Velero Backup Configuration

Overview

This template configures Velero for automated Kubernetes backup and disaster recovery. Velero backs up your entire cluster state — namespaces, deployments, services, configmaps, secrets, and persistent volumes — to object storage (S3, GCS, Azure Blob). It enables both scheduled backups and on-demand snapshots, critical for recovering from ransomware attacks, accidental deletions, or cluster failures.

Security threat addressed: Without backups, a ransomware attack or accidental kubectl delete namespace production is catastrophic. With Velero, you can restore your entire cluster state to a known-good point in time within minutes.

When to use: Deploy Velero in every production cluster. Configure both daily and weekly backup schedules with different retention policies.

Threat Model

• Ransomware recovery: If an attacker encrypts or destroys cluster resources, restore from the latest backup.
• Accidental deletion recovery: Restore accidentally deleted namespaces, deployments, or persistent volumes.
• Disaster recovery: Recreate the entire cluster in a different region from backup.

MITRE ATT&CK:

• T1485 — Data Destruction: Velero enables recovery from intentional data destruction attacks.
• T1490 — Inhibit System Recovery: Offsite backups in separate accounts protect against backup deletion.

YAML Source

# Velero Schedule — Daily backup
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: daily-backup
  namespace: velero
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM UTC
  template:
    ttl: 168h  # 7-day retention
    includedNamespaces:
    - production
    - staging
    # ACTION REQUIRED: Add all namespaces to back up
    storageLocation: default
    volumeSnapshotLocations:
    - default
    snapshotVolumes: true

---
# Velero Schedule — Weekly full backup
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: weekly-full-backup
  namespace: velero
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  schedule: "0 3 * * 0"  # Weekly on Sunday at 3 AM UTC
  template:
    ttl: 720h  # 30-day retention
    includedNamespaces:
    - "*"  # Back up everything
    storageLocation: default
    volumeSnapshotLocations:
    - default
    snapshotVolumes: true

---
# BackupStorageLocation — S3 bucket
apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: default
  namespace: velero
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  provider: aws
  objectStorage:
    bucket: my-velero-backups  # ACTION REQUIRED: Your S3 bucket name
    prefix: cluster-backups
  config:
    region: us-east-1  # ACTION REQUIRED: Your AWS region
    s3ForcePathStyle: "false"

---
# VolumeSnapshotLocation — EBS snapshots
apiVersion: velero.io/v1
kind: VolumeSnapshotLocation
metadata:
  name: default
  namespace: velero
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  provider: aws
  config:
    region: us-east-1  # ACTION REQUIRED: Your AWS region

Deployment

1. Install Velero CLI and server: velero install --provider aws --bucket my-velero-backups --secret-file ./credentials-velero
2. Apply backup schedules: kubectl apply -f 24_velero_backup.yaml
3. Verify schedules: velero schedule get
4. Trigger a manual backup: velero backup create manual-test-backup --include-namespaces production

Verification

# Check backup schedules
velero schedule get

# List completed backups
velero backup get

# Verify latest backup is complete
velero backup describe daily-backup-$(date +%Y%m%d) --details

# Test restore to a separate namespace (non-destructive)
velero restore create test-restore --from-backup daily-backup-latest --namespace-mappings production:production-test

Further Reading

• Kubernetes Secrets Management Best Practices — Protect backed-up secrets
• Template 18: External Secrets — External secret storage complements backup