AWS - создание snapshot для ebs

Thank you for reading this post, don't forget to subscribe!

появилась задача рас в сутки делать снапшот диска который для gitaly у gitlab.

есть 2 варианта

использовать aws backup
использовать Data Lifecycle Manager

вот вариант с aws backup

resource "aws_backup_vault" "gitlab" {
  name        = "gitlab-backup"
  kms_key_arn = "arn:aws:kms:eu-central-1:ACCOUNT-ID:key/006ca35a-edbcddae2f04"
  tags = {
    Name = "gitlab-backup"
  }
}

resource "aws_backup_plan" "gitlab" {
  name = "gitlab-backup"

  rule {
    rule_name         = "gitlab-backup"
    target_vault_name = aws_backup_vault.gitlab.name
    schedule          = "cron(00 21 * * ? *)"
    lifecycle {
      delete_after = 14
    }
  }
}


resource "aws_backup_selection" "gitlab_backup_selection" {
  name         = "gitlab-ebs-backup-selection"
  iam_role_arn = aws_iam_role.backup_role.arn
  plan_id      = aws_backup_plan.gitlab.id

  selection_tag {
    type  = "STRINGEQUALS"
    key   = "kubernetes.io/created-for/pvc/name"
    value = "repo-data-gitlab-gitaly-0"
  }
}



resource "aws_iam_role" "backup_role" {
  name = "aws-backup-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "backup.amazonaws.com"
      }
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "backup_policy_attachment" {
  role       = aws_iam_role.backup_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

resource "aws_backup_vault" "gitlab" {

name = "gitlab-backup"

kms_key_arn = "arn:aws:kms:eu-central-1:ACCOUNT-ID:key/006ca35a-edbcddae2f04"

tags = {

Name = "gitlab-backup"

}

resource "aws_backup_plan" "gitlab" {

name = "gitlab-backup"

rule {

rule_name = "gitlab-backup"

target_vault_name = aws_backup_vault.gitlab.name

schedule = "cron(00 21 * * ? *)"

lifecycle {

delete_after = 14

}

resource "aws_backup_selection" "gitlab_backup_selection" {

name = "gitlab-ebs-backup-selection"

iam_role_arn = aws_iam_role.backup_role.arn

plan_id = aws_backup_plan.gitlab.id

selection_tag {

type = "STRINGEQUALS"

key = "kubernetes.io/created-for/pvc/name"

value = "repo-data-gitlab-gitaly-0"

}

resource "aws_iam_role" "backup_role" {

name = "aws-backup-role"

assume_role_policy = jsonencode({

Version = "2012-10-17",

Statement = [{

Effect = "Allow"

Principal = {

Service = "backup.amazonaws.com"

}

Action = "sts:AssumeRole"

}]

})

}

resource "aws_iam_role_policy_attachment" "backup_policy_attachment" {

role = aws_iam_role.backup_role.name

policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"

}

тут указываем в selection

key = "kubernetes.io/created-for/pvc/name"
value = "repo-data-gitlab-gitaly-0"

эти тэги смотрим на самом диске.
так же нужно указать arn kms kms_key_arn которым шифровались диски.

================================================================

второй вариант

resource "aws_dlm_lifecycle_policy" "gitlab_pvc_snapshot" {
  description        = "Daily snapshot for GitLab PVC and retention of 14 days"
  execution_role_arn = aws_iam_role.dlm_role.arn
  state              = "ENABLED"

  policy_details {
    resource_types = ["VOLUME"]

    target_tags = {
      "kubernetes.io/created-for/pvc/name" = "repo-data-gitlab-gitaly-0"
    }
    schedule {
      name = "daily-gitlab-pvc-snapshot"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = ["21:00"]
      }

      retain_rule {
        count = 14 # Хранить 14 последних снапшотов
      }

      copy_tags = true
    }
  }
}

resource "aws_iam_role" "dlm_role" {
  name = "gitlab-ebs-snapshots"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "dlm.amazonaws.com"
      }
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "dlm_role_policy" {
  role       = aws_iam_role.dlm_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"
}

resource "aws_dlm_lifecycle_policy" "gitlab_pvc_snapshot" {

description = "Daily snapshot for GitLab PVC and retention of 14 days"

execution_role_arn = aws_iam_role.dlm_role.arn

state = "ENABLED"

policy_details {

resource_types = ["VOLUME"]

target_tags = {

"kubernetes.io/created-for/pvc/name" = "repo-data-gitlab-gitaly-0"

}

schedule {

name = "daily-gitlab-pvc-snapshot"

create_rule {

interval = 24

interval_unit = "HOURS"

times = ["21:00"]

}

retain_rule {

count = 14 # Хранить 14 последних снапшотов

}

copy_tags = true

}

resource "aws_iam_role" "dlm_role" {

name = "gitlab-ebs-snapshots"

assume_role_policy = jsonencode({

Version = "2012-10-17"

Statement = [{

Effect = "Allow"

Principal = {

Service = "dlm.amazonaws.com"

}

Action = "sts:AssumeRole"

}]

})

}

resource "aws_iam_role_policy_attachment" "dlm_role_policy" {

role = aws_iam_role.dlm_role.name

policy_arn = "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"

}

тут так же нужно указать tag от диска.

Отмечу что при запуске крон может выполнять не точно в указанное время а с задержкой.
для первого вариант можно даже выставить окно - по дефолту оно равно час а если за 3 часа не выполнилось то считается упавшим.

Пн	Вт	Ср	Чт	Пт	Сб	Вс
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30

Centos

AWS - создание snapshot для ebs

второй вариант

https://github.com/midnight47/