Backup with Velero

What Velero Backs Up

Velero has two halves: Kubernetes resources are listed through the API, serialized as JSON, and stored in an object-storage bucket (BackupStorageLocation); persistent volumes are captured either as cloud snapshots (CSI/cloud plugin → Volumesnapshotlocation) or as file-level backups by the node agent (kopia) for Supported setups.

Its objects are ordinary CRs you can inspect: backupstoragelocations.velero.io, volumesnapshotlocations.velero.io, backups.velero.io, restores.velero.io. Schedules are CronJobs in disguise: velero schedule create hourly --schedule="0 * * * *" --ttl 168h creates recurring backups with retention via TTL.

Install, Back Up, Restore, Migrate

velero install --provider aws \
  --plugins velero/velero-plugin-for-aws \
  --bucket velero-backups \
  --backup-location-config region=eu-west-1 \
  --snapshot-location-config region=eu-west-1 \
  --secret-file ./credentials-velero -n velero

velero backup create daily-$(date +%F) --include-namespaces prod --wait
velero backup describe daily-$(date +%F) --details
velero restore create --from-backup daily-$(date +%F) \
  --namespace-mappings prod:prod-dr --wait

Migration to a new cluster: run Velero in the source (or target with access to the same bucket), take a backup, install Velero in the target cluster, and restore — --namespace-mappings rewrites namespaces when names differ. Includes/excludes (--include-resources, --exclude) scope noisy or cluster-scoped objects.

Pitfalls and Interview Angles

What it misses. Velero does not back up etcd itself or guarantee kube-system add-ons; volume file-backup for statefulsets requires the velero.io/backup-volumes: data pod annotation; velero.io/exclude-from-volumerestore: "true" skips PV data deliberately.

Not a DR plan alone. Resources restored into a cluster whose CNI/storage class/CRDs differ can half-apply — restore target prerequisites must exist first.

TTL and drift. Backups age out with --ttl; verify bucket lifecycle policies do not delete before your RPO window closes.

Permissions. The credentials Velero holds often can snapshot every volume in the account — scope the IAM policy.

Interview angle: explain the two data paths (API objects → bucket, PVs → snapshots/files), walk a cluster migration end-to-end, and list exactly what you must add beyond Velero for full DR.