Perform cross-project backups

This page describes how to perform a cross-project backup in Google Kubernetes Engine (GKE) using the Backup for GKE service.

Overview

Cross-project backups let you decouple the backup project lifecycle from the cluster project. You can get access-controlled backups separately in a different project than the cluster project.

Limitations

You cannot migrate existing backup plans to perform cross-project backups.

Pricing

For pricing details, see Pricing for cross-project backups and restores.

Before you begin

1. Before you start, make sure you have performed the following tasks:

   • Enable the Google Kubernetes Engine API.
   Enable Google Kubernetes Engine API
   • If you want to use the Google Cloud CLI for this task, install and then initialize the gcloud CLI. If you previously installed the gcloud CLI, get the latest version by running gcloud components update.

2. Enable the Backup for GKE API in the project that contains the cluster you want to back up and the project where you want to store the backup. For more information, see Enable the Backup for GKE API.

3. Enable the Backup for GKE add-on in the cluster you want to backup. For more information, see Enable Backup for GKE for a cluster.

Required roles

To get the permissions that you need to create and manage a cross-project backup, ask your administrator to grant you the Backup for GKE Backup Admin (roles/gkebackup.backupAdmin), which is a subset of Backup for GKE Admin (roles/gkebackup.admin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Set up service accounts

If needed, create per-project service accounts to perform operations on your projects.

Using Google Cloud CLI, run the following commands to set up a service account:

1. Create a service account by running the gcloud beta services identity create command:

     gcloud beta services identity create \
       --service=gkebackup.googleapis.com \
       --project=CLUSTER_PROJECT_ID
     gcloud projects add-iam-policy-binding CLUSTER_PROJECT_ID \
       --member=serviceAccount:service-CLUSTER_PROJECT_NUMBER@gcp-sa-gkebackup.iam.gserviceaccount.com \
       --role=roles/gkebackup.serviceAgent \
   
     gcloud beta services identity create \
       --service=gkebackup.googleapis.com \
       --project=BACKUP_PROJECT_ID
     gcloud projects add-iam-policy-binding BACKUP_PROJECT_ID \
       --member=serviceAccount:service-BACKUP_PROJECT_NUMBER@gcp-sa-gkebackup.iam.gserviceaccount.com \
       --role=roles/gkebackup.serviceAgent
   

   Replace the following:

   • CLUSTER_PROJECT_ID: the alphanumeric name of your Google Cloud project that you want to create. For example, cluster-project-id.

   • CLUSTER_PROJECT_NUMBER: the unique numeric identifier for your Google Cloud project. For example, 123456789012.

   • BACKUP_PROJECT_ID: the alphanumeric name of the Google Cloud project where your backup will be stored. For example, backup-project-id.

   • BACKUP_PROJECT_NUMBER: the unique numeric identifier of the project where your backup will be stored. For example, 123456789012.

2. Allow the backup project's service account to perform backups in the cluster project by running the gcloud projects add-iam-policy-binding command:

     gcloud projects add-iam-policy-binding CLUSTER_PROJECT_ID \
      --member=serviceAccount:service-BACKUP_PROJECT_NUMBER@gcp-sa-gkebackup.iam.gserviceaccount.com \
      --role=roles/gkebackup.serviceAgent
   

   Replace the following:

   • CLUSTER_PROJECT_ID: the alphanumeric name of your Google Cloud project. For example, cluster-project-id.

   • BACKUP_PROJECT_NUMBER: the unique numeric identifier of the project where your backup will be stored. For example, 123456789012.

3. Allow the cluster project's agent to access gkebackup.googleapis.com in the backup project by running the gcloud projects add-iam-policy-binding command:

     gcloud projects add-iam-policy-binding BACKUP_PROJECT_ID \
      --member serviceAccount:service-CLUSTER_PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com \
      --role "roles/gkebackup.crossProjectServiceAgent"
   

   Replace the following:

   • BACKUP_PROJECT_ID: the alphanumeric name of the Google Cloud project where your backup will be stored. For example, backup-project-id.

   • CLUSTER_PROJECT_NUMBER: the unique numeric identifier for your Google Cloud project. For example, 123456789012.

Create a backup channel

After you set up service accounts, you must create a backup channel in the same project and region as the cluster that you want to back up. After you create a backup channel, you can back up clusters in the project and region to the destination project.

gcloud beta container backup-restore backup-channels create BACKUP_CHANNEL_NAME \
 --project=CLUSTER_PROJECT_ID \
 --location=CLUSTER_LOCATION \
 --destination-project=projects/BACKUP_PROJECT_NUMBER

Create a backup plan

After you create a backup channel, you must create the backup plan. If the cluster being backed up resides in a different project, the backup plan is automatically bound to an existing backup channel. The backup_channel field in the backup plan shows the backup channel that the backup plan is bound to.

Before you begin

Before you create a backup plan, see Plan a set of backups.

Create a backup plan

To create a backup plan in the backup project using the Google Cloud console, use the following instructions:

1. In the Google Cloud console, go to the Google Kubernetes Engine page.

   Go to Google Kubernetes Engine

2. From the Resource Management menu, click Backup for GKE.

3. Open the backup project you want to create the backup plan in.

4. Click Create a backup plan.

5. Select the Configure cross-project backups checkbox.

6. In the Cluster project field, choose the project containing your source cluster.

7. From the Cluster menu, select the region of the cluster.

8. In the Backup plan name field, enter a name for the backup plan.

9. In the Backup project field, enter the name of the backup project you want to store your backups in.

10. In the Region field, enter the location where your backups will be stored. If no backup channel is found, click Create backup channel, follow the prompts to create a backup channel, and click Create.

11. Click View backup channel details.

12. Click Validate permissions.

13. Complete the remaining steps as described in Create a backup plan.

14. Click Create plan.

View a backup channel

Use the instructions in the following sections to view backup channels.

View all backup channels within a project and region

  gcloud beta container backup-restore backup-channels list \
    --project=CLUSTER_PROJECT_ID \
    --location=CLUSTER_LOCATION

View details of a backup channel

  gcloud beta container backup-restore backup-channels describe BACKUP_CHANNEL_NAME \
  --project=CLUSTER_PROJECT_ID \
  --location=CLUSTER_LOCATION

View the backup plans bound to a backup channel

To view the backup plans that are bound to a backup channel, run the gcloud beta container backup-restore backup-plan-bindings list command using Google Cloud CLI:

   gcloud beta container backup-restore backup-plan-bindings list \
    --backup-channel=BACKUP_CHANNEL_NAME \
    --project=CLUSTER_PROJECT_ID \
    --location=CLUSTER_LOCATION

Replace the following:

• BACKUP_CHANNEL_NAME: the name of the backup channel you want to view. For example, my-backup-channel-name.

• CLUSTER_PROJECT_ID: the alphanumeric name of your Google Cloud project where the cluster is located. For example, cluster-project-id.

• CLUSTER_LOCATION: the region where the cluster is located. For example, us-central1.

Manage backup channels

The following sections describe how to manage backup channels after you create them.

Update a backup channel

Use the following instructions to update a backup channel. Note that you can only modify the description of an existing backup channel. All other fields cannot be modified.

gcloud beta container backup-restore backup-channels update BACKUP_CHANNEL_NAME \
  --project=CLUSTER_PROJECT_ID \
  --location=CLUSTER_LOCATION \
  --description=DESCRIPTION

Delete a backup channel

You can only delete a backup channel if it does not contain any active backup plans. If active backup plans are bound to it, you must first deactivate or delete the backup plans before you can delete the backup channel.

  gcloud beta container backup-restore backup-channels delete BACKUP_CHANNEL_NAME \
    --project=CLUSTER_PROJECT_ID \
    --location=CLUSTER_LOCATION

What's next

• Learn how to perform a cross-project restore.

• Learn more about planning a set of restores.