Setup OADP for AWS

This skill provides comprehensive guidance for configuring OADP on AWS-based OpenShift clusters, including S3 bucket setup, IAM permissions, EBS volume snapshots, and ROSA-specific configurations.

When to Use This Skill

AWS Clusters: Setting up OADP on OpenShift clusters running on AWS EC2
ROSA Clusters: Configuring OADP on Red Hat OpenShift Service on AWS
AWS STS: Using AWS Security Token Service for authentication
S3 Storage: Configuring S3 as backup storage location
EBS Snapshots: Setting up EBS volume snapshot integration
Cross-Region: Configuring multi-region backup redundancy

What This Skill Does

Creates S3 Bucket: Sets up S3 bucket for backup storage
Configures IAM: Creates IAM users/roles with required permissions
Sets Up Credentials: Configures AWS credentials for OADP
Configures DPA: Creates DataProtectionApplication with AWS provider
Enables EBS Snapshots: Configures VolumeSnapshotLocation for EBS
Validates Setup: Tests S3 connectivity and snapshot capabilities
Optimizes Configuration: Tunes settings for AWS-specific performance

How to Use

Basic Usage

Setup OADP for AWS with S3 bucket

Configure OADP on ROSA cluster

Advanced Usage

Setup OADP with AWS STS authentication

Configure multi-region AWS backup with failover

Prerequisites

Before setting up OADP on AWS:

[ ] OpenShift cluster running on AWS or ROSA
[ ] AWS CLI configured with admin credentials
[ ] OADP operator installed (see install-oadp skill)
[ ] S3 bucket created or permissions to create one
[ ] IAM permissions to create users/roles/policies
[ ] Understanding of AWS regions and availability zones

Examples

Example 1: Basic AWS Setup with IAM User

User: "Setup OADP with AWS S3 using IAM user credentials"

Skill Actions:

Create S3 bucket:

# Set variables
BUCKET_NAME="oadp-backups-$(date +%s)"
AWS_REGION="us-east-1"

# Create bucket
aws s3 mb s3://$BUCKET_NAME --region $AWS_REGION

# Enable versioning (recommended)
aws s3api put-bucket-versioning \
  --bucket $BUCKET_NAME \
  --versioning-configuration Status=Enabled

# Enable encryption
aws s3api put-bucket-encryption \
  --bucket $BUCKET_NAME \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "AES256"
      }
    }]
  }'

echo "S3 bucket created: $BUCKET_NAME"

Create IAM policy for OADP:

# Create policy document
cat <<EOF > oadp-s3-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": [
        "arn:aws:s3:::$BUCKET_NAME/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": [
        "arn:aws:s3:::$BUCKET_NAME"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVolumes",
        "ec2:DescribeSnapshots",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:CreateSnapshot",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    }
  ]
}
EOF

# Create IAM policy
aws iam create-policy \
  --policy-name OADPBackupPolicy \
  --policy-document file://oadp-s3-policy.json

POLICY_ARN=$(aws iam list-policies --query 'Policies[?PolicyName==`OADPBackupPolicy`].Arn' --output text)
echo "IAM Policy ARN: $POLICY_ARN"

Create IAM user and attach policy:

# Create IAM user
aws iam create-user --user-name oadp-backup-user

# Attach policy to user
aws iam attach-user-policy \
  --user-name oadp-backup-user \
  --policy-arn $POLICY_ARN

# Create access keys
aws iam create-access-key --user-name oadp-backup-user > oadp-access-keys.json

# Extract credentials
AWS_ACCESS_KEY_ID=$(jq -r '.AccessKey.AccessKeyId' oadp-access-keys.json)
AWS_SECRET_ACCESS_KEY=$(jq -r '.AccessKey.SecretAccessKey' oadp-access-keys.json)

echo "Access Key ID: $AWS_ACCESS_KEY_ID"
echo "Secret saved in oadp-access-keys.json - store securely!"

Create credentials secret in OpenShift:

# Create credentials file
cat <<EOF > credentials-velero
[default]
aws_access_key_id=$AWS_ACCESS_KEY_ID
aws_secret_access_key=$AWS_SECRET_ACCESS_KEY
EOF

# Create secret
oc create secret generic cloud-credentials \
  --from-file cloud=credentials-velero \
  -n openshift-adp

# Clean up local credentials
rm -f credentials-velero oadp-access-keys.json

Create DataProtectionApplication:

apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: dpa-aws
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
      featureFlags:
        - EnableCSI
    kopia:
      enable: true
    # Note: Restic is deprecated in OADP 1.4+, use Kopia for new deployments
  backupLocations:
    - name: default
      velero:
        provider: aws
        default: true
        objectStorage:
          bucket: $BUCKET_NAME
          prefix: cluster-backups
        config:
          region: $AWS_REGION
        credential:
          name: cloud-credentials
          key: cloud
  snapshotLocations:
    - name: default
      velero:
        provider: aws
        config:
          region: $AWS_REGION

Verify setup:

# Check DPA status
oc get dpa -n openshift-adp

# Check BackupStorageLocation
oc get backupstoragelocations -n openshift-adp

# Verify BSL is Available
oc get bsl -n openshift-adp -o jsonpath='{.items[0].status.phase}'

# Test S3 connectivity
velero backup-location get

Success Indicators:

✅ S3 bucket created with versioning and encryption
✅ IAM policy and user created
✅ BackupStorageLocation shows "Available"
✅ VolumeSnapshotLocation configured for EBS

Example 2: ROSA Setup with AWS STS

User: "Configure OADP on ROSA cluster using STS authentication"

Skill Actions:

Create S3 bucket (same as Example 1):

BUCKET_NAME="oadp-rosa-backups-$(date +%s)"
AWS_REGION="us-east-1"

aws s3 mb s3://$BUCKET_NAME --region $AWS_REGION
aws s3api put-bucket-versioning --bucket $BUCKET_NAME --versioning-configuration Status=Enabled

Get ROSA cluster OIDC provider:

# Get ROSA cluster ID
CLUSTER_NAME="my-rosa-cluster"
CLUSTER_ID=$(rosa describe cluster -c $CLUSTER_NAME -o json | jq -r .id)

# Get OIDC endpoint
OIDC_ENDPOINT=$(rosa describe cluster -c $CLUSTER_NAME -o json | jq -r .aws.sts.oidc_endpoint_url)
OIDC_ENDPOINT=${OIDC_ENDPOINT#https://}

echo "OIDC Endpoint: $OIDC_ENDPOINT"

Create IAM trust policy for STS:

# Get AWS account ID
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

# Create trust policy
cat <<EOF > trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "${OIDC_ENDPOINT}:sub": [
            "system:serviceaccount:openshift-adp:velero",
            "system:serviceaccount:openshift-adp:openshift-adp-controller-manager"
          ]
        }
      }
    }
  ]
}
EOF

Create IAM role with STS:

# Create IAM role
aws iam create-role \
  --role-name ROSA-OADP-Role \
  --assume-role-policy-document file://trust-policy.json \
  --description "OADP backup role for ROSA with STS"

# Attach OADP policy (created earlier)
aws iam attach-role-policy \
  --role-name ROSA-OADP-Role \
  --policy-arn $POLICY_ARN

# Get role ARN
ROLE_ARN=$(aws iam get-role --role-name ROSA-OADP-Role --query Role.Arn --output text)
echo "Role ARN: $ROLE_ARN"

Create credentials secret with STS role:

# Create credentials file for STS
cat <<EOF > credentials-velero
[default]
role_arn=$ROLE_ARN
web_identity_token_file=/var/run/secrets/openshift/serviceaccount/token
EOF

# Create secret
oc create secret generic cloud-credentials-sts \
  --from-file cloud=credentials-velero \
  -n openshift-adp

rm credentials-velero

Create DPA for ROSA with STS:

apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: dpa-rosa-sts
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
      podConfig:
        env:
          - name: AWS_ROLE_ARN
            value: $ROLE_ARN
          - name: AWS_WEB_IDENTITY_TOKEN_FILE
            value: /var/run/secrets/openshift/serviceaccount/token
        volumes:
          - name: bound-sa-token
            projected:
              sources:
                - serviceAccountToken:
                    path: token
                    expirationSeconds: 3600
                    audience: openshift
        volumeMounts:
          - name: bound-sa-token
            mountPath: /var/run/secrets/openshift/serviceaccount
    kopia:
      enable: true
      podConfig:
        env:
          - name: AWS_ROLE_ARN
            value: $ROLE_ARN
          - name: AWS_WEB_IDENTITY_TOKEN_FILE
            value: /var/run/secrets/openshift/serviceaccount/token
  backupLocations:
    - name: default
      velero:
        provider: aws
        default: true
        objectStorage:
          bucket: $BUCKET_NAME
          prefix: rosa-backups
        config:
          region: $AWS_REGION
        credential:
          name: cloud-credentials-sts
          key: cloud
  snapshotLocations:
    - name: default
      velero:
        provider: aws
        config:
          region: $AWS_REGION

ROSA-Specific Notes:

STS provides temporary credentials via OIDC
No long-lived access keys required
ServiceAccount token refreshed automatically
More secure than static IAM users

Example 3: Multi-Region AWS Setup

User: "Configure OADP with primary and secondary regions for DR"

Skill Actions:

Create S3 buckets in multiple regions:

PRIMARY_REGION="us-east-1"
SECONDARY_REGION="us-west-2"
PRIMARY_BUCKET="oadp-primary-$(date +%s)"
SECONDARY_BUCKET="oadp-secondary-$(date +%s)"

# Create primary bucket
aws s3 mb s3://$PRIMARY_BUCKET --region $PRIMARY_REGION
aws s3api put-bucket-versioning --bucket $PRIMARY_BUCKET --versioning-configuration Status=Enabled

# Create secondary bucket
aws s3 mb s3://$SECONDARY_BUCKET --region $SECONDARY_REGION
aws s3api put-bucket-versioning --bucket $SECONDARY_BUCKET --versioning-configuration Status=Enabled

# Optional: Enable cross-region replication
# (Requires additional IAM role and replication configuration)

Create multi-region DPA:

apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: dpa-multi-region
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
  backupLocations:
    - name: primary-us-east
      velero:
        provider: aws
        default: true
        objectStorage:
          bucket: $PRIMARY_BUCKET
          prefix: cluster-backups
        config:
          region: us-east-1
        credential:
          name: cloud-credentials
          key: cloud
    - name: secondary-us-west
      velero:
        provider: aws
        default: false
        objectStorage:
          bucket: $SECONDARY_BUCKET
          prefix: cluster-backups
        config:
          region: us-west-2
        credential:
          name: cloud-credentials
          key: cloud
  snapshotLocations:
    - name: primary-snapshots
      velero:
        provider: aws
        config:
          region: us-east-1
    - name: secondary-snapshots
      velero:
        provider: aws
        config:
          region: us-west-2

Create backup to specific region:

# Backup to primary region (default)
velero backup create app-backup-primary \
  --include-namespaces myapp

# Backup to secondary region
velero backup create app-backup-secondary \
  --include-namespaces myapp \
  --storage-location secondary-us-west \
  --volume-snapshot-locations secondary-snapshots

Example 4: S3-Compatible Storage (MinIO, Wasabi)

User: "Setup OADP with S3-compatible storage"

Skill Actions:

Create DPA for S3-compatible endpoint:

apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: dpa-s3-compatible
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
  backupLocations:
    - name: s3-compatible
      velero:
        provider: aws
        default: true
        objectStorage:
          bucket: oadp-backups
          prefix: openshift
        config:
          region: minio  # Arbitrary for non-AWS
          s3ForcePathStyle: "true"  # Required for MinIO/others
          s3Url: https://minio.example.com:9000  # Custom endpoint
          insecureSkipTLSVerify: "false"  # Set true for self-signed certs
        credential:
          name: cloud-credentials
          key: cloud

Credentials for S3-compatible:

# Same format as AWS
cat <<EOF > credentials-velero
[default]
aws_access_key_id=<MINIO_ACCESS_KEY>
aws_secret_access_key=<MINIO_SECRET_KEY>
EOF

AWS-Specific Configuration Options

S3 Bucket Configuration

Recommended S3 settings:

# Enable versioning (for backup recovery)
aws s3api put-bucket-versioning \
  --bucket $BUCKET_NAME \
  --versioning-configuration Status=Enabled

# Enable server-side encryption
aws s3api put-bucket-encryption \
  --bucket $BUCKET_NAME \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "AES256"
      },
      "BucketKeyEnabled": true
    }]
  }'

# Configure lifecycle policy (optional)
aws s3api put-bucket-lifecycle-configuration \
  --bucket $BUCKET_NAME \
  --lifecycle-configuration file://lifecycle-policy.json

Lifecycle policy example:

{
  "Rules": [
    {
      "Id": "TransitionOldBackups",
      "Status": "Enabled",
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD_IA"
        },
        {
          "Days": 90,
          "StorageClass": "GLACIER"
        }
      ],
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 90
      }
    }
  ]
}

EBS Snapshot Configuration

VolumeSnapshotClass for EBS:

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: oadp-ebs-snapclass
  labels:
    velero.io/csi-volumesnapshot-class: "true"
driver: ebs.csi.aws.com
deletionPolicy: Retain
parameters:
  tagSpecification_1: "Name=velero-backup"
  tagSpecification_2: "ManagedBy=oadp"

Performance Tuning

Optimize for large AWS deployments:

spec:
  configuration:
    velero:
      podConfig:
        resourceAllocations:
          limits:
            cpu: "2"
            memory: 2Gi
          requests:
            cpu: "1"
            memory: 1Gi
      args:
        - --max-concurrent-k8s-connections=50
        - --resource-timeout=10m
    kopia:
      podConfig:
        resourceAllocations:
          limits:
            cpu: "2"
            memory: 4Gi
        env:
          - name: KOPIA_PARALLEL_FILE_OPERATIONS
            value: "8"

Troubleshooting

BSL Shows Unavailable

Symptoms: BackupStorageLocation phase is "Unavailable" on AWS

Common AWS-specific causes:

IAM permissions insufficient:

# Test S3 access
aws s3 ls s3://$BUCKET_NAME

# Test with Velero pod's credentials
oc exec -n openshift-adp deployment/velero -- aws s3 ls s3://$BUCKET_NAME

Wrong region:

# Check bucket region
aws s3api get-bucket-location --bucket $BUCKET_NAME

# Verify matches DPA configuration
oc get dpa -n openshift-adp -o yaml | grep region

S3 endpoint unreachable:

# Test from Velero pod
oc exec -n openshift-adp deployment/velero -- curl -I https://s3.$AWS_REGION.amazonaws.com

EBS Snapshot Failures

Symptoms: Volume snapshots fail with AWS errors

Diagnosis:

# Check VolumeSnapshot status
oc get volumesnapshots -A

# Check VolumeSnapshot errors
oc describe volumesnapshot <snapshot-name> -n <namespace>

# Check CSI driver logs
oc logs -n openshift-cluster-csi-drivers -l app=aws-ebs-csi-driver

Common issues:

IAM role missing EC2 snapshot permissions
EBS volume in different AZ than snapshot location
Volume encryption key access denied
Snapshot quota exceeded

STS Token Expiration

Symptoms: ROSA/STS backups fail intermittently

Solution:

# Increase token expiration in DPA
spec:
  configuration:
    velero:
      podConfig:
        volumes:
          - name: bound-sa-token
            projected:
              sources:
                - serviceAccountToken:
                    path: token
                    expirationSeconds: 7200  # Increase from 3600

Best Practices

Use IAM Roles over Users
- Prefer STS/IRSA for ROSA
- Use IAM roles for EC2-based clusters
- Rotate credentials regularly
- Use least-privilege permissions
Enable S3 Features
- Versioning for backup recovery
- Encryption at rest
- Access logging
- Lifecycle policies for cost optimization
Multi-Region Strategy
- Primary and secondary BSLs
- Cross-region replication for critical data
- Test cross-region restore
- Document failover procedures
Cost Optimization
- Use S3 Intelligent-Tiering
- Implement lifecycle policies
- Delete old snapshots
- Monitor S3 storage costs
Security
- Encrypt S3 buckets
- Use VPC endpoints for S3 access
- Enable S3 access logs
- Restrict IAM policies to specific buckets
- Use KMS for encryption keys

Verification Checklist

After AWS setup:

[ ] S3 bucket created with versioning enabled
[ ] S3 bucket encrypted at rest
[ ] IAM user/role created with correct permissions
[ ] Credentials secret created in openshift-adp namespace
[ ] DPA applied and reconciled successfully
[ ] BackupStorageLocation shows "Available"
[ ] VolumeSnapshotLocation configured
[ ] Test backup created successfully
[ ] Can list backups in S3 bucket
[ ] EBS snapshot created during test backup

Next Steps

After AWS setup:

Test Backup: Create test backup with EBS volumes
Test Restore: Verify cross-AZ and cross-region restore
Configure Schedules: Set up automated backup schedules
Monitor Costs: Track S3 and EBS snapshot costs
Document: Record AWS account, bucket names, IAM details

Related Skills:

install-oadp - Install OADP operator
create-backup - Create backups
backup-etcd - Backup etcd for control plane DR

Resources

AWS OADP Documentation: https://docs.openshift.com/container-platform/latest/backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.html
ROSA OADP Guide: https://docs.openshift.com/rosa/rosa_backing_up_and_restoring_applications/backing-up-applications.html
AWS STS: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html

Version: 1.0 Last Updated: 2025-11-17 Tested With: OADP 1.3+, AWS, ROSA

setup-oadp-aws

Setup OADP for AWS

When to Use This Skill

What This Skill Does

How to Use

Basic Usage

Advanced Usage

Prerequisites

Examples

Example 1: Basic AWS Setup with IAM User

Example 2: ROSA Setup with AWS STS

Example 3: Multi-Region AWS Setup

Example 4: S3-Compatible Storage (MinIO, Wasabi)

AWS-Specific Configuration Options

S3 Bucket Configuration

EBS Snapshot Configuration

Performance Tuning

Troubleshooting

BSL Shows Unavailable

EBS Snapshot Failures

STS Token Expiration

Best Practices

Verification Checklist

Next Steps

Resources