Stage 5 · Platform
Storage & Secrets
Backup & Disaster Recovery
Azure Backup, Velero for AKS, and RTO/RPO planning.
Backup Strategies
A backup strategy covers three layers: application data (databases, file storage), Kubernetes resources (deployments, services, configs), and cluster state (namespaces, RBAC, CRDs). Each layer requires different tools.
| Layer | Tool | What It Backs Up |
|---|---|---|
| Application data | Azure Backup, database-native | Database dumps, blob snapshots, file shares |
| Kubernetes resources | Velero, etcd snapshots | Deployments, Services, ConfigMaps, Secrets |
| Cluster state | AKS backup, Azure Policy | Namespaces, RBAC, CRDs, Helm releases |
Azure Backup
Azure Backup provides centralized backup management for VMs, managed disks, file shares, and databases. It supports daily, weekly, monthly, and yearly retention with point-in-time recovery.
# Create a Recovery Services vault
az backup vault create \
--resource-group rg-payments \
--name rv-payments-prod \
--location eastus
# Enable backup for a VM
az backup protection enable-for-vm \
--resource-group rg-payments \
--vault-name rv-payments-prod \
--vm vm-payments-01 \
--policy-name DefaultPolicy
# List backup items
az backup item list \
--resource-group rg-payments \
--vault-name rv-payments-prod \
--container-name iaasvmcontainer;rg-payments;vm-payments-01 \
--query "[].{name:name, status:protectionStatus}" --output tableThe DefaultPolicy retains backups for 30 days. Create custom policies for longer retention periods or more frequent backups.
Velero for AKS
Velero is a Kubernetes-native backup tool that backs up cluster resources and persistent volumes. It stores backups in Azure Blob Storage and supports cross-cluster restores.
# Install Velero using the Azure plugin
velero install \
--provider azure \
--bucket velero-backups-prod \
--secret-file ./credentials-velero \
--backup-location-config "resourceGroup=rg-velero,storageAccount=stveleroprod,subscriptionId={sub-id}" \
--snapshot-location-config "resourceGroup=rg-velero,subscriptionId={sub-id}" \
--use-node-agent
# Create a backup
velero backup create payments-full-backup \
--include-namespaces default \
--wait
# List backups
velero backup getVelero captures Kubernetes resources and disk snapshots. The --include-namespaces flag limits backup scope to reduce storage costs.
Create a scheduled backup for daily runs: velero schedule create daily-backup --schedule='0 2 * * *' --ttl 720h --include-namespaces default
RTO and RPO Planning
RTO (Recovery Time Objective) is the maximum acceptable time to restore service after a failure. RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time.
| Scenario | RTO | RPO | Strategy |
|---|---|---|---|
| Single pod failure | Seconds | 0 (no data loss) | Kubernetes self-healing, PDBs |
| Node failure | <5 minutes | 0 | Pod rescheduling, PDBs |
| Zone failure | <15 minutes | <5 minutes | Zone-aware deployments, Velero |
| Region failure | <1 hour | <1 hour | Geo-redundant storage, cross-region failover |
| Complete data loss | Hours | <24 hours | Azure Backup, Velero + BLS |
Restore Procedures
# Restore all resources from a backup
velero restore create payments-restore \
--from-backup payments-full-backup \
--include-namespaces default
# Restore specific resources
velero restore create payments-selective \
--from-backup payments-full-backup \
--selector app=payments
# Check restore status
velero restore getVelero restores are selective — you can restore specific namespaces, labels, or resource types. Check velero restore logs for any restore errors.
# Restore a VM to a specific point in time
az backup restore restore-disks \
--resource-group rg-payments \
--vault-name rv-payments-prod \
--container-name "iaasvmcontainer;rg-payments;vm-payments-01" \
--item-name vm-payments-01 \
--restore-mode OriginalLocation \
--restore-as-unmanaged-disks falseRestore to original location replaces the existing VM. Use RestoreASManagedDisks false to restore to unmanaged disks for manual recovery.
Backup Testing
Backups are useless if they cannot be restored. Regular backup testing verifies that backups are complete, consistent, and restorable within your RTO/RPO targets.
- Monthly restore test — Restore a non-critical workload to an isolated environment
- Quarterly DR drill — Simulate a region failure and execute the full failover runbook
- Annual RPO validation — Verify that backup frequency meets RPO requirements
- Backup integrity check — Validate backup checksums and encryption
- Restore time measurement — Track actual restore time against RTO targets
If you have never restored from a backup, you do not have a backup — you have a hope. Schedule regular restore tests and document the results.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.