Enable Velero vSphere Operator Supervisor Service in Air-Gapped
search cancel

Enable Velero vSphere Operator Supervisor Service in Air-Gapped

book

Article ID: 453277

calendar_today

Updated On:

Products

VMware vSphere Kubernetes Service

Issue/Introduction

This article provides a sample procedure to enable the Velero vSphere Operator Supervisor Service in an air-gapped environment using a private Harbor registry based on official document.

Environment

vSphere Kubernetes Service

Resolution

Step 1: Add the Harbor CA Certificate to the Supervisor

Add the CA certificate of your private Harbor registry to the Supervisor using the vSphere Client:

  1. Navigate to Workload Management > Target Supervisor > Configure > Container Registries.
  2. Click ADD REGISTRY and import the certificate.

 

Step 2: Download and Push Required Images

Use an external jump host with access to both the Broadcom container registry and your private Harbor registry to pull and push the required container images.

  1. Check compatible image versions in the Velero Plugin Compatibility Matrix and Broadcom Container Packages.
  2. Pull the images to your jump host:
# Example: Download the Velero images, change the version tag for your environment
docker pull vsphere-docker.packages.broadcom.com/vsphere/iaas/packages/velero/velero:v1.13.2_vmware.3
docker pull vsphere-docker.packages.broadcom.com/velero/velero-plugin-for-vsphere:v1.6.0
docker pull vsphere-docker.packages.broadcom.com/velero/velero-plugin-for-aws:v1.6.1
docker pull vsphere-docker.packages.broadcom.com/velero/backup-driver:v1.6.0

# Tag the downloaded images and push them to the private Harbor registry.
docker tag <SOURCE_IMAGE> <HARBOR_FQDN>/<HARBOR_PROJECT>/<IMAGE>:<TAG>
docker push <HARBOR_FQDN>/<HARBOR_PROJECT>/<IMAGE>:<TAG>

 

Step 3: Configure the Velero vSphere Operator

Configure the Velero vSphere Operator from the vSphere Client to use the images stored in the private Harbor registry.

  1. Refer to Create a vSphere Namespace for the Velero Plugin for vSphere about configNamespace
  2. Refer to Configure the Velero vSphere Operator Service on the Supervisor for detailed field definitions.
veleroConfig:
  configNamespace: # Specify the vSphere Namespace created for backup traffic
  veleroImage: <HARBOR_FQDN>/<HARBOR_PROJECT>/velero:v1.13.2_vmware.3
  vspherePlugin: <HARBOR_FQDN>/<HARBOR_PROJECT>/velero-plugin-for-vsphere:v1.6.0
  awsPlugin: <HARBOR_FQDN>/<HARBOR_PROJECT>/velero-plugin-for-aws:v1.6.1

Note: The backup-driver image does not require an entry in veleroConfig. Its location is automatically derived from the vspherePlugin parameter.

 

Step 4: Install the Velero Plugin for vSphere

  1. Review the installation prerequisites in Install the Velero Plugin for vSphere.
  2. Run the installation command:
# Example - Update these options for your environment.
./velero-vsphere install --no-secret --no-default-backup-location --use-volume-snapshots=false

 

Step 5: Verify the Deployment

Verify that all Velero components are "Running" in the Supervisor Service namespace.

kubectl -n svc-velero-domain-c1002 get pods
#> NAME                                              READY   STATUS    RESTARTS       AGE
#> backup-driver-56b97fc89f-rr7qx                    1/1     Running   0              3m34s
#> velero-78978698f-hskzv                            1/1     Running   0              4m42s
#> velero-vsphere-operator-69965cff48-dw968          1/1     Running   2 (3h6m ago)   3d6h
#> velero-vsphere-operator-webhook-649c7f9c7-244kx   1/1     Running   2 (3h6m ago)   3d6h
#> velero-vsphere-operator-webhook-649c7f9c7-48lqc   1/1     Running   2 (3h6m ago)   3d6h
#> velero-vsphere-operator-webhook-649c7f9c7-4kljj   1/1     Running   2 (3h6m ago)   3d6h

 

TroubleShooting Tips

Check - Velero Operator values

TARGET_SECRET_NAME=$(kubectl -n vmware-system-supervisor-services get secrets -oname | grep config-secret | grep velero)
kubectl -n vmware-system-supervisor-services get ${TARGET_SECRET_NAME} -ojson | jq -r '.data["values.yaml"]' | base64 -d
#> namespace: svc-velero-domain-c1002
#> veleroConfig:
#>   awsPlugin: <HARBOR>/<PROJECT>/velero-plugin-for-aws:v1.6.1
#>   veleroImage: <HARBOR>/<PROJECT>velero:v1.13.2_vmware.3
#>   vspherePlugin: <HARBOR>/<PROJECT>/velero-plugin-for-vsphere:v1.6.0

Check - Velero Image Location

kubectl -n svc-velero-domain-c1002 get deployment/velero -oyaml | grep image:
#>        image: <HARBOR>/<PROJECT>/velero:v1.13.2_vmware.3
#>      - image: <HARBOR>/<PROJECT>/velero-plugin-for-aws:v1.6.1
#>      - image: <HARBOR>/<PROJECT>/velero-plugin-for-vsphere:v1.6.0
Powered by Wolken Software