Edit

Prerequisites for Azure Kubernetes Service backup using Azure Backup

  • Article

This article describes the prerequisites for Azure Kubernetes Service (AKS) backup.

Azure Backup now allows you to back up AKS clusters (cluster resources and persistent volumes attached to the cluster) using a backup extension, which must be installed in the cluster. Backup vault communicates with the cluster via this Backup Extension to perform backup and restore operations. Based on the least privileged security model, a Backup vault must have Trusted Access enabled to communicate with the AKS cluster.

Note

Vaulted backup and Cross Region Restore for AKS using Azure Backup are currently in preview.

Backup Extension

  • The extension enables backup and restore capabilities for the containerized workloads and persistent volumes used by the workloads running in AKS clusters.

  • Backup Extension is installed in its own namespace dataprotection-microsoft by default. It is installed with cluster wide scope that allows the extension to access all the cluster resources. During the extension installation, it also creates a User-assigned Managed Identity (Extension Identity) in the Node Pool resource group.

  • Backup Extension uses a blob container (provided in input during installation) as a default location for backup storage. To access this blob container, the Extension Identity requires Storage Blob Data Contributor role on the storage account that has the container.

  • You need to install Backup Extension on both the source cluster to be backed up and the target cluster where backup is to be restored.

  • Backup Extension can be installed in the cluster from the AKS portal blade on the Backup tab under Settings. You can also use the Azure CLI commands to manage the installation and other operations on the Backup Extension.

  • Before you install an extension in an AKS cluster, you must register the Microsoft.KubernetesConfiguration resource provider at the subscription level. Learn how to register the resource provider.

  • Extension agent and extension operator are the core platform components in AKS, which are installed when an extension of any type is installed for the first time in an AKS cluster. These provide capabilities to deploy 1P and 3P extensions. The backup extension also relies on them for installation and upgrades.

    Note

    Both of these core components are deployed with aggressive hard limits on CPU and memory, with CPU less than 0.5% of a core and memory limit ranging from 50-200 MB. So, the COGS impact of these components is very low. Because they are core platform components, there is no workaround available to remove them once installed in the cluster.

  • If Storage Account, to be provided as input for Extension installation, is under Virtual Network/Firewall, then BackupVault needs to be added as trusted access in Storage Account Network Settings. Learn how to grant access to trusted Azure service, which helps to store backups in the Vault datastore

Learn how to manage the operation to install Backup Extension using Azure CLI.

Trusted Access

Many Azure services depend on clusterAdmin kubeconfig and the publicly accessible kube-apiserver endpoint to access AKS clusters. The AKS Trusted Access feature enables you to bypass the private endpoint restriction. Without using Microsoft Entra application, this feature enables you to give explicit consent to your system-assigned identity of allowed resources to access your AKS clusters using an Azure resource RoleBinding. The feature allows you to access AKS clusters with different configurations, which aren't limited to private clusters, clusters with local accounts disabled, Microsoft Entra ID clusters, and authorized IP range clusters.

Your Azure resources access AKS clusters through the AKS regional gateway using system-assigned managed identity authentication. The managed identity must have the appropriate Kubernetes permissions assigned via an Azure resource role.

For AKS backup, the Backup vault accesses your AKS clusters via Trusted Access to configure backups and restores. The Backup vault is assigned a pre-defined role Microsoft.DataProtection/backupVaults/backup-operator in the AKS cluster, allowing it to only perform specific backup operations.

To enable Trusted Access between a Backup vault and an AKS cluster, you must register the TrustedAccessPreview feature flag on Microsoft.ContainerService at the subscription level. Learn more to register the resource provider.

Learn how to enable Trusted Access.

Note

  • You can install the Backup Extension on your AKS cluster directly from the Azure portal under the Backup section in AKS portal.
  • You can also enable Trusted Access between Backup vault and AKS cluster during the backup or restore operations in the Azure portal.

AKS Cluster

To enable backup for an AKS cluster, see the following prerequisites: .

  • AKS backup uses CSI drivers snapshot capabilities to perform backups of persistent volumes. CSI Driver support is available for AKS clusters with Kubernetes version 1.21.1 or later.

    Note

    • Currently, AKS backup only supports backup of Azure Disk-based persistent volumes (enabled by CSI driver). If you're using Azure File Share and Azure Blob type persistent volumes in your AKS clusters, you can configure backups for them via the Azure Backup solutions available for Azure File Share and Azure Blob.
    • In Tree, volumes aren't supported by AKS backup; only CSI driver based volumes can be backed up. You can migrate from tree volumes to CSI driver based Persistent Volumes.

  • Before installing Backup Extension in the AKS cluster, ensure that the CSI drivers and snapshots are enabled for your cluster. If disabled, see these steps to enable them.

  • Azure Backup for AKS supports AKS clusters using either System Identity or User Identity, for backup operations. Although clusters using Service Principle aren't supported, you can update such AKS cluster to use a Managed System Identity.

  • The Backup Extension during installation fetches Container Images stored in Microsoft Container Registry (MCR). If you enable a firewall on the AKS cluster, the extension installation process might fail due to access issues on the Registry. Learn how to allow MCR access from the firewall.

  • In case you have the cluster in a Private Virtual Network and Firewall, apply the following FQDN/application rules: *.microsoft.com, *.azure.com, *.core.windows.net, *.azmk8s.io, *.digicert.com, *.digicert.cn, *.geotrust.com, *.msocsp.com. Learn how to apply FQDN rules.

  • If you have any previous installation of Velero in the AKS cluster, you need to delete it before installing Backup Extension.

Required roles and permissions

To perform AKS backup and restore operations as a user, you need to have specific roles on the AKS cluster, Backup vault, Storage account, and Snapshot resource group.

Scope Preferred role Description
AKS Cluster Owner Allows you to install Backup Extension, enable Trusted Access and grant permissions to Backup vault over the cluster.
Backup vault resource group Backup Contributor Allows you to create Backup vault in a resource group, create backup policy, configure backup, and restore and assign missing roles required for Backup operations.
Storage account Owner Allows you to perform read and write operations on the storage account and assign required roles to other Azure resources as a part of backup operations.
Snapshot resource group Owner Allows you to perform read and write operations on the Snapshot resource group and assign required roles to other Azure resources as part of backup operations.

Note

Owner role on an Azure resource allows you to perform Azure RBAC operations of that resource. If it's not available, the resource owner must provide the required roles to the Backup vault and AKS cluster before initiating the backup or restore operations.

Also, as part of the backup and restore operations, the following roles are assigned to the AKS cluster, Backup Extension Identity, and Backup vault.

Role Assigned to Assigned on Description
Reader Backup vault AKS cluster Allows the Backup vault to perform List and Read operations on AKS cluster.
Reader Backup vault Snapshot resource group Allows the Backup vault to perform List and Read operations on snapshot resource group.
Contributor AKS cluster Snapshot resource group Allows AKS cluster to store persistent volume snapshots in the resource group.
Storage Blob Data Contributor Extension Identity Storage account Allows Backup Extension to store cluster resource backups in the blob container.
Data Operator for Managed Disk Backup vault Snapshot Resource Group Allows Backup Vault service to move incremental snapshot data to the Vault.
Disk Snapshot Contributor Backup vault Snapshot Resource Group Allows Backup Vault to access Disks snapshots and perform Vaulting operation.
Storage Blob Data Reader Backup vault Storage Account Allow Backup Vault to access Blob Container with backup data stored to move to Vault.
Contributor Backup vault Staging Resource Group Allows Backup Vault to hydrate backups as Disks stored in Vault Tier.
Storage Account Contributor Backup vault Staging Storage Account Allows Backup Vault to hydrate backups stored in Vault Tier.
Storage Blob Data Owner Backup vault Staging Storage Account Allows Backup Vault to copy cluster state in a blob container stored in Vault Tier.

Note

AKS backup allows you to assign these roles during backup and restore processes through the Azure portal with a single click.

Next steps