. Instead, a separate Pod is temporarily provisioned in the application namespace to mount and read the PVC.

warning

If available, snapshot capable storage should always be used in favor of generic backup. This method performs a file system traversal on a live PVC. As a result, the backup obtained will not be crash-consistent. This is acceptable if:

  • Crash consistency is not required for the volume, or
  • Consistency is enforced via Blueprint to quiesce/freeze the workload during the backup action period
warning

Generic storage backup workflows are not compatible with immutable backups location profiles. Immutable backups enabled location profiles can be used with these workflows, but the protection period will be ignored, and no point-in-time restore functionality will be provided. Please note that use of an object-locking bucket for such cases can amplify storage usage without any additional benefit.

warning

Shareable volume backup and restore workflows are not compatible with NFS/SMB location profiles.

Prerequisites​

To perform a generic backup of a shareable volume, all of the following conditions must be met:

  • Only Filesystem mode PVCs are supported
  • Only PVCs bound with ReadWriteMany (RWX) access mode are supported
  • Statically provisioned PVCs must reference a StorageClass
Note

Dynamically provisioned PVCs created using the AWS EFS CSI provisioner (efs.csi.aws.com) will automatically be protected using shareable volume generic backup. No additional StorageClass annotation is required.

Enabling Shareable Volume Backup​

To minimize required end user configuration, shareable volume generic backup is applied to all supported volumes associated with a given StorageClass by applying a single annotation: 

kubectl annotate storageclass <rwx-storageclass-name>\
  k10.kasten.io/rwx-generic-backup="true"

After enabling the capability on the StorageClass, ensure relevant Kasten policies specify a Location Profile for Kanister Actions, which defines the target location for all generic backups performed on behalf of the policy.

Additional OpenShift Requirements​

When configuring generic backups of shareable volumes on OpenShift, the following additional steps are required per application namespace:

Update Pod Security Admission​

The Kasten datamover pod requires additional capabilities (CHOWN, DAC_OVERRIDE, FOWNER), requiring Pod Security Admission to allow privileged pods within the application namespace: 

oc label ns <app-namespace> \
  pod-security.kubernetes.io/enforce=privileged \
  --overwrite

Grant SCC to the Namespace Service Account​

The service account that runs the datamover pod must have a binding to a Security Context Constraints (SCC) profile that permits the required capabilities. Allow the application namespace service account to use the built-in Veeam Kasten SCC profile: 

oc adm policy add-scc-to-user k10-scc \
  system:serviceaccount:<app-namespace>:default