Protecting OpenShift Virtualization VMs

OpenShift Virtualization is an add-on to the OpenShift Container Platform that allows the creation and execution of Virtual Machine workloads alongside container workloads. Once installed on the OpenShit Container Platform, OpenShift Virtualization introduces some custom resources that can be used to manage Virtual Machine workloads. Read the official documentation to learn more about OpenShift Virtualization.

Virtual Machines as Workloads in K10

If OpenShift Virtualization is enabled in the OpenShift cluster and there are some Virtual Machines created, K10 will automatically discover those Virtual Machines and treat them as workloads.

../_images/vm-as-workload.png

Backup the Virtual Machines

Since K10 can discover the Virtual Machines running on the cluster and treat them as workloads, they can be easily backed up like any other application. To protect a Virtual Machine present in a namespace, a policy should be created and run for that namespace.

If there is a need to freeze the guest filesystem of the Virtual Machine before backing up the disks, K10 can be instructed to freeze/thaw the guest filesystem before and after the disk snapshots by annotating the virtual machine with a specific annotation before running the policy.

The Virtual Machine resource can be annotated using the command below.

kubectl annotate virtualmachine -n <namespace> <virtualmachine-name> k10.kasten.io/freezeVM=true

After annotating the Virtual Machine, if the policy that protects this application is run, the Virtual Machine will be frozen before a snapshot is taken and unfrozen after the snapshot has been taken.

If it's not acceptable to have the Virtual Machine's guest filesystem frozen for the time that creating the snapshot takes, K10 can be instructed to abort the snapshot operation and unfreeze the Virtual Machine. The helm flag below can be used to specify the maximum time duration that is allowed for K10 to take snapshots of the Virtual Machine's volumes.

helm install ... --set kubeVirtVMs.snapshot.unfreezeTimeout="3m"

If this field is not specified, it defaults to 5 minutes. The format of how this value can be written is documented here.

Note

If there is more than one Virtual Machines to protect, all of them must be annotated with the same annotation mentioned above.

Restore the Virtual Machines

Restoring the backed-up Virtual Machines will require K10 transforms to be applied. These transforms are used to instruct the OpenShift Virtualization operator to not handle data import/population activities and let K10 restore the data.

If the Virtual Machine instance involves any DataVolume references, transforms on the DataVolume and respective PersistentVolumeClaim resources must be applied. Otherwise, transforms are required just on VirtualMachine resources. Read more about K10 transforms here.

These are the three transforms that must be applied before restoring the application that has Virtual Machines. The transforms must be applied either while creating the import+restore policy or while restoring the application from a local restore point.

Annotate DataVolume

Resource that the transform must be applied on should be DataVolume

../_images/dv-resource.png

And below is the transform that should be applied

op: add
key: /metadata/annotations/cdi.kubevirt.io~1storage.prePopulated
value: <datavolume-name>

Note

This transform needs to be applied to all the DataVolume resources referenced in the Virtual Machine.

Annotate PVC

Resource that the transform must be applied on should be PersistentVolumeClaim

../_images/pvc-resource.png

And below is the transform that should be applied

op: add
key: /metadata/annotations/cdi.kubevirt.io~1storage.populatedFor
value: <datavolume-name>

Note

This transform needs to be applied to all the PersistentVolumeClaim resources referenced in the Virtual Machine.

Remove MAC Address from Virtual Machine resource

The MAC address must be removed from Virtual Machine resource as it is assigned by the OpenShift Virtualization Operator.

../_images/vm-resource.png

And below is the transform that should be applied

op: remove
path: /spec/template/spec/domain/devices/interfaces/0/macAddress

Note

This transform needs to be applied to all the macAddress fields of the Virtual Machine. For the first field, the transform path should be /spec/template/spec/domain/devices/interfaces/0/macAddress and for the next one /spec/template/spec/domain/devices/interfaces/1/macAddress and so on.

Once all these transforms are applied, run the restore action and wait for the action to complete. Once the restore action succeeds, make sure the Virtual Machine is running in the target namespace/cluster.