3 minute read
The Gardener project features a sub-project called etcd-backup-restore to take periodic backups of etcd backing Shoot clusters. It demands the bucket (or its equivalent in different object store providers) to be created and configured externally with appropriate credentials. The
BackupBucket resource takes this responsibility in Gardener.
Before introducing the
BackupBucket extension resource, Gardener was using Terraform in order to create and manage these provider-specific resources (e.g., see AWS Backup).
Now, Gardener commissions an external, provider-specific controller to take over this task. You can also refer to backupInfra proposal documentation to get idea about how the transition was done and understand the resource in broader scope.
What is the Scope of Bucket?
A bucket will be provisioned per
Seed. So, a backup of every
Shoot created on that
Seed will be stored under a different shoot specific prefix under the bucket.
For the backup of the
Shoot rescheduled on different
Seed, it will continue to use the same bucket.
What is the Lifespan of
The bucket associated with
BackupBucket will be created at the creation of the
Seed. And as per current implementation, it will also be deleted on deletion of the
Seed, if there isn’t any
BackupEntry resource associated with it.
In the future, we plan to introduce a schedule for
BackupBucket - the deletion logic for the
BackupBucket resource, which will reschedule it on different available
Seeds on deletion or failure of a health check for the currently associated
seed. In that case, the
BackupBucket will be deleted only if there isn’t any schedulable
Seed available and there isn’t any associated
What Needs to be Implemented to Support a New Infrastructure Provider?
As part of the seed flow, Gardener will create a special CRD in the seed cluster that needs to be reconciled by an extension controller, for example:
--- apiVersion: extensions.gardener.cloud/v1alpha1 kind: BackupBucket metadata: name: foo spec: type: azure providerConfig: <some-optional-provider-specific-backupbucket-configuration> region: eu-west-1 secretRef: name: backupprovider namespace: shoot--foo--bar
.spec.secretRef contains a reference to the provider secret pointing to the account that shall be used to create the needed resources. This provider secret will be configured by the Gardener operator in the
Seed resource and propagated over there by the seed controller.
After your controller has created the required bucket, if required, it generates the secret to access the objects in the bucket and put a reference to it in
status. This secret is supposed to be used by Gardener or eventually a
BackupEntry resource and etcd-backup-restore component to backup the etcd.
In order to support a new infrastructure provider, you need to write a controller that watches all
.spec.type=<my-provider-name>. You can take a look at the below referenced example implementation for the Azure provider.