Asynchronous DR

Prerequisites

Version: Portworx v2.1 or later needs to be installed on both clusters. Also requires Stork v2.2+ on both the clusters.
Secret Store : Make sure you have configured a secret store on both your clusters. This will be used to store the credentials for the objectstore.
Network Connectivity: Ports 9001 and 9010 on the destination cluster should be reachable by the source cluster.

Stork helper: storkctl is a command-line tool for interacting with a set of scheduler extensions.

Perform the following steps to download storkctl from the Stork pod:

Linux:

STORK_POD=$(kubectl get pods -n kube-system -l name=stork -o jsonpath='{.items[0].metadata.name}') &&
kubectl cp -n kube-system $STORK_POD:/storkctl/linux/storkctl ./storkctl
sudo mv storkctl /usr/local/bin &&
sudo chmod +x /usr/local/bin/storkctl

OS X:

STORK_POD=$(kubectl get pods -n kube-system -l name=stork -o jsonpath='{.items[0].metadata.name}') &&
kubectl cp -n kube-system $STORK_POD:/storkctl/darwin/storkctl ./storkctl
sudo mv storkctl /usr/local/bin &&
sudo chmod +x /usr/local/bin/storkctl

Windows:

Copy storkctl.exe from the stork pod:

STORK_POD=$(kubectl get pods -n kube-system -l name=stork -o jsonpath='{.items[0].metadata.name}') &&
kubectl cp -n kube-system $STORK_POD:/storkctl/windows/storkctl.exe ./storkctl.exe

Move storkctl.exe to a directory in your PATH

Default Storage Class: Make sure you have configured only one default storage class. Having multiple default storage classes will cause PVC migrations to fail.
License: You will need a DR enabled Portworx license at both the source and destination cluster to use this feature.
If the destination cluster runs on GKE, follow the steps in the Migration with Stork on GKE page.
If the destination cluster runs on EKS, follow the steps in the Migration with Stork on EKS page.
An external objectstore, such as Minio s3, AWS s3, GCE Object Storage, or Azure Blob Storage, must be setup outside the Kubernetes clusters. If an external objectstore is not provided, Portworx will create an internal objectstore with a 100G backing volume. Pure Storage does not recommend using the internal objectstore in production.

Overview

With asynchronous DR, you can replicate Kubernetes applications and their data between two Kubernetes clusters. Here, a separate Portworx Enterprise cluster runs under each Kubernetes cluster.

The active Kubernetes cluster asynchronously backs-up apps, configuration and data to a standby Kubernetes cluster.
The standby Kubernetes cluster has running controllers, configuration and PVCs that map to a local volumes.
Incremental changes in Kubernetes applications and Portworx data are continuously sent to the standby cluster.

The list of supported Kubernetes resources can be found here If a custom CR that you need is not present in this list, you can register a new one. Refer to the Application Registration document for instructions on how to do this.

Enable load balancing on cloud clusters

If you’re running Kubernetes on the cloud, you must configure an External LoadBalancer (ELB) for the Portworx API service.

Warning: Do not enable load balancing without authorization enabled on the Portworx cluster.

Enable load balancing by entering the kubectl edit service command and changing the service type value from nodePort to loadBalancer:

kubectl edit service portworx-service -n kube-system

kind: Service
apiVersion: v1
metadata:
  name: portworx-service
  namespace: kube-system
  labels:
    name: portworx
spec:
  selector:
    name: portworx
  type: loadBalancer

Generate and Apply a ClusterPair Spec

In Kubernetes, you must define a trust object called ClusterPair. Portworx requires this object to communicate with the destination cluster. The ClusterPair object pairs the Portworx storage driver with the Kubernetes scheduler, allowing the volumes and resources to be migrated between clusters.

The ClusterPair is generated and used in the following way:

The ClusterPair spec is generated on the destination cluster.
The generated spec is then applied on the source cluster

Perform the following steps to create a cluster pair:

NOTE: You must run the pxctl commands in this document either on your Portworx nodes directly, or from inside the Portworx containers on your Kubernetes control plane node.

Create object store credentials for cloud clusters

You must create object store credentials on both the destination and source clusters before you can create a cluster pair. The options you use to create your object store credentials differ based on which object store you use:

Create Amazon s3 credentials

Find the UUID of your destination cluster
Enter the pxctl credentials create command, specifying the following:
- The --provider flag with the name of the cloud provider (s3).
- The --s3-access-key flag with your secret access key
- The --s3-secret-key flag with your access key ID
- The --s3-region flag with the name of the S3 region (us-east-1)
- The --s3-endpoint flag with the name of the endpoint (s3.amazonaws.com)
- The optional --s3-storage-class flag with either the STANDARD or STANDARD-IA value, depending on which storage class you prefer
- clusterPair_ with the UUID of your destination cluster. Enter the following command into your cluster to find its UUID:
```
PX_POD=$(kubectl get pods -l name=portworx -n kube-system -o jsonpath='{.items[0].metadata.name}')
kubectl exec $PX_POD -n kube-system --  /opt/pwx/bin/pxctl status | grep UUID | awk '{print $3}'
```
```
/opt/pwx/bin/pxctl credentials create \
--provider s3 \
--s3-access-key <aws_access_key> \
--s3-secret-key <aws_secret_key> \
--s3-region us-east-1  \
--s3-endpoint s3.amazonaws.com \
--s3-storage-class STANDARD \
clusterPair_<UUID_of_destination_cluster>
```

Create Microsoft Azure credentials

Find the UUID of your destination cluster

Enter the pxctl credentials create command, specifying the following:

--provider as azure
--azure-account-name with the name of your Azure account
--azure-account-key with your Azure account key

clusterPair_ with the UUID of your destination cluster appended. Enter the following command into your cluster to find its UUID:

PX_POD=$(kubectl get pods -l name=portworx -n kube-system -o jsonpath='{.items[0].metadata.name}')
kubectl exec $PX_POD -n kube-system --  /opt/pwx/bin/pxctl status | grep UUID | awk '{print $3}'

/opt/pwx/bin/pxctl credentials create \
--provider azure \
--azure-account-name <your_azure_account_name> \
--azure-account-key <your_azure_account_key> \
clusterPair_<UUID_of_destination_cluster>

Create Google Cloud Platform credentials

Find the UUID of your destination cluster

Enter the pxctl credentials create command, specifying the following:

--provider as google
--google-project-id with the string of your Google project ID
--google-json-key-file with the filename of your GCP JSON key file

clusterPair_ with the UUID of your destination cluster appended. Enter the following command into your cluster to find its UUID:

PX_POD=$(kubectl get pods -l name=portworx -n kube-system -o jsonpath='{.items[0].metadata.name}')
kubectl exec $PX_POD -n kube-system --  /opt/pwx/bin/pxctl status | grep UUID | awk '{print $3}'

/opt/pwx/bin/pxctl credentials create \
--provider google \
--google-project-id <your_google_project_ID> \
--google-json-key-file <your_GCP_JSON_key_file> \
clusterPair_<UUID_of_destination_cluster>

Generate a ClusterPair on the destination cluster

To generate the ClusterPair spec, run the following command on the destination cluster:

storkctl generate clusterpair -n <migrationnamespace> <remotecluster>

Here, remotecluster is the Kubernetes object that will be created on the source cluster representing the pair relationship, and migrationnamespace is the Kubernetes namespace of the source cluster that you want to migrate to the destination cluster.

During the actual migration, you will reference this name to identify the destination of your migration.

apiVersion: stork.libopenstorage.org/v1alpha1
kind: ClusterPair
metadata:
    creationTimestamp: null
    name: remotecluster
    namespace: migrationnamespace
spec:
   config:
      clusters:
         kubernetes:
            LocationOfOrigin: /etc/kubernetes/admin.conf
            certificate-authority-data: <CA_DATA>
            server: https://192.168.56.74:6443
      contexts:
         kubernetes-admin@kubernetes:
            LocationOfOrigin: /etc/kubernetes/admin.conf
            cluster: kubernetes
            user: kubernetes-admin
      current-context: kubernetes-admin@kubernetes
      preferences: {}
      users:
         kubernetes-admin:
            LocationOfOrigin: /etc/kubernetes/admin.conf
            client-certificate-data: <CLIENT_CERT_DATA>
            client-key-data: <CLIENT_KEY_DATA>
    options:
       <insert_storage_options_here>: ""
       mode: DisasterRecovery
status:
  remoteStorageId: ""
  schedulerStatus: ""
  storageStatus: ""

Save the resulting spec to a file named clusterpair.yaml.

Get the destination cluster token

On the destination cluster, run the following command from one of the Portworx nodes to get the cluster token. You’ll need this token in later steps:

pxctl cluster token show

Insert Storage Options

NOTE: When using ClusterPair in the context of Async DR, you must have a DR enabled Portworx license at both the source and destination cluster to enable disaster recovery mode. If you do not have these licenses, enabling disaster recovery mode will fail.

To pair storage specifying the following fields in the options section of your ClusterPair:

ip, with the IP address of the remote Portworx node
port, with the port of the remote Portworx node
token, the token of the destination cluster obtained fom the previous step.
mode: by default, every seventh migration is a full migration. If you specify mode: DisasterRecovery, then every migration is incremental. When doing a one time Migration (and not DR) this option can be skipped.

In the updated spec, ensure values for all fields under options are quoted.

Using Rancher Projects with ClusterPair

NOTE: If you are not using Rancher, skip to the next section.

Rancher has a concept of Projects that allow grouping of resources and Kubernetes namespaces. Depending on the resource and how it is created, Rancher adds the following label or annotation:

field.cattle.io/projectID: <project-short-UUID>

The projectID uniquely identifies the project, and the annotation or label on the Kubernetes object provides a way to tie a Kubernetes object back to a Rancher project.

From version 2.11.2 or newer, Stork has the capability to map projects from the source cluster to the destination cluster when it migrates Kubernetes resources. It will ensure that the following are transformed when migrating Kubernetes resources to a destination cluster: * Labels and annotations for projectID field.cattle.io/projectID on any Kubernetes resource on the source cluster are transformed to their respective projectIDs on the destination cluster. * Namespace Selectors on a NetworkPolicy object which refer to the field.cattle.io/projectID label will be transformed to their respective projectIDs on the destination cluster. * Namespace Selectors on a Pod object (Kubernetes version 1.24 or newer) which refer to the field.cattle.io/projectID label will be transformed to their respective projectIDs on the destination cluster.

NOTE:

Rancher project mappings are supported only with Stork version 2.11.2 or newer.
All the Rancher projects need to be created on both the source and the destination cluster.

While creating the ClusterPair, use the argument --project-mappings to indicate which projectID on the source cluster maps to a projectID on the destination cluster. For example:

storkctl generate clusterpair -n <migrationnamespace> <remotecluster> --project-mappings  <projectID-A1>=<projectID-A2>,<projectID-B1>: <projectID-B2>

The project mappings are provided as a comma-separate key=value pairs. In this example, projectID-A1 on source cluster maps to projectID-A2 on the destination cluster, while projectID-B1 on the source cluster maps to projectID-B2 on the destination cluster.

Apply the ClusterPair spec on the source cluster

A typical ClusterPair spec should like the following once you have followed the previous steps

apiVersion: stork.libopenstorage.org/v1alpha1
kind: ClusterPair
metadata:
  creationTimestamp: null
  name: remotecluster
spec:
  config:
    clusters:
      kubernetes:
        LocationOfOrigin: /etc/kubernetes/admin.conf
        certificate-authority-data: <CA_DATA>
        server: https://192.168.56.74:6443
    contexts:
      kubernetes-admin@kubernetes:
        LocationOfOrigin: /etc/kubernetes/admin.conf
        cluster: kubernetes
        user: kubernetes-admin
    current-context: kubernetes-admin@kubernetes
    preferences: {}
    users:
      kubernetes-admin:
        LocationOfOrigin: /etc/kubernetes/admin.conf
        client-certificate-data: <CLIENT_CERT_DATA>
        client-key-data: <CLIENT_KEY_DATA>
  options:
    ip:     <ip_of_remote_px_node>
    port:   <port_of_remote_px_node_default_9001>
    token:  <token_from_step_3>
    mode: DisasterRecovery
  platformOptions:
    # This section will be set only when using Rancher
    rancher:
      projectMappings:
        <projectID-A1>: <projectID-A2>
        <projectID-B1>: <projectID-B2>

status:
  remoteStorageId: ""
  schedulerStatus: ""
  storageStatus: ""

To create the ClusterPair, apply the ClusterPair YAML spec on the source cluster. Run the following command from a location where you have kubectl access to the source cluster:

kubectl apply -f clusterpair.yaml -n <namespace>

Verify the ClusterPair

To verify that you have generated the ClusterPair and that it is ready, run the following command:

storkctl -n <namespace> get clusterpair

NAME            STORAGE-STATUS   SCHEDULER-STATUS   CREATED
remotecluster   Ready            Ready              07 Mar 22 19:01 PST

On a successful pairing, you should see the STORAGE-STATUS and SCHEDULER-STATUS as Ready.

If you see an error instead, you can get more information by running the following command:

kubectl describe clusterpair remotecluster -n <namespace>

NOTE: You might need to perform additional steps if you are using GKE or EKS.

Schedule a migration

To schedule a migration, you must create a schedule policy or a namespaced schedule policy. The NamespacedSchedulePolicy is namespace-scoped while SchedulePolicy is cluster-scoped.

Create a schedule policy

Paste the following content into a file called testpolicy.yaml:

apiVersion: stork.libopenstorage.org/v1alpha1
kind: SchedulePolicy
metadata:
  name: testpolicy
policy:
  interval:
    intervalMinutes: 60
  daily:
    time: "10:14PM"
  weekly:
    day: "Thursday"
    time: "10:13PM"
  monthly:
    date: 14
    time: "8:05PM"

For details about how you can configure a schedule policy, see the Schedule Policy reference page.

Apply your spec by entering the following command:
```
kubectl apply -f testpolicy.yaml
```

Display your schedule policy. Enter the storkctl get command passing it the name of your policy:

storkctl get schedulepolicy

NAME           INTERVAL-MINUTES   DAILY     WEEKLY             MONTHLY
testpolicy     60                 10:14PM   Thursday@10:13PM   14@8:05PM

Create a namespaced schedule policy

Paste the following content into a file called namespaced-testpolicy.yaml:

apiVersion: stork.libopenstorage.org/v1alpha1
kind: NamespacedSchedulePolicy
metadata:
  name: testpolicy
  namespace: <namespace-for-sched-policy>
policy:
  interval:
    intervalMinutes: 60
  daily:
    time: "10:14PM"
  weekly:
    day: "Thursday"
    time: "10:13PM"
  monthly:
    date: 14
    time: "8:05PM"

Apply your spec by entering the following command:
```
kubectl apply -f namespaced-testpolicy.yaml
```
Display your namespacedschedule policy. Enter the kubectl -n <namespace-for-sched-policy> get command passing it the name of your policy:
```
kubectl -n <namespace-for-sched-policy>  get namespacedschedulepolicy
```
```
NAME           AGE
testpolicy     1s
```

Create a migration schedule

Once a schedule policy or namespaced schedule policy has been created, you can use it to schedule a migration. The spec for the MigrationSchedule spec contains the same fields as the Migration spec with the addition of the policy name. The MigrationSchedule object is namespaced like the Migration object. Stork will first look for namespaced schedule policy in the same namespace of migration/backup. If a namespaced schedule policy with the specified name is not found it will look for global SchedulePolicy with the same name.

Note that startApplications should be set to false in the spec. Otherwise, the first Migration will start the pods on the remote cluster and will succeed. But all subsequent migrations will fail since the volumes will be in use.

NOTE: If your cluster has a DR license applied to it, you can only perform migrations in DR mode; this includes operations involving the pxctl cluster migrate command.

Continuing our previous example with testpolicy, here is how to create a MigrationSchedule object that schedules a migration:

apiVersion: stork.libopenstorage.org/v1alpha1
kind: MigrationSchedule
metadata:
  name: mysqlmigrationschedule
  namespace: mysql
spec:
  template:
    spec:
      clusterPair: remotecluster
      includeResources: true
      startApplications: false
      namespaces:
      - mysql
  schedulePolicyName: testpolicy

If the policy name is missing or invalid there will be events logged against the schedule object. Success and failures of the migrations created by the schedule will also result in events being logged against the object. These events can be seen by running a kubectl describe on the object

The output of kubectl describe will also show the status of the migrations that were triggered for each of the policies along with the start and finish times. The statuses will be maintained for the last successful migration and any Failed or InProgress migrations for each policy type.

Let’s now run kubectl describe and see how the output would look like:

kubectl describe migrationschedules.stork.libopenstorage.org -n mysql

Name:         mysqlmigrationschedule

Namespace:    mysql
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"stork.libopenstorage.org/v1alpha1","kind":"MigrationSchedule","metadata":{"annotations":{},"name":"mysqlmigrationschedule",...
API Version:  stork.libopenstorage.org/v1alpha1
Kind:         MigrationSchedule
Metadata:
  Creation Timestamp:  2019-02-14T04:53:58Z
  Generation:          1
  Resource Version:    30206628
  Self Link:           /apis/stork.libopenstorage.org/v1alpha1/namespaces/mysql/migrationschedules/mysqlmigrationschedule
  UID:                 8a245c1d-3014-11e9-8d3e-0214683e8447
Spec:
  Schedule Policy Name:  daily
  Template:
    Spec:
      Cluster Pair:       remotecluster
      Include Resources:  true
      Namespaces:
        mysql
      Post Exec Rule:
      Pre Exec Rule:
      Selectors:           <nil>
      Start Applications:  false
Status:
  Items:
    Daily:
      Creation Timestamp:  2019-02-14T22:16:51Z
      Finish Timestamp:    2019-02-14T22:19:51Z
      Name:                mysqlmigrationschedule-daily-2019-02-14-221651
      Status:              Successful
    Interval:
      Creation Timestamp:  2019-02-16T00:40:52Z
      Finish Timestamp:    2019-02-16T00:41:52Z
      Name:                mysqlmigrationschedule-interval-2019-02-16-004052
      Status:              Successful
      Creation Timestamp:  2019-02-16T00:41:52Z
      Finish Timestamp:    <nil>
      Name:                mysqlmigrationschedule-interval-2019-02-16-004152
      Status:              InProgress
    Monthly:
      Creation Timestamp:  2019-02-14T20:05:41Z
      Finish Timestamp:    2019-02-14T20:07:41Z
      Name:                mysqlmigrationschedule-monthly-2019-02-14-200541
      Status:              Successful
    Weekly:
      Creation Timestamp:  2019-02-14T22:13:51Z
      Finish Timestamp:    2019-02-14T22:16:51Z
      Name:                mysqlmigrationschedule-weekly-2019-02-14-221351
      Status:              Successful
Events:
  Type    Reason      Age                    From   Message
  ----    ------      ----                   ----   -------
  Normal  Successful  4m55s (x53 over 164m)  stork  (combined from similar events): Scheduled migration (mysqlmigrationschedule-interval-2019-02-16-003652) completed successfully

Each migration is associated with a Migrations object. To get the most important information, type:

kubectl get migration -n mysql

NAME AGE
mysqlmigrationschedule-daily-2019-02-14-221651 1d
mysqlmigrationschedule-interval-2019-02-16-004052 5m
mysqlmigrationschedule-interval-2019-02-16-004152 4m
mysqlmigrationschedule-monthly-2019-02-14-200541 1d
mysqlmigrationschedule-weekly-2019-02-14-221351 1d

Once the MigrationSchedule object is deleted, all the associated Migration objects should be deleted as well.

Failover an application

For instructions on how to failover an application, follow the steps from Metro DR to Stop the application on the source cluster and then Start the application on the destination cluster.

Clean up disaster recovery objects

If you no longer require a disaster recovery object, you can delete it.

To delete a migration schedule, run the following command:

kubectl delete migrationschedule mysqlmigrationschedule -n mysql

To delete a namespaced policy, run the following command:

kubectl delete namespacedschedulepolicy testpolicy -n mysql

To delete a cluster pair, run the following command:

kubectl delete clusterpair remotecluster -n mysql

Supported Kubernetes Resources

The Asynchronous DR feature supports the following Kubernetes resources:

PersistentVolumeClaim
PersistentVolume
Deployment
DeploymentConfig
StatefulSet
ConfigMap
Service
Secret
DaemonSet
ServiceAccount
Role
RoleBinding
ClusterRole
ClusterRoleBinding
ImageStream
Ingress
Route
Template
CronJob
ResourceQuota
ReplicaSet
LimitRange
PodDisruptionBudget
NetworkPolicy

NOTE: By default, Stork skips migrating NetworkPolicies which have CIDR set. To migrate NetworkPolicies which have CIDR set, use the skipNetworkPolicyCheck: true flag in the Migration object.

Asynchronous DR also supports the following CRDs out-of-the-box:

CassandraDatacenter
CouchbaseBucket
CouchbaseCluster
CouchbaseEphemeralBucket
CouchbaseMemcachedBucket
CouchbaseReplication
CouchbaseUser
CouchbaseGroup
CouchbaseRoleBinding
CouchbaseBackup
CouchbaseBackupRestore
IBPCA
IBPConsole
IBPOrderer
IBPPeer
RedisEnterpriseCluster
RedisEnterpriseDatabase

Asynchronous DR

Prerequisites

Overview

Enable load balancing on cloud clusters

Generate and Apply a ClusterPair Spec

Create object store credentials for cloud clusters

Create Amazon s3 credentials

Create Microsoft Azure credentials

Create Google Cloud Platform credentials

Generate a ClusterPair on the destination cluster

Get the destination cluster token

Insert Storage Options

Using Rancher Projects with ClusterPair

Apply the ClusterPair spec on the source cluster

Verify the ClusterPair

Schedule a migration

Create a schedule policy

Create a namespaced schedule policy

Create a migration schedule

Failover an application

Clean up disaster recovery objects

Supported Kubernetes Resources

Set up cross-cloud application migration from Google Cloud to Microsoft Azure with Portworx on OpenShift 4.2

Set up multi-cloud disaster recovery with Rancher Kubernetes Engine and Portworx

Asynchronous DR for Postgres on Rancher Kubernetes Engine

Set up multi-cloud and multi-cluster data movement with Portworx on Openshift

Asynchronous DR

Prerequisites

Overview

Enable load balancing on cloud clusters

Generate and Apply a ClusterPair Spec

Create object store credentials for cloud clusters

Create Amazon s3 credentials

Create Microsoft Azure credentials

Create Google Cloud Platform credentials

Generate a ClusterPair on the destination cluster

Get the destination cluster token

Insert Storage Options

Using Rancher Projects with ClusterPair

Apply the ClusterPair spec on the source cluster

Verify the ClusterPair

Schedule a migration

Create a schedule policy

Create a namespaced schedule policy

Create a migration schedule

Failover an application

Clean up disaster recovery objects

Supported Kubernetes Resources

Related videos

Set up cross-cloud application migration from Google Cloud to Microsoft Azure with Portworx on OpenShift 4.2

Set up multi-cloud disaster recovery with Rancher Kubernetes Engine and Portworx

Asynchronous DR for Postgres on Rancher Kubernetes Engine

Set up multi-cloud and multi-cluster data movement with Portworx on Openshift