Backup e Disaster Recovery con Velero

# Installa CLI
brew install velero  # macOS
# oppure: wget dal GitHub release

# Installa su cluster con Helm (esempio MinIO / S3-compatibile)
helm repo add vmware-tanzu https://vmware-tanzu.github.io/helm-charts
helm repo update

helm install velero vmware-tanzu/velero \
  --namespace velero \
  --create-namespace \
  --set configuration.backupStorageLocation[0].name=default \
  --set configuration.backupStorageLocation[0].provider=aws \
  --set configuration.backupStorageLocation[0].bucket=velero-backups \
  --set configuration.backupStorageLocation[0].config.region=eu-west-1 \
  --set configuration.backupStorageLocation[0].config.s3ForcePathStyle=true \
  --set configuration.backupStorageLocation[0].config.s3Url=http://minio.storage:9000 \
  --set configuration.volumeSnapshotLocation[0].name=default \
  --set configuration.volumeSnapshotLocation[0].provider=aws \
  --set configuration.volumeSnapshotLocation[0].config.region=eu-west-1 \
  --set credentials.secretContents.cloud="[default]\naws_access_key_id=minioadmin\naws_secret_access_key=minioadmin\n" \
  --set initContainers[0].name=velero-plugin-for-aws \
  --set initContainers[0].image=velero/velero-plugin-for-aws:v1.10.0 \
  --set initContainers[0].volumeMounts[0].mountPath=/target \
  --set initContainers[0].volumeMounts[0].name=plugins

# Verifica
velero backup-location get
kubectl get pods -n velero

# Backup di tutto il cluster
velero backup create full-backup

# Backup di un namespace specifico
velero backup create prod-backup --include-namespaces production

# Backup con selettore label
velero backup create api-backup \
  --selector app=api \
  --include-namespaces production,staging

# Backup escludendo risorse
velero backup create no-secrets \
  --exclude-resources secrets

# Backup con TTL (scade dopo 30 giorni)
velero backup create monthly-backup \
  --include-namespaces production \
  --ttl 720h

# Verifica stato
velero backup describe prod-backup
velero backup logs prod-backup

# Ogni giorno alle 2:00 AM
velero schedule create daily-prod \
  --schedule="0 2 * * *" \
  --include-namespaces production \
  --ttl 168h  # 7 giorni di retention

# Ogni ora
velero schedule create hourly-critical \
  --schedule="0 * * * *" \
  --selector tier=critical \
  --ttl 48h

# Lista schedule
velero schedule get

# Forza file-level backup per un Pod (annotazione)
kubectl annotate pod mydb \
  backup.velero.io/backup-volumes=data

# CSI Snapshot (automatico se driver supporta)
# Velero lo usa se trova una VolumeSnapshotClass per il driver

# Restore completo da un backup
velero restore create --from-backup prod-backup

# Restore in un namespace diverso (migrazione)
velero restore create --from-backup prod-backup \
  --namespace-mappings production:staging

# Restore solo alcune risorse
velero restore create --from-backup prod-backup \
  --include-resources deployments,services,configmaps

# Restore con selettore label
velero restore create --from-backup prod-backup \
  --selector app=api

# Verifica stato del restore
velero restore describe <restore-name>
velero restore logs <restore-name>

# Esempio: due BSL in regioni diverse
velero backup-location create primary \
  --provider aws --bucket velero-eu --config region=eu-west-1

velero backup-location create secondary \
  --provider aws --bucket velero-us --config region=us-east-1

# Backup su entrambi
velero backup create dr-backup \
  --storage-location primary
velero backup create dr-backup-replica \
  --storage-location secondary

# Crea un namespace di test e ripristina lì
velero restore create test-restore \
  --from-backup daily-prod-20260419020000 \
  --namespace-mappings production:restore-test

# Verifica che tutto funzioni
kubectl get all -n restore-test
kubectl exec -n restore-test myapp-xxx -- curl localhost:8080/health

# Pulisci
kubectl delete namespace restore-test

# 1. Deploy MinIO come object storage locale
kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio
  namespace: velero
spec:
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      labels:
        app: minio
    spec:
      containers:
      - name: minio
        image: minio/minio:latest
        command: ["minio", "server", "/data"]
        env:
        - name: MINIO_ROOT_USER
          value: "minioadmin"
        - name: MINIO_ROOT_PASSWORD
          value: "minioadmin"
        ports:
        - containerPort: 9000
        volumeMounts:
        - name: data
          mountPath: /data
      volumes:
      - name: data
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: minio
  namespace: velero
spec:
  selector:
    app: minio
  ports:
  - port: 9000
EOF

# 2. Crea il bucket
kubectl exec -n velero deploy/minio -- \
  mc alias set local http://localhost:9000 minioadmin minioadmin
kubectl exec -n velero deploy/minio -- \
  mc mb local/velero-backups

# 3. Installa Velero con il plugin AWS
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.10.0 \
  --bucket velero-backups \
  --secret-file ./credentials-velero \
  --backup-location-config region=minio,s3ForcePathStyle="true",s3Url=http://minio.velero:9000 \
  --use-volume-snapshots=false

# Deploy di un'app di esempio
kubectl create namespace demo
kubectl apply -n demo -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.27
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  setting: "production"
EOF

# Backup
velero backup create demo-backup --include-namespaces demo

# Verifica
velero backup describe demo-backup

# Simula disaster
kubectl delete namespace demo

# Restore
velero restore create --from-backup demo-backup

# Verifica
kubectl get all -n demo
kubectl get configmap -n demo

# Crea uno schedule
velero schedule create demo-hourly \
  --schedule="0 * * * *" \
  --include-namespaces demo \
  --ttl 24h

# Verifica
velero schedule get

# Controlla le metriche
kubectl port-forward -n velero deploy/velero 8085:8085 &
curl -s localhost:8085/metrics | grep velero_backup