Skip to content

Commit 61b895f

Browse files
anshulahuja98Miraj50FAREAST\rishrajAnshul Ahuja
authored
Enable Backup Command for AKS in dataprotection CLI (#9701)
* stubs * draft changes * Update README.md test * Create backup extension * Prototype for one command data protection * Initial cut with baseline testing Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * [AKS] Update backup configuration parameters and improve argument handling Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * cleanup test file Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * cleanup stray change Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * Update Vendored AKS SDK Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * [AKS Preview] Revert backup changes - moved to separate branch aksbackup-aks-preview * linting Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * final changes Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * refactor vault decision Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * GRS changes Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * Bugbash and UTs Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * fix changelog Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * lint Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * Fix lint errors Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * linter 10/10 Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * lint Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * PR Feedback Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * Add license Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> * Fix docs Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> --------- Signed-off-by: Anshul Ahuja <anshulahuja@microsoft.com> Co-authored-by: Rishabh Raj <rishabhstpaul@gmail.com> Co-authored-by: FAREAST\rishraj <rishraj@microsoft.com> Co-authored-by: Anshul Ahuja <anshulahuja@microsoft.com>
1 parent 574c58e commit 61b895f

97 files changed

Lines changed: 48098 additions & 4 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/dataprotection/HISTORY.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
33
Release History
44
===============
5+
1.9.0
6+
+++++
7+
* `az dataprotection enable-backup trigger`: New command to enable backup for AKS clusters with a single command. Supports preset backup strategies (Week, Month, DisasterRecovery) and Custom strategy with user-provided configuration.
8+
* Added vendored SDKs: `azure-mgmt-containerservice` (40.2.0), `azure-mgmt-kubernetesconfiguration` (3.1.0), `azure-mgmt-resourcegraph` (8.0.0).
9+
510
1.8.1
611
+++++
712
* Documentation update for `initialize-backupconfig` and `initialize-restoreconfig` commands to clarify that the generated JSON is meant for use with other CLI commands, and may not work as an input for non-CLI scenarios without modification.

‎src/dataprotection/azext_dataprotection/manual/_consts.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# --------------------------------------------------------------------------------------------
2+
# Copyright (c) Microsoft Corporation. All rights reserved.
3+
# Licensed under the MIT License. See License.txt in the project root for license information.
4+
# --------------------------------------------------------------------------------------------
5+
6+
# AKS Backup Strategy Constants
7+
CONST_BACKUP_STRATEGY_WEEK = "Week"
8+
CONST_BACKUP_STRATEGY_MONTH = "Month"
9+
CONST_BACKUP_STRATEGY_DISASTER_RECOVERY = "DisasterRecovery"
10+
CONST_BACKUP_STRATEGY_CUSTOM = "Custom"
11+
12+
# List of all backup strategies for AKS
13+
CONST_AKS_BACKUP_STRATEGIES = [
14+
CONST_BACKUP_STRATEGY_WEEK,
15+
CONST_BACKUP_STRATEGY_MONTH,
16+
CONST_BACKUP_STRATEGY_DISASTER_RECOVERY,
17+
CONST_BACKUP_STRATEGY_CUSTOM,
18+
]

‎src/dataprotection/azext_dataprotection/manual/_help.py‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,3 +291,67 @@
291291
- name: List of Recovery Points in a Vault
292292
text: az dataprotection recovery-point list --backup-instance-name "sample_biname-00000000-0000-0000-0000-000000000000" --resource-group "sample_rg" --vault-name "sample_vault"
293293
"""
294+
295+
helps['dataprotection enable-backup'] = """
296+
type: group
297+
short-summary: Enable backup for Azure resources.
298+
"""
299+
300+
helps['dataprotection enable-backup trigger'] = """
301+
type: command
302+
short-summary: Enable backup for an AKS cluster by setting up all required resources including backup vault, policy, storage account, extension, and trusted access.
303+
long-summary: |
304+
This command orchestrates all the steps required to enable backup for an AKS cluster:
305+
1. Creates or reuses a backup resource group, storage account, and blob container
306+
2. Installs the backup extension on the cluster (or reuses an existing one)
307+
3. Creates or reuses a backup vault and backup policy
308+
4. Configures trusted access and role assignments
309+
5. Creates a backup instance
310+
311+
The --backup-configuration-file parameter accepts a JSON file (@file.json) or inline JSON string with the following optional settings:
312+
- storageAccountResourceId: ARM ID of an existing storage account to use
313+
- blobContainerName: Name of an existing blob container (used with storageAccountResourceId)
314+
- backupResourceGroupId: ARM ID of an existing resource group for backup resources
315+
- backupVaultId: ARM ID of an existing backup vault (required for Custom strategy)
316+
- backupPolicyId: ARM ID of an existing backup policy (required for Custom strategy)
317+
- tags: Dictionary of tags to apply to created resources (e.g., {"Owner": "team", "Env": "prod"})
318+
319+
Backup strategy presets (--backup-strategy):
320+
- Week (default): Daily incremental backups with 7-day retention in Operational Store.
321+
- Month: Daily incremental backups with 30-day retention in Operational Store.
322+
- DisasterRecovery: Daily incremental backups with 7-day Operational Store + 90-day Vault Store retention. FirstOfDay backups are copied to Vault Store for cross-region restore.
323+
- Custom: Bring your own vault and policy. Requires backupVaultId and backupPolicyId in --backup-configuration-file.
324+
examples:
325+
- name: Enable backup for an AKS cluster with default Week strategy
326+
text: az dataprotection enable-backup trigger --datasource-type AzureKubernetesService --datasource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster}
327+
- name: Enable backup with Month strategy
328+
text: az dataprotection enable-backup trigger --datasource-type AzureKubernetesService --datasource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster} --backup-strategy Month
329+
- name: Enable backup with Custom strategy using existing vault and policy
330+
text: |
331+
az dataprotection enable-backup trigger --datasource-type AzureKubernetesService \\
332+
--datasource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster} \\
333+
--backup-strategy Custom \\
334+
--backup-configuration-file @config.json
335+
336+
Where config.json contains:
337+
{
338+
"backupVaultId": "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.DataProtection/backupVaults/{vault}",
339+
"backupPolicyId": "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.DataProtection/backupVaults/{vault}/backupPolicies/{policy}"
340+
}
341+
- name: Enable backup with resource tags for policy compliance
342+
text: |
343+
az dataprotection enable-backup trigger --datasource-type AzureKubernetesService \\
344+
--datasource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster} \\
345+
--backup-configuration-file '{"tags": {"Owner": "team", "Environment": "prod", "DeleteBy": "2026-12"}}'
346+
- name: Enable backup using an existing storage account
347+
text: |
348+
az dataprotection enable-backup trigger --datasource-type AzureKubernetesService \\
349+
--datasource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster} \\
350+
--backup-configuration-file @config.json
351+
352+
Where config.json contains:
353+
{
354+
"storageAccountResourceId": "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{sa}",
355+
"blobContainerName": "my-backup-container"
356+
}
357+
"""

‎src/dataprotection/azext_dataprotection/manual/_params.py‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
get_permission_scope_values,
4343
get_resource_type_values,
4444
get_persistent_volume_restore_mode_values,
45-
get_conflict_policy_values
45+
get_conflict_policy_values,
46+
get_all_backup_strategies,
4647
)
4748

4849
vault_name_type = CLIArgumentType(help='Name of the backup vault.', options_list=['--vault-name', '-v'], type=str)
@@ -182,6 +183,27 @@ def load_arguments(self, _):
182183
c.argument('restore_request_object', type=validate_file_or_dict, help='Request body for operation "Restore" Expected value: '
183184
'json-string/@json-file. Required when --operation is Restore')
184185

186+
# Enable Backup command
187+
with self.argument_context('dataprotection enable-backup trigger') as c:
188+
c.argument('datasource_type', type=str, help="The type of datasource to be backed up. Supported values: AzureKubernetesService.")
189+
c.argument('datasource_id', type=str, help="The full ARM resource ID of the datasource to be backed up.")
190+
c.argument('backup_strategy', arg_type=get_enum_type(get_all_backup_strategies()),
191+
help="Backup strategy preset (daily incremental backups). "
192+
"For AzureKubernetesService: "
193+
"Week (7-day operational store retention), "
194+
"Month (30-day operational store retention), "
195+
"DisasterRecovery (7-day operational + 90-day vault store retention), "
196+
"Custom (bring your own vault/policy). Default: Week.")
197+
c.argument('backup_configuration_file', type=validate_file_or_dict,
198+
options_list=['--backup-configuration-file', '-f'],
199+
help="Path to a JSON backup configuration file. "
200+
"Supports backupVaultId and backupPolicyId "
201+
"(required for Custom strategy). "
202+
"For workload-specific settings, "
203+
"refer to the documentation.")
204+
c.argument('yes', options_list=['--yes', '-y'], action='store_true',
205+
help='Do not prompt for confirmation.')
206+
185207
with self.argument_context('dataprotection job show') as c:
186208
c.argument('resource_group_name', resource_group_name_type)
187209
c.argument('vault_name', vault_name_type, id_part='name')

‎src/dataprotection/azext_dataprotection/manual/aks/__init__.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# --------------------------------------------------------------------------------------------
2+
# Copyright (c) Microsoft Corporation. All rights reserved.
3+
# Licensed under the MIT License. See License.txt in the project root for license information.
4+
# --------------------------------------------------------------------------------------------

0 commit comments

Comments
 (0)