feat(backups): configure resource required for enabling backups

Author: Simon Emms

.env.example

@@ -3,6 +3,10 @@
 AZURE_SUBSCRIPTION_ID=""
 AZURE_TENANT_ID=""
 
+# Set if you want to configure KOTS backups
+# https://docs.replicated.com/vendor/snapshots-overview
+BACKUPS_ENABLED=false
+
 # The name of the Kubernetes cluster
 CLUSTER_NAME=gitpod
 

.gitignore

@@ -3,3 +3,4 @@
 .idea
 gitpod.yaml
 gitpod-config.yaml
+credentials-velero

Dockerfile

@@ -17,6 +17,8 @@ RUN mkdir -p /tmp/helm/ \
 RUN curl -fsSL https://github.com/mikefarah/yq/releases/download/v4.12.2/yq_linux_amd64 -o /usr/local/bin/yq \
   && chmod +x /usr/local/bin/yq
 
+COPY --from=velero/velero:v1.8.1 /velero /usr/bin/velero
+
 WORKDIR /gitpod
 
 COPY . /gitpod

setup.sh

@@ -16,7 +16,7 @@ set -a
 SERVICES_POOL="services"
 WORKSPACES_POOL="workspaces"
 
-K8S_NODE_VM_SIZE=${K8S_NODE_VM_SIZE:="Standard_D4_v3"}
+K8S_NODE_VM_SIZE=${K8S_NODE_VM_SIZE:="Standard_DS3_v2"}
 
 function check_prerequisites() {
     if [ -z "${AZURE_SUBSCRIPTION_ID}" ]; then
@@ -141,6 +141,7 @@ function install() {
     setup_managed_dns
     setup_mysql_database
     setup_storage
+    setup_backup
     output_config
 }
 
@@ -366,6 +367,86 @@ function setup_mysql_database() {
     --start-ip-address "0.0.0.0"
 }
 
+function setup_backup() {
+  if [ -n "${BACKUPS_ENABLED}" ] && [ "${BACKUPS_ENABLED}" == "true" ]; then
+    echo "Configuring backups..."
+
+    # Based from https://github.com/vmware-tanzu/velero-plugin-for-microsoft-azure#setup
+    BACKUP_ACCOUNT="${STORAGE_ACCOUNT_NAME}backup"
+    if [ "$(az storage account show --name ${BACKUP_ACCOUNT} --resource-group ${RESOURCE_GROUP} --query "name == '${BACKUP_ACCOUNT}'" || echo "empty")" == "true" ]; then
+      echo "Backup storage account exists..."
+    else
+      echo "Create backup storage account..."
+      az storage account create \
+        --name "${STORAGE_ACCOUNT_NAME}backup" \
+        --resource-group "${RESOURCE_GROUP}" \
+        --location "${LOCATION}" \
+        --sku Standard_GRS \
+        --encryption-services blob \
+        --https-only true \
+        --kind BlobStorage \
+        --access-tier Hot
+    fi
+
+    ACCOUNT_KEY="$(az storage account keys list --resource-group "${RESOURCE_GROUP}" --account-name "${BACKUP_ACCOUNT}" --query "[0].value" -o tsv)"
+
+    BLOB_CONTAINER="velero"
+    if [ "$(az storage container show --account-name ${BACKUP_ACCOUNT} --name ${BLOB_CONTAINER} --account-key="${ACCOUNT_KEY}" --query "name == '${BLOB_CONTAINER}'" || echo "empty")" == "true" ]; then
+      echo "Backup storage container exists..."
+    else
+      echo "Create backup storage container..."
+      az storage container create \
+        -n "${BLOB_CONTAINER}" \
+        --account-key="${ACCOUNT_KEY}" \
+        --public-access off \
+        --account-name "${BACKUP_ACCOUNT}"
+    fi
+
+    kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/v1.8.9/deploy/infra/deployment-rbac.yaml
+
+    IDENTITY_NAME=velero
+    IDENTITY_RESOURCE_ID=$(az aks show --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}" --query "identityProfile.kubeletidentity.resourceId" -o tsv)
+    IDENTITY_CLIENT_ID=$(az aks show --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}" --query "identityProfile.kubeletidentity.clientId" -o tsv)
+
+    cat <<EOF | kubectl apply -f -
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentity
+metadata:
+  name: $IDENTITY_NAME
+spec:
+  type: 0
+  resourceID: $IDENTITY_RESOURCE_ID
+  clientID: $IDENTITY_CLIENT_ID
+EOF
+
+    cat <<EOF | kubectl apply -f -
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentityBinding
+metadata:
+  name: $IDENTITY_NAME-binding
+spec:
+  azureIdentity: $IDENTITY_NAME
+  selector: $IDENTITY_NAME
+EOF
+
+    cat << EOF  > ./credentials-velero
+AZURE_SUBSCRIPTION_ID=${AZURE_SUBSCRIPTION_ID}
+AZURE_RESOURCE_GROUP=${RESOURCE_GROUP}
+AZURE_CLOUD_NAME=AzurePublicCloud
+EOF
+
+    velero install \
+      --provider azure \
+      --plugins velero/velero-plugin-for-microsoft-azure:v1.4.0 \
+      --bucket "${BLOB_CONTAINER}" \
+      --secret-file ./credentials-velero \
+      --backup-location-config "resourceGroup=${RESOURCE_GROUP},storageAccount=${BACKUP_ACCOUNT}" \
+      --snapshot-location-config apiTimeout=30m \
+      --use-restic \
+      --wait
+  fi
+}
+
 function setup_storage() {
   if [ "$(az storage account show --name ${STORAGE_ACCOUNT_NAME} --resource-group ${RESOURCE_GROUP} --query "name == '${STORAGE_ACCOUNT_NAME}'" || echo "empty")" == "true" ]; then
     echo "Storage account exists..."