-
Notifications
You must be signed in to change notification settings - Fork 40
Expand file tree
/
Copy pathindex.html
More file actions
1030 lines (1006 loc) · 44.2 KB
/
index.html
File metadata and controls
1030 lines (1006 loc) · 44.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="author" content="The CloudNativePG Contributors" />
<link rel="shortcut icon" href="../img/favicon.ico" />
<title>Backup and Recovery - CloudNativePG</title>
<link rel="stylesheet" href="../css/theme.css" />
<link rel="stylesheet" href="../css/theme_extra.css" />
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.7.3/styles/github.min.css" />
<script>
// Current page data
var mkdocs_page_name = "Backup and Recovery";
var mkdocs_page_input_path = "backup_recovery.md";
var mkdocs_page_url = null;
</script>
<script src="../js/jquery-3.6.0.min.js" defer></script>
<!--[if lt IE 9]>
<script src="../js/html5shiv.min.js"></script>
<![endif]-->
<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.7.3/highlight.min.js"></script>
<script>hljs.initHighlightingOnLoad();</script>
</head>
<body class="wy-body-for-nav" role="document">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side stickynav">
<div class="wy-side-scroll">
<div class="wy-side-nav-search">
<a href=".." class="icon icon-home"> CloudNativePG
</a><div role="search">
<form id ="rtd-search-form" class="wy-form" action="../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" title="Type search term here" />
</form>
</div>
</div>
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
<ul>
<li class="toctree-l1"><a class="reference internal" href="..">CloudNativePG</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../before_you_start/">Before You Start</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../use_cases/">Use cases</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../architecture/">Architecture</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../installation_upgrade/">Installation and upgrades</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../quickstart/">Quickstart</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../bootstrap/">Bootstrap</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../security/">Security</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../instance_manager/">Postgres instance manager</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../scheduling/">Scheduling</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../resource_management/">Resource management</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../failure_modes/">Failure Modes</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../rolling_update/">Rolling Updates</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../replication/">Replication</a>
</li>
</ul>
<ul class="current">
<li class="toctree-l1 current"><a class="reference internal current" href="./">Backup and Recovery</a>
<ul class="current">
<li class="toctree-l2"><a class="reference internal" href="#cloud-provider-support">Cloud provider support</a>
<ul>
<li class="toctree-l3"><a class="reference internal" href="#s3">S3</a>
</li>
<li class="toctree-l3"><a class="reference internal" href="#other-s3-compatible-object-storages-providers">Other S3-compatible Object Storages providers</a>
</li>
<li class="toctree-l3"><a class="reference internal" href="#minio-gateway">MinIO Gateway</a>
</li>
<li class="toctree-l3"><a class="reference internal" href="#azure-blob-storage">Azure Blob Storage</a>
</li>
<li class="toctree-l3"><a class="reference internal" href="#other-azure-blob-storage-compatible-providers">Other Azure Blob Storage compatible providers</a>
</li>
<li class="toctree-l3"><a class="reference internal" href="#google-cloud-storage">Google Cloud Storage</a>
<ul>
<li class="toctree-l4"><a class="reference internal" href="#running-inside-google-kubernetes-engine">Running inside Google Kubernetes Engine</a>
</li>
<li class="toctree-l4"><a class="reference internal" href="#using-authentication">Using authentication</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="#on-demand-backups">On-demand backups</a>
</li>
<li class="toctree-l2"><a class="reference internal" href="#scheduled-backups">Scheduled backups</a>
</li>
<li class="toctree-l2"><a class="reference internal" href="#wal-archiving">WAL archiving</a>
</li>
<li class="toctree-l2"><a class="reference internal" href="#recovery">Recovery</a>
<ul>
<li class="toctree-l3"><a class="reference internal" href="#restoring-into-a-cluster-with-a-backup-section">Restoring into a cluster with a backup section</a>
</li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="#retention-policies">Retention policies</a>
</li>
<li class="toctree-l2"><a class="reference internal" href="#compression-algorithms">Compression algorithms</a>
</li>
<li class="toctree-l2"><a class="reference internal" href="#tagging-of-backup-objects">Tagging of backup objects</a>
</li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../postgresql_conf/">PostgreSQL Configuration</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../operator_conf/">Operator configuration</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../storage/">Storage</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../labels_annotations/">Labels and annotations</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../monitoring/">Monitoring</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../logging/">Logging</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../certificates/">Certificates</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../ssl_connections/">Client TLS/SSL Connections</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../applications/">Connecting from an application</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../connection_pooling/">Connection Pooling</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../replica_cluster/">Replica clusters</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../kubernetes_upgrade/">Kubernetes Upgrade</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../expose_pg_services/">Exposing Postgres Services</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../cnpg-plugin/">CloudNativePG Plugin</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../failover/">Automated failover</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../troubleshooting/">Troubleshooting</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../fencing/">Fencing</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../postgis/">PostGIS</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../e2e/">End-to-End Tests</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../container_images/">Container Image Requirements</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../operator_capability_levels/">Operator Capability Levels</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../samples/">Examples</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../commercial_support/">Commercial support</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../faq/">Frequently Asked Questions (FAQ)</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../api_reference/">API Reference</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../supported_releases/">Supported releases</a>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../release_notes/">Release notes</a>
</li>
</ul>
</div>
</div>
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
<nav class="wy-nav-top" role="navigation" aria-label="Mobile navigation menu">
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="..">CloudNativePG</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content"><div role="navigation" aria-label="breadcrumbs navigation">
<ul class="wy-breadcrumbs">
<li><a href=".." class="icon icon-home" alt="Docs"></a> »</li><li>Backup and Recovery</li>
<li class="wy-breadcrumbs-aside">
</li>
</ul>
<hr/>
</div>
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
<div class="section" itemprop="articleBody">
<h1 id="backup-and-recovery">Backup and Recovery</h1>
<p>The operator can orchestrate a continuous backup infrastructure
that is based on the <a href="https://pgbarman.org">Barman</a> tool. Instead
of using the classical architecture with a Barman server, which
backs up many PostgreSQL instances, the operator relies on the
<code>barman-cloud-wal-archive</code>, <code>barman-cloud-check-wal-archive</code>,
<code>barman-cloud-backup</code>, <code>barman-cloud-backup-list</code>, and
<code>barman-cloud-backup-delete</code> tools. As a result, base backups will
be <em>tarballs</em>. Both base backups and WAL files can be compressed
and encrypted.</p>
<p>For this, it is required to use an image with <code>barman-cli-cloud</code> included.
You can use the image <code>ghcr.io/cloudnative-pg/postgresql</code> for this scope,
as it is composed of a community PostgreSQL image and the latest
<code>barman-cli-cloud</code> package.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>Always ensure that you are running the latest version of the operands
in your system to take advantage of the improvements introduced in
Barman cloud (as well as improve the security aspects of your cluster).</p>
</div>
<p>A backup is performed from a primary or a designated primary instance in a
<code>Cluster</code> (please refer to
<a href="../replica_cluster/">replica clusters</a>
for more information about designated primary instances).</p>
<h2 id="cloud-provider-support">Cloud provider support</h2>
<p>You can archive the backup files in any service that is supported
by the Barman Cloud infrastructure. That is:</p>
<ul>
<li><a href="https://aws.amazon.com/s3/">AWS S3</a></li>
<li><a href="https://azure.microsoft.com/en-us/services/storage/blobs/">Microsoft Azure Blob Storage</a></li>
<li><a href="https://cloud.google.com/storage/">Google Cloud Storage</a></li>
</ul>
<p>You can also use any compatible implementation of the
supported services.</p>
<p>The required setup depends on the chosen storage provider and is
discussed in the following sections.</p>
<h3 id="s3">S3</h3>
<p>You will need the following information about your environment:</p>
<ul>
<li>
<p><code>ACCESS_KEY_ID</code>: the ID of the access key that will be used
to upload files into S3</p>
</li>
<li>
<p><code>ACCESS_SECRET_KEY</code>: the secret part of the access key mentioned above</p>
</li>
<li>
<p><code>ACCESS_SESSION_TOKEN</code>: the optional session token, in case it is required</p>
</li>
</ul>
<p>The access key used must have permission to upload files into
the bucket. Given that, you must create a Kubernetes secret with the
credentials, and you can do that with the following command:</p>
<pre><code class="language-sh">kubectl create secret generic aws-creds \
--from-literal=ACCESS_KEY_ID=<access key here> \
--from-literal=ACCESS_SECRET_KEY=<secret key here>
# --from-literal=ACCESS_SESSION_TOKEN=<session token here> # if required
</code></pre>
<p>The credentials will be stored inside Kubernetes and will be encrypted
if encryption at rest is configured in your installation.</p>
<p>Once that secret has been created, you can configure your cluster like in
the following example:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "<destination path here>"
s3Credentials:
accessKeyId:
name: aws-creds
key: ACCESS_KEY_ID
secretAccessKey:
name: aws-creds
key: ACCESS_SECRET_KEY
</code></pre>
<p>The destination path can be any URL pointing to a folder where
the instance can upload the WAL files, e.g.
<code>s3://BUCKET_NAME/path/to/folder</code>.</p>
<h3 id="other-s3-compatible-object-storages-providers">Other S3-compatible Object Storages providers</h3>
<p>In case you're using S3-compatible object storage, like MinIO or
Linode Object Storage, you can specify an endpoint instead of using the
default S3 one.</p>
<p>In this example, it will use the <code>bucket</code> bucket of Linode in the region
<code>us-east1</code>.</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "<destination path here>"
endpointURL: bucket.us-east1.linodeobjects.com
s3Credentials:
[...]
</code></pre>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>Suppose you configure an Object Storage provider which uses a certificate signed with a private CA,
like when using MinIO via HTTPS. In that case, you need to set the option <code>endpointCA</code>
referring to a secret containing the CA bundle so that Barman can verify the certificate correctly.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>If you want ConfigMaps and Secrets to be <strong>automatically</strong> reloaded by instances, you can
add a label with key <code>cnpg.io/reload</code> to the Secrets/ConfigMaps. Otherwise, you will have to reload
the instances using the <code>kubectl cnpg reload</code> subcommand.</p>
</div>
<h3 id="minio-gateway">MinIO Gateway</h3>
<p>Optionally, you can use MinIO Gateway as a common interface which
relays backup objects to other cloud storage solutions, like S3 or GCS.
For more information, please refer to <a href="https://docs.min.io/">MinIO official documentation</a>.</p>
<p>Specifically, the CloudNativePG cluster can directly point to a local
MinIO Gateway as an endpoint, using previously created credentials and service.</p>
<p>MinIO secrets will be used by both the PostgreSQL cluster and the MinIO instance.
Therefore you must create them in the same namespace:</p>
<pre><code class="language-sh">kubectl create secret generic minio-creds \
--from-literal=MINIO_ACCESS_KEY=<minio access key here> \
--from-literal=MINIO_SECRET_KEY=<minio secret key here>
</code></pre>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Cloud Object Storage credentials will be used only by MinIO Gateway in this case.</p>
</div>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>In order to allow PostgreSQL to reach MinIO Gateway, it is necessary to create a
<code>ClusterIP</code> service on port <code>9000</code> bound to the MinIO Gateway instance.</p>
</div>
<p>For example:</p>
<pre><code class="language-yaml">apiVersion: v1
kind: Service
metadata:
name: minio-gateway-service
spec:
type: ClusterIP
ports:
- port: 9000
targetPort: 9000
protocol: TCP
selector:
app: minio
</code></pre>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>At the time of writing this documentation, the official
<a href="https://github.com/minio/minio-operator/issues/71">MinIO Operator</a>
for Kubernetes does not support the gateway feature. As such, we will use a
<code>deployment</code> instead.</p>
</div>
<p>The MinIO deployment will use cloud storage credentials to upload objects to the
remote bucket and relay backup files to different locations.</p>
<p>Here is an example using AWS S3 as Cloud Object Storage:</p>
<pre><code class="language-yaml">apiVersion: apps/v1
kind: Deployment
[...]
spec:
containers:
- name: minio
image: minio/minio:RELEASE.2020-06-03T22-13-49Z
args:
- gateway
- s3
env:
# MinIO access key and secret key
- name: MINIO_ACCESS_KEY
valueFrom:
secretKeyRef:
name: minio-creds
key: MINIO_ACCESS_KEY
- name: MINIO_SECRET_KEY
valueFrom:
secretKeyRef:
name: minio-creds
key: MINIO_SECRET_KEY
# AWS credentials
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: aws-creds
key: ACCESS_KEY_ID
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: aws-creds
key: ACCESS_SECRET_KEY
# Uncomment the below section if session token is required
# - name: AWS_SESSION_TOKEN
# valueFrom:
# secretKeyRef:
# name: aws-creds
# key: ACCESS_SESSION_TOKEN
ports:
- containerPort: 9000
</code></pre>
<p>Proceed by configuring MinIO Gateway service as the <code>endpointURL</code> in the <code>Cluster</code>
definition, then choose a bucket name to replace <code>BUCKET_NAME</code>:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: s3://BUCKET_NAME/
endpointURL: http://minio-gateway-service:9000
s3Credentials:
accessKeyId:
name: minio-creds
key: MINIO_ACCESS_KEY
secretAccessKey:
name: minio-creds
key: MINIO_SECRET_KEY
[...]
</code></pre>
<p>Verify on <code>s3://BUCKET_NAME/</code> the presence of archived WAL files before
proceeding with a backup.</p>
<h3 id="azure-blob-storage">Azure Blob Storage</h3>
<p>In order to access your storage account, you will need one of the following combinations
of credentials:</p>
<ul>
<li><a href="https://docs.microsoft.com/en-us/azure/storage/common/storage-configure-connection-string#configure-a-connection-string-for-an-azure-storage-account"><strong>Connection String</strong></a></li>
<li><strong>Storage account name</strong> and <a href="https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage"><strong>Storage account access key</strong></a></li>
<li><strong>Storage account name</strong> and <a href="https://docs.microsoft.com/en-us/azure/storage/blobs/sas-service-create"><strong>Storage account SAS Token</strong></a>.</li>
</ul>
<p>The credentials need to be stored inside a Kubernetes Secret, adding data entries only when
needed. The following command performs that:</p>
<pre><code>kubectl create secret generic azure-creds \
--from-literal=AZURE_STORAGE_ACCOUNT=<storage account name> \
--from-literal=AZURE_STORAGE_KEY=<storage account key> \
--from-literal=AZURE_STORAGE_SAS_TOKEN=<SAS token> \
--from-literal=AZURE_STORAGE_CONNECTION_STRING=<connection string>
</code></pre>
<p>The credentials will be encrypted at rest, if this feature is enabled in the used
Kubernetes cluster.</p>
<p>Given the previous secret, the provided credentials can be injected inside the cluster
configuration:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "<destination path here>"
azureCredentials:
connectionString:
name: azure-creds
key: AZURE_CONNECTION_STRING
storageAccount:
name: azure-creds
key: AZURE_STORAGE_ACCOUNT
storageKey:
name: azure-creds
key: AZURE_STORAGE_KEY
storageSasToken:
name: azure-creds
key: AZURE_STORAGE_SAS_TOKEN
</code></pre>
<p>When using the Azure Blob Storage, the <code>destinationPath</code> fulfills the following
structure:</p>
<pre><code><http|https>://<account-name>.<service-name>.core.windows.net/<resource-path>
</code></pre>
<p>where <code><resource-path></code> is <code><container>/<blob></code>. The <strong>account name</strong>,
which is also called <strong>storage account name</strong>, is included in the used host name.</p>
<h3 id="other-azure-blob-storage-compatible-providers">Other Azure Blob Storage compatible providers</h3>
<p>If you are using a different implementation of the Azure Blob Storage APIs,
the <code>destinationPath</code> will have the following structure:</p>
<pre><code><http|https>://<local-machine-address>:<port>/<account-name>/<resource-path>
</code></pre>
<p>In that case, <code><account-name></code> is the first component of the path.</p>
<p>This is required if you are testing the Azure support via the Azure Storage
Emulator or <a href="https://github.com/Azure/Azurite">Azurite</a>.</p>
<h3 id="google-cloud-storage">Google Cloud Storage</h3>
<p>Currently, the operator supports two authentication methods for Google Cloud Storage,
one assumes the pod is running inside a Google Kubernetes Engine cluster, the other one leverages
the environment variable <code>GOOGLE_APPLICATION_CREDENTIALS</code>.</p>
<h4 id="running-inside-google-kubernetes-engine">Running inside Google Kubernetes Engine</h4>
<p>This could be one of the easiest way to create a backup, and only requires
the following configuration:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "gs://<destination path here>"
googleCredentials:
gkeEnvironment: true
</code></pre>
<p>This, will tell the operator that the cluster is running inside a Google Kubernetes
Engine meaning that no credentials are needed to upload the files</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>This method will require carefully defined permissions for cluster
and pods, which have to be defined by a cluster administrator.</p>
</div>
<h4 id="using-authentication">Using authentication</h4>
<p>Following the <a href="https://cloud.google.com/docs/authentication/getting-started">instruction from Google</a>
you will get a JSON file that contains all the required information to authenticate.</p>
<p>The content of the JSON file must be provided using a <code>Secret</code> that can be created
with the following command:</p>
<pre><code class="language-shell">kubectl create secret generic backup-creds --from-file=gcsCredentials=gcs_credentials_file.json
</code></pre>
<p>This will create the <code>Secret</code> with the name <code>backup-creds</code> to be used in the yaml file like this:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "gs://<destination path here>"
googleCredentials:
applicationCredentials:
name: backup-creds
key: gcsCredentials
</code></pre>
<p>Now the operator will use the credentials to authenticate against Google Cloud Storage.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>This way of authentication will create a JSON file inside the container with all the needed
information to access your Google Cloud Storage bucket, meaning that if someone gets access to the pod
will also have write permissions to the bucket.</p>
</div>
<h2 id="on-demand-backups">On-demand backups</h2>
<p>To request a new backup, you need to create a new Backup resource
like the following one:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Backup
metadata:
name: backup-example
spec:
cluster:
name: pg-backup
</code></pre>
<p>The operator will start to orchestrate the cluster to take the
required backup using <code>barman-cloud-backup</code>. You can check
the backup status using the plain <code>kubectl describe backup <name></code>
command:</p>
<pre><code class="language-text">Name: backup-example
Namespace: default
Labels: <none>
Annotations: API Version: postgresql.cnpg.io/v1
Kind: Backup
Metadata:
Creation Timestamp: 2020-10-26T13:57:40Z
Self Link: /apis/postgresql.cnpg.io/v1/namespaces/default/backups/backup-example
UID: ad5f855c-2ffd-454a-a157-900d5f1f6584
Spec:
Cluster:
Name: pg-backup
Status:
Phase: running
Started At: 2020-10-26T13:57:40Z
Events: <none>
</code></pre>
<p>When the backup has been completed, the phase will be <code>completed</code>
like in the following example:</p>
<pre><code class="language-text">Name: backup-example
Namespace: default
Labels: <none>
Annotations: API Version: postgresql.cnpg.io/v1
Kind: Backup
Metadata:
Creation Timestamp: 2020-10-26T13:57:40Z
Self Link: /apis/postgresql.cnpg.io/v1/namespaces/default/backups/backup-example
UID: ad5f855c-2ffd-454a-a157-900d5f1f6584
Spec:
Cluster:
Name: pg-backup
Status:
Backup Id: 20201026T135740
Destination Path: s3://backups/
Endpoint URL: http://minio:9000
Phase: completed
s3Credentials:
Access Key Id:
Key: ACCESS_KEY_ID
Name: minio
Secret Access Key:
Key: ACCESS_SECRET_KEY
Name: minio
Server Name: pg-backup
Started At: 2020-10-26T13:57:40Z
Stopped At: 2020-10-26T13:57:44Z
Events: <none>
</code></pre>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>This feature will not backup the secrets for the superuser and the
application user. The secrets are supposed to be backed up as part of
the standard backup procedures for the Kubernetes cluster.</p>
</div>
<h2 id="scheduled-backups">Scheduled backups</h2>
<p>You can also schedule your backups periodically by creating a
resource named <code>ScheduledBackup</code>. The latter is similar to a
<code>Backup</code> but with an added field, called <code>schedule</code>.</p>
<p>This field is a <em>cron schedule</em> specification, which follows the same
<a href="https://pkg.go.dev/github.com/robfig/cron#hdr-CRON_Expression_Format">format used in Kubernetes CronJobs</a>.</p>
<p>This is an example of a scheduled backup:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
name: backup-example
spec:
schedule: "0 0 0 * * *"
backupOwnerReference: self
cluster:
name: pg-backup
</code></pre>
<p>The above example will schedule a backup every day at midnight.</p>
<div class="admonition hint">
<p class="admonition-title">Hint</p>
<p>Backup frequency might impact your recovery time object (RTO) after a
disaster which requires a full or Point-In-Time recovery operation. Our
advice is that you regularly test your backups by recovering them, and then
measuring the time it takes to recover from scratch so that you can refine
your RTO predictability. Recovery time is influenced by the size of the
base backup and the amount of WAL files that need to be fetched from the archive
and replayed during recovery (remember that WAL archiving is what enables
continuous backup in PostgreSQL!).
Based on our experience, a weekly base backup is more than enough for most
cases - while it is extremely rare to schedule backups more frequently than once
a day.</p>
</div>
<p>ScheduledBackups can be suspended if needed by setting <code>.spec.suspend: true</code>,
this will stop any new backup to be scheduled as long as the option is set to false.</p>
<p>In case you want to issue a backup as soon as the ScheduledBackup resource is created
you can set <code>.spec.immediate: true</code>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><code>.spec.backupOwnerReference</code> indicates which ownerReference should be put inside
the created backup resources.</p>
<ul>
<li><em>none:</em> no owner reference for created backup objects (same behavior as before the field was introduced)</li>
<li><em>self:</em> sets the Scheduled backup object as owner of the backup</li>
<li><em>cluster:</em> set the cluster as owner of the backup</li>
</ul>
</div>
<h2 id="wal-archiving">WAL archiving</h2>
<p>WAL archiving is enabled as soon as you choose a destination path
and you configure your cloud credentials.</p>
<p>If required, you can choose to compress WAL files as soon as they
are uploaded and/or encrypt them:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
[...]
wal:
compression: gzip
encryption: AES256
</code></pre>
<p>You can configure the encryption directly in your bucket, and the operator
will use it unless you override it in the cluster configuration.</p>
<p>PostgreSQL implements a sequential archiving scheme, where the
<code>archive_command</code> will be executed sequentially for every WAL
segment to be archived.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>By default, CloudNativePG sets <code>archive_timeout</code> to <code>5min</code>, ensuring
that WAL files, even in case of low workloads, are closed and archived
at least every 5 minutes, providing a deterministic time-based value for
your Recovery Point Objective (RPO). Even though you change the value
of the <a href="https://www.postgresql.org/docs/current/runtime-config-wal.html#GUC-ARCHIVE-TIMEOUT"><code>archive_timeout</code> setting in the PostgreSQL configuration</a>,
our experience suggests that the default value set by the operator is
suitable for most use cases.</p>
</div>
<p>When the bandwidth between the PostgreSQL instance and the object
store allows archiving more than one WAL file in parallel, you
can use the parallel WAL archiving feature of the instance manager
like in the following example:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
[...]
wal:
compression: gzip
maxParallel: 8
encryption: AES256
</code></pre>
<p>In the previous example, the instance manager optimizes the WAL
archiving process by archiving in parallel at most eight ready
WALs, including the one requested by PostgreSQL.</p>
<p>When PostgreSQL will request the archiving of a WAL that has
already been archived by the instance manager as an optimization,
that archival request will be just dismissed with a positive status.</p>
<h2 id="recovery">Recovery</h2>
<p>Cluster restores are not performed "in-place" on an existing cluster.
You can use the data uploaded to the object storage to <em>bootstrap</em> a
new cluster from a previously taken backup.
The operator will orchestrate the recovery process using the
<code>barman-cloud-restore</code> tool (for the base backup) and the
<code>barman-cloud-wal-restore</code> tool (for WAL files, including parallel support, if
requested).</p>
<p>For details and instructions on the <code>recovery</code> bootstrap method, please refer
to the <a href="../bootstrap/#bootstrap-from-a-backup-recovery">"Bootstrap from a backup" section</a>.</p>
<p>Under the hood, the operator will inject an init container in the first
instance of the new cluster, and the init container will start recovering the
backup from the object storage.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>The duration of the base backup copy in the new PVC depends on
the size of the backup, as well as the speed of both the network and the
storage.</p>
</div>
<p>When the base backup recovery process is completed, the operator starts the
Postgres instance in recovery mode: in this phase, PostgreSQL is up, albeit not
able to accept connections, and the pod is healthy according to the
liveness probe. Through the <code>restore_command</code>, PostgreSQL starts fetching WAL
files from the archive (you can speed up this phase by setting the
<code>maxParallel</code> option and enable the parallel WAL restore capability).</p>
<p>This phase terminates when PostgreSQL reaches the target (either the end of the
WAL or the required target in case of Point-In-Time-Recovery). Indeed, you can
optionally specify a <code>recoveryTarget</code> to perform a point in time recovery. If
left unspecified, the recovery will continue up to the latest available WAL on
the default target timeline (<code>current</code> for PostgreSQL up to 11, <code>latest</code> for
version 12 and above).</p>
<p>Once the recovery is complete, the operator will set the required
superuser password into the instance. The new primary instance will start
as usual, and the remaining instances will join the cluster as replicas.</p>
<p>The process is transparent for the user and it is managed by the instance
manager running in the Pods.</p>
<h3 id="restoring-into-a-cluster-with-a-backup-section">Restoring into a cluster with a backup section</h3>
<p>A manifest for a cluster restore may include a <code>backup</code> section.
This means that the new cluster, after recovery, will start archiving WAL's and
taking backups if configured to do so.</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>It is not allowed to use the same <code>barmanObjectStore</code> object in the <code>backup</code>
section as in the <code>externalClusters</code> section, for the recovery. While in some
cases this <em>could</em> work, the operator will prevent recovery into a new
cluster if using the same backup object as the source cluster. This is to
guard against edge cases where the source WAL's could be overwritten.
A cluster with the same <code>barmanObjectStore</code> reused for recovery and backup
will generate a validation error: <code>spec.backup.barmanObjectStore: Invalid value: …</code></p>
</div>
<p>For example, the section below could be part of a manifest for a Cluster
bootstrapping from Cluster <code>cluster-example-backup</code>, and would create a
new folder in the storage bucket named <code>recoveredCluster</code> where the base backups
and WAL's of the recovered cluster would be stored.</p>
<pre><code class="language-yaml"> backup:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio:9000
serverName: "recoveredCluster"
s3Credentials:
accessKeyId:
name: minio
key: ACCESS_KEY_ID
secretAccessKey:
name: minio
key: ACCESS_SECRET_KEY
retentionPolicy: "30d"
externalClusters:
- name: cluster-example-backup
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio:9000
s3Credentials:
</code></pre>
<p>You should not re-use the exact same <code>barmanObjectStore</code> configuration
for different clusters. There could be cases where the existing information
in the storage buckets could be overwritten by the new cluster.</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>The operator now includes a safety check to ensure a cluster will not
overwrite a storage bucket that contained information. A cluster that would
overwrite existing storage will remain in state <code>Setting up primary</code> with
Pods in an Error state.
The pod logs will show:
<code>ERROR: WAL archive check failed for server recoveredCluster: Expected empty archive"</code></p>
</div>
<h2 id="retention-policies">Retention policies</h2>
<p>CloudNativePG can manage the automated deletion of backup files from
the backup object store, using <strong>retention policies</strong> based on the recovery
window.</p>
<p>Internally, the retention policy feature uses <code>barman-cloud-backup-delete</code>
with <code>--retention-policy “RECOVERY WINDOW OF {{ retention policy value }} {{ retention policy unit }}”</code>.</p>
<p>For example, you can define your backups with a retention policy of 30 days as
follows:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
destinationPath: "<destination path here>"
s3Credentials:
accessKeyId:
name: aws-creds
key: ACCESS_KEY_ID
secretAccessKey:
name: aws-creds
key: ACCESS_SECRET_KEY
retentionPolicy: "30d"
</code></pre>
<div class="admonition note">
<p class="admonition-title">There's more ...</p>
<p>The <strong>recovery window retention policy</strong> is focused on the concept of
<em>Point of Recoverability</em> (<code>PoR</code>), a moving point in time determined by
<code>current time - recovery window</code>. The <em>first valid backup</em> is the first
available backup before <code>PoR</code> (in reverse chronological order).
CloudNativePG must ensure that we can recover the cluster at
any point in time between <code>PoR</code> and the latest successfully archived WAL
file, starting from the first valid backup. Base backups that are older
than the first valid backup will be marked as <em>obsolete</em> and permanently
removed after the next backup is completed.</p>
</div>
<h2 id="compression-algorithms">Compression algorithms</h2>
<p>CloudNativePG by default archives backups and WAL files in an
uncompressed fashion. However, it also supports the following compression
algorithms via <code>barman-cloud-backup</code> (for backups) and
<code>barman-cloud-wal-archive</code> (for WAL files):</p>
<ul>
<li>bzip2</li>
<li>gzip</li>
<li>snappy</li>
</ul>
<p>The compression settings for backups and WALs are independent. See the
<a href="../api_reference/#DataBackupConfiguration">DataBackupConfiguration</a> and
<a href="../api_reference/#WalBackupConfiguration">WALBackupConfiguration</a> sections in
the API reference.</p>
<p>It is important to note that archival time, restore time, and size change
between the algorithms, so the compression algorithm should be chosen according
to your use case.</p>
<p>The Barman team has performed an evaluation of the performance of the supported
algorithms for Barman Cloud. The following table summarizes a scenario where a
backup is taken on a local MinIO deployment. The Barman GitHub project includes
a <a href="https://github.com/EnterpriseDB/barman/issues/344#issuecomment-992547396">deeper analysis</a>.</p>
<table>
<thead>
<tr>
<th>Compression</th>
<th>Backup Time (ms)</th>
<th>Restore Time (ms)</th>
<th>Uncompressed size (MB)</th>
<th>Compressed size (MB)</th>
<th>Approx ratio</th>
</tr>
</thead>
<tbody>
<tr>
<td>None</td>
<td>10927</td>
<td>7553</td>
<td>395</td>
<td>395</td>
<td>1:1</td>
</tr>
<tr>
<td>bzip2</td>
<td>25404</td>
<td>13886</td>
<td>395</td>
<td>67</td>
<td>5.9:1</td>
</tr>
<tr>
<td>gzip</td>
<td>116281</td>
<td>3077</td>
<td>395</td>
<td>91</td>
<td>4.3:1</td>
</tr>
<tr>
<td>snappy</td>
<td>8134</td>
<td>8341</td>
<td>395</td>
<td>166</td>
<td>2.4:1</td>
</tr>
</tbody>
</table>
<h2 id="tagging-of-backup-objects">Tagging of backup objects</h2>
<p>Barman 2.18 introduces support for tagging backup resources when saving them in
object stores via <code>barman-cloud-backup</code> and <code>barman-cloud-wal-archive</code>. As a
result, if your PostgreSQL container image includes Barman with version 2.18 or
higher, CloudNativePG enables you to specify tags as key-value pairs
for backup objects, namely base backups, WAL files and history files.</p>
<p>You can use two properties in the <code>.spec.backup.barmanObjectStore</code> definition:</p>
<ul>
<li><code>tags</code>: key-value pair tags to be added to backup objects and archived WAL
file in the backup object store</li>
<li><code>historyTags</code>: key-value pair tags to be added to archived history files in
the backup object store</li>
</ul>
<p>The excerpt of a YAML manifest below provides an example of usage of this
feature:</p>
<pre><code class="language-yaml">apiVersion: postgresql.cnpg.io/v1
kind: Cluster
[...]
spec:
backup:
barmanObjectStore:
[...]
tags:
backupRetentionPolicy: "expire"
historyTags:
backupRetentionPolicy: "keep"
</code></pre>
</div>
</div><footer>
<div class="rst-footer-buttons" role="navigation" aria-label="Footer Navigation">
<a href="../replication/" class="btn btn-neutral float-left" title="Replication"><span class="icon icon-circle-arrow-left"></span> Previous</a>
<a href="../postgresql_conf/" class="btn btn-neutral float-right" title="PostgreSQL Configuration">Next <span class="icon icon-circle-arrow-right"></span></a>
</div>
<hr/>
<div role="contentinfo">
<!-- Copyright etc -->
</div>
Built with <a href="https://www.mkdocs.org/">MkDocs</a> using a <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>