Kubernetes Backup Done Right, with Plakar — Transcript

Full transcript

1. 0:00You are running Kubernetes in production
2. 0:02and your team is shipping very fast.
3. 0:04Then someone runs a wrong command or a
4. 0:07node goes down or a bad deployment just
5. 0:09corrupts your state. What happens next?
6. 0:12If you don't have a proper backup
7. 0:13strategy, well, you are in trouble. And
8. 0:16if you think you have one, you want want
9. 0:18to check whether it actually works or
10. 0:20not. In this video, I'm going to show
11. 0:22you how to back up a Kubernetes cluster
12. 0:24by using Pluker, which is an open-source
13. 0:27backup tool that covers everything
14. 0:28including your state, your manifests,
15. 0:31and even your persistent volume data. We
16. 0:34will deploy a WordPress MySQL stack,
17. 0:36create real content in this WordPress
18. 0:38website, then we will take a full backup
19. 0:41including the persistent volume data. Of
20. 0:43course, we will delete everything and do
21. 0:46a complete restore. If you're into
22. 0:47DevOps, cloud-native tooling, and you're
23. 0:50not losing your data, please hit
24. 0:51subscribe. And hey, welcome to Usain
25. 0:53Codes. Let's compile.
26. 1:00Most people's Kubernetes backup strategy
27. 1:02is, well, nothing. Or maybe etcd
28. 1:05snapshots once a day or they rely on
29. 1:07Velero, which is great but can be
30. 1:09complex to set up and doesn't give you
31. 1:11much visibility into what you have
32. 1:13backed up. The real challenge is that a
33. 1:15Kubernetes cluster has three layers of
34. 1:17data you need to protect. The first one
35. 1:19is etcd. This is the brain of your
36. 1:21cluster. Every resource definition,
37. 1:23every secret, every config map lives
38. 1:24here. If etcd dies and you have no
39. 1:27backup, your cluster is gone. The second
40. 1:29one is the manifest. The YAML
41. 1:31definitions of your deployments,
42. 1:32services, ingresses, config maps,
43. 1:35everything. You want these versioned and
44. 1:37restorable individually, not just as a
45. 1:39giant etcd blob. The third one is
46. 1:42persistent volumes. Stateful apps like
47. 1:44databases, message queues, anything
48. 1:46writing to disk. These are often the
49. 1:48most critical and the most forgotten
50. 1:50ones. Most tools handle one or two of
51. 1:52these. Pluker handles all three with a
52. 1:55single consistent interface. Pluker is
53. 1:57an open-source backup platform. Think of
54. 1:59it as the Docker container model, but
55. 2:01for your data. Instead of raw files,
56. 2:03Pluker stores everything in something
57. 2:05called a closet, a self-contained,
58. 2:08immutable, encrypted data unit. Like a
59. 2:10container that packages your data with
60. 2:12all its context and metadata. A few
61. 2:14things that make Pluker stand out: the
62. 2:16client-side encryption. Your data is
63. 2:18encrypted before it leaves your machine.
64. 2:21The storage backend, whether it's S3,
65. 2:23local disk, or SFTP, never sees your
66. 2:26plain text. The second one,
67. 2:27deduplication before encryption. Most
68. 2:29tools can't deduplicate encrypted data.
69. 2:31Pluker's closet engine does dedupe
70. 2:33first, which means you get massive
71. 2:35storage savings without sacrificing
72. 2:37privacy. Third one, browsable snapshots.
73. 2:40You don't have to restore a backup to
74. 2:42see what's in it. You can mount it,
75. 2:43browse it, and even diff two snapshots
76. 2:46directly from the CLI or UI. And as of
77. 2:49early 2026,
78. 2:50Pluker joined the Linux Foundation and
79. 2:52the CNCF. So, this is not a side
80. 2:54project. It's production-grade,
81. 2:56community-backed infrastructure. Oh, and
82. 2:58it's free and open-source. Let's install
83. 3:01it. For this demo, I am running a GKE
84. 3:03cluster on Google Cloud with a WordPress
85. 3:05and MySQL stack, two deployments, two
86. 3:07services, a config map, a secret, and
87. 3:10two persistent volume claims backed by
88. 3:12the PD CSI driver. They are all in a
89. 3:15demo namespace. This is a realistic
90. 3:17stateful workload where the data inside
91. 3:19the volumes actually matters. I have
92. 3:21already set up the GKE cluster with the
93. 3:23CSI snapshot support. The fully set up
94. 3:26steps are in the GitHub repo linked in
95. 3:27the description. So, let me deploy the
96. 3:29app.
97. 3:34Our namespace is created, and we have
98. 3:36plenty of resources inside demo folder.
99. 3:39Let's apply the remainings.
100. 3:47Let's wait for MySQL and WordPress pods
101. 3:50to be ready.
102. 3:52We have MySQL database, WordPress pod.
103. 3:55Uh we have service, of course, to access
104. 3:57WordPress website. Our pods are managed
105. 3:59by deployments. It contains replica
106. 4:01sets, config map for WordPress
107. 4:03configuration, and we have MySQL
108. 4:05database access credentials inside this
109. 4:07secret. Of course, we have persistent
110. 4:09volume claim for MySQL and WordPress.
111. 4:11Now, let's set up WordPress through the
112. 4:13browser. We already have load balancer
113. 4:16access.
114. 4:20Okay, select language, provide a website
115. 4:22title.
116. 4:32Install WordPress. It's installed.
117. 4:39Okay, let's create a sample post so we
118. 4:42can verify after restoration.
119. 5:04Okay, our content is here. This part is
120. 5:06important. We now have an actual user
121. 5:09data inside the persistent volumes. The
122. 5:11MySQL PVC has our WordPress database
123. 5:13with this custom page, and the WordPress
124. 5:15PVC has the PHP files and uploads. If we
125. 5:18lose these volumes, we'll lose
126. 5:20everything. Our WordPress website is
127. 5:22ready. Now, let's install Pluker. I'm
128. 5:24installing the Kubernetes branch, which
129. 5:26has built-in Kubernetes support.
130. 5:31Okay, it's installed. Now, install the
131. 5:34S3 integration package. Remember, we
132. 5:36will back up our data into S3 buckets.
133. 5:39In order to use S3 package, we need to
134. 5:41log in via GitHub first.
135. 5:46So, in order to finalize the login, just
136. 5:48open this in browser and provide your
137. 5:51credentials.
138. 5:57Okay.
139. 5:58I'm now logged in. Go back to terminal.
140. 6:01Now, we can add S3 package.
141. 6:04Okay, it's already installed because I
142. 6:06did it before. Next step is configuring
143. 6:09Plakar to store backups in an S3 bucket.
144. 6:11Plakar uses a store concept and named
145. 6:14reference to a remote backend. In order
146. 6:16to create a store in our case, we need
147. 6:18to provide our AWS credentials because
148. 6:21it will be stored in bucket. I already
149. 6:22defined it in my environment variables.
150. 6:25So, here is the command.
151. 6:28We add a new store which is called
152. 6:30backup and the location is your bucket's
153. 6:33full location. I will be using Plakar
154. 6:35demo VP backup buckets and my credential
155. 6:38is AWS access key ID and secret access
156. 6:40key. Let's add this store.
157. 6:43Okay, it's added. Now, we initialize an
158. 6:45encrypted closet on that S3 store. We
159. 6:47will set the pass phrase as an
160. 6:49environment variable so we don't have to
161. 6:51type it every time.
162. 6:56Plakar will use this pass phrase to
163. 6:58encrypt your backups and notice the
164. 7:00bucket itself is just dumb storage.
165. 7:03Plakar encrypts everything client-side
166. 7:04before it ever reach S3. AWS can't read
167. 7:07your data. Your IAM admin can't read
168. 7:10your data. Nobody can except you. One
169. 7:12last thing. Plakar's Kubernetes
170. 7:14integration connects via the Kubernetes
171. 7:16API server. So, we need to keep CTL
172. 7:18proxy running.
173. 7:22Let me show you what's in our cluster
174. 7:24right now.
175. 7:28We have a WordPress deployment, a MySQL
176. 7:30deployment, two services, a config map,
177. 7:33a secret, and two PVCs. One for MySQL
178. 7:35data, one for WordPress files. And
179. 7:37remember, we created a custom WordPress
180. 7:40page. That data is living inside the
181. 7:42MySQL PVC right now. Now, let's take a
182. 7:44full backup. First, we backup all the
183. 7:47manifests, deployments, services,
184. 7:49secrets, config maps, everything.
185. 7:58Okay, that captures the entire cluster
186. 8:00state as YAML manifests, but manifests
187. 8:03alone don't include the data inside your
188. 8:05volumes. For that, we will use Pluker's
189. 8:07CSI integration. It creates a snapshot
190. 8:10of each PVC, mounts it in a temporary
191. 8:12pod, ingests the file system data, and
192. 8:15cleans up the snapshot. Let's back up
193. 8:17both PVCs. Here, we provide a snapshot
194. 8:19class, PD snap class. This is used for
195. 8:22GKE clusters. So, by using this class,
196. 8:25it will take a snapshot of your PVC
197. 8:27content. And here, demo namespace and
198. 8:29MySQL PVC. Let's back up it into S3.
199. 8:38Now, we will do the same for WordPress
200. 8:40backup. This time, it will be demo
201. 8:42namespace and WordPress PVC.
202. 8:46Okay, WordPress backup is also
203. 8:48completed. That's the difference between
204. 8:49backing up a definitions and backing up
205. 8:52data. With Kubernetes protocol, you get
206. 8:54the manifests. With Kubernetes plus CSI
207. 8:57protocol, you get the actual volume
208. 8:59contents. Together, you have a complete
209. 9:01backup. Let's verify what was backed up.
210. 9:06We can see our snapshot with its IDs.
211. 9:08The smallest one is for manifest, of
212. 9:11course. This is for MySQL, and this is
213. 9:13for WordPress backup content. Now, let's
214. 9:16browse what's inside. This is one of
215. 9:19Pluker's killer features. You can
216. 9:20inspect any snapshot without restoring
217. 9:22it.
218. 9:25So, you provide ID.
219. 9:28Inside demo namespace, what are the
220. 9:30backup content? As you can see, apps,
221. 9:32discovery, they are API groups under
222. 9:34demo namespace. Let's check this one.
223. 9:38You can see every resource organized
224. 9:40cleanly. Config maps, secrets, services,
225. 9:42PVCs under the core API group, as you
226. 9:45can see here. Let's check apps group.
227. 9:48Deployments and replica sets are under
228. 9:51the apps group, and each one stored as a
229. 9:53YAML file, and you can inspect
230. 9:55individually. And in the separate PVC
231. 9:57snapshots, we have the actual file
232. 9:59system contents of each volume. And all
233. 10:01of this is sitting in S3, fully
234. 10:03encrypted with AES 256
235. 10:06GCM. AWS sees encrypted blobs, only you
236. 10:09hold the key. Now, let's come to the fun
237. 10:12part. Let's break the things. Let's
238. 10:13delete demo namespace.
239. 10:16As you can see, everything is gone.
240. 10:19So, no demo namespace at all. And just
241. 10:22like that, our WordPress site, our MySQL
242. 10:24database, our custom page, our services,
243. 10:27our config, our secrets, our PVCs with
244. 10:29all the data inside, everything in the
245. 10:32demo namespace gone. This is the
246. 10:33scenario every ops team dreads. The PVCs
247. 10:36are gone, and with them, all the MySQL
248. 10:38data, including that custom WordPress
249. 10:41page we created. But, our backup is safe
250. 10:43in S3. Let's bring it all back,
251. 10:45including the data. First, let's confirm
252. 10:48our backup is still safe in S3.
253. 10:51Here's our snapshot. Now, here is the
254. 10:53key insight. Pluker lets you restore
255. 10:55individual resources from the snapshot
256. 10:57tree. We don't have to do a full blast
257. 10:59restore. We go step-by-step in the right
258. 11:02order. First, restore the namespace.
259. 11:04Without the namespace, nothing else can
260. 11:06be created.
261. 11:11The manifests are located inside this
262. 11:13snapshot, so I will use that ID, and
263. 11:18the namespace is restored. Let's verify
264. 11:20it. As you can see, it is being created.
265. 11:23So, namespace is back. Now, let's
266. 11:26restore our resources one by one. We
267. 11:28will use same command, but the path will
268. 11:30be different for each resource. The
269. 11:32first one is config map.
270. 11:35Okay, the second one is secret.
271. 11:39Services.
272. 11:41Service for MySQL, then service for
273. 11:44WordPress.
274. 11:47Notice we are skipping kube-root-ca
275. 11:49certificate config map because that's an
276. 11:52auto-managed config map that Kubernetes
277. 11:54recreates on its own. We only restore
278. 11:56what we actually own. As a third step,
279. 11:57we will restore the PVCs with their
280. 12:00data. First, we create a fresh empty
281. 12:02PVCs. As you can see, we already have
282. 12:05PVC manifest inside demo here. We will
283. 12:07create a fresh PVC from them.
284. 12:11Remember, they are completely new PVCs.
285. 12:14We don't have any data inside this. I
286. 12:16mean, the custom web page. So, we can
287. 12:18import the data from our backup into
288. 12:20this one.
289. 12:22Let's list the snapshot IDs again. So,
290. 12:25this will be WordPress. This will be
291. 12:27MySQL.
292. 12:30You see, we are using CSI in the
293. 12:31protocol in order to copy the content
294. 12:34from snapshot.
295. 12:35In demo namespace for MySQL.
296. 12:39And we need to provide our snapshot ID,
297. 12:41which is this one.
298. 12:42So, we are trying to restore data into
299. 12:45the Kubernetes by using CSI driver and
300. 12:48the destination is demo namespace and
301. 12:51MySQL PVC, which exists before here.
302. 12:54Now, let's do the same for WordPress.
303. 12:57WordPress snapshot ID is this one.
304. 12:59And the PVC name is WordPress.
305. 13:03Okay, both PVC restore is completed.
306. 13:05Pluker creates a temporary pod, mounts
307. 13:07the PVC, and writes the backed up file
308. 13:10system data back into it. The MySQL
309. 13:12database and WordPress files are fully
310. 13:14restored right now, not just empty
311. 13:16volumes, but the actual data. Since we
312. 13:18have the PVC content, let's restore the
313. 13:21final stuff, which is the deployment.
314. 13:25Okay, first one is MySQL. This is just a
315. 13:28manifest and second one is WordPress.
316. 13:32Now, let's wait for both pods to be
317. 13:34ready.
318. 13:35MySQL is already up and running and
319. 13:38WordPress is also up and running. Let's
320. 13:40list all the resources inside demo
321. 13:43namespace.
322. 13:44Okay, MySQL's running, PostgreSQL
323. 13:46running, services running, deployments
324. 13:49and secrets persistent volumes.
325. 13:51Deployments are back, services are back,
326. 13:53config map secrets PVs is all the
327. 13:55resource and healthy. But, here is the
328. 13:57real test. Let's check if our custom
329. 14:00WordPress page survived.
330. 14:04So, here it is. Our custom WordPress
331. 14:06page Hello Placker is back. The MySQL
332. 14:09data inside the PVC was fully restored.
333. 14:11This is the power of Kubernetes and CSI
334. 14:14driver protocol and it doesn't just
335. 14:17restore definitions. It restores the
336. 14:19data. That granularity is something you
337. 14:21just don't get with at CD only backups
338. 14:24or Velero. You can browse any snapshot,
339. 14:26pick exactly which resources to restore
340. 14:28and skip the ones Kubernetes manage on
341. 14:30its own. And with Kubernetes and CSI
342. 14:32protocol, your stateful volume data is
343. 14:35protected, too. We are back. Full
344. 14:36recovery, zero drama and data included.
345. 14:39So, check out Placker.io for the full
346. 14:41documentation and Kubernetes guide and
347. 14:43the link is in the description. If this
348. 14:45was helpful, please smash that like
349. 14:47button. It actually helps a ton.
350. 14:49Subscribe if you want more content on
351. 14:51cloud infrastructure and data
352. 14:53protection. If you have any question,
353. 14:54please put them in the comments. I read
354. 14:57all of them one by one. One more thing,
355. 14:59we did all of this manually today to
356. 15:01understand the context how it works.
357. 15:03But, the proper backup strategy should
358. 15:05be automated and version control. If you
359. 15:08want a follow-up video on how to do this
360. 15:10by using infrastructure as code, maybe
361. 15:12by way of Helm, maybe a Kubernetes
362. 15:14operator, drop a comment below and let
363. 15:17me know. If there is enough interest, it
364. 15:19will be the next video and see you in
365. 15:20the next one.