Velero

Kubernetes backup, restore, and migration tool. Velero saves cluster resource state (Deployments, Services, ConfigMaps, PVCs) and optionally PVC data to S3-compatible object storage. It supports recurring backup schedules, TTL-based expiration, and namespace-scoped or cluster-wide backup policies.

Key Features

• Cluster-scoped backup — saves Kubernetes resources and optionally PVC data to S3
• Kopia filesystem backup — uploaderType: kopia (modern replacement for Restic)
• Scheduled backups — Schedule resources rendered directly from chart values
• TTL-based expiration — backups expire automatically (default 7 days)
• Node-agent DaemonSet — optional filesystem backup for PVC data inclusion
• S3-compatible storage — validated with the AWS plugin for MinIO and AWS S3
• Restore-only mode — lock a cluster to restores only (useful for DR environments)
• Prometheus metrics — metrics Service enabled by default and optional ServiceMonitor
• Restricted server and plugin containers — non-root identities, read-only root filesystems, dropped capabilities, blocked privilege escalation, and RuntimeDefault seccomp
• NetworkPolicy enabled by default — ingress is limited to the metrics listener
• Configurable metrics listener — the process port, probes, and named Service target stay aligned

Installation

Velero requires cluster-wide permissions and is typically deployed in a dedicated namespace:

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install velero helmforge/velero -n velero --create-namespace -f values.yaml

OCI registry:

helm install velero oci://ghcr.io/helmforgedev/helm/velero -n velero --create-namespace -f values.yaml

Deployment Examples

# values.yaml — Velero backing up Kubernetes resources only (no PVC data)
# This is the default behavior. PVC contents are NOT included.
credentials:
  existingSecret: velero-s3-credentials # must contain 'cloud' key with AWS-format credentials

configuration:
  defaultBackupTTL: 720h # 30 days
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

# values.yaml — Full cluster backup including PVC data via node-agent
# Requires node-agent DaemonSet and uses Kopia for filesystem-level backup.
credentials:
  existingSecret: velero-s3-credentials

configuration:
  defaultBackupTTL: 720h
  defaultVolumesToFsBackup: true # include PVC data in all backups by default
  uploaderType: kopia
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

nodeAgent:
  enabled: true
  resources:
    requests:
      memory: 128Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 500m

# values.yaml — Scheduled daily and weekly backups with different TTLs
credentials:
  existingSecret: velero-s3-credentials

configuration:
  defaultBackupTTL: 168h # 7 days default
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: us-east-1
        # s3Url not needed for real AWS S3

nodeAgent:
  enabled: true

schedules:
  - name: daily
    schedule: '0 3 * * *'
    template:
      ttl: 168h # 7 days
      includedNamespaces:
        - default
        - apps
      defaultVolumesToFsBackup: true
      snapshotVolumes: false

  - name: weekly
    schedule: '0 2 * * 0'
    template:
      ttl: 720h # 30 days
      includedNamespaces: [] # empty = all namespaces
      defaultVolumesToFsBackup: true

# values.yaml — DR environment: Velero locked to restore-only mode
# Use this on a secondary cluster that only receives restores, never creates backups.
credentials:
  existingSecret: velero-s3-credentials

configuration:
  restoreOnlyMode: true
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      accessMode: ReadOnly # read-only on DR side
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

S3 Credentials Format

Velero uses an AWS credentials file format regardless of the S3 provider (including MinIO). The credentials.secretContents field contains the full file content:

[default]
aws_access_key_id=your-access-key
aws_secret_access_key=your-secret-key

For production, store credentials in a pre-created Kubernetes Secret and reference it with credentials.existingSecret:

kubectl create secret generic velero-s3-credentials \
  --from-literal=cloud='[default]
aws_access_key_id=your-access-key
aws_secret_access_key=your-secret-key' \
  -n velero

For backup storage that requires cloud credentials, set credentials.useSecret=true and provide one of credentials.existingSecret, credentials.name, or credentials.secretContents so the Velero pods mount /credentials.

Dual-stack Networking

The metrics Service supports Kubernetes dual-stack fields through service.ipFamilyPolicy and service.ipFamilies. Defaults omit both fields so the cluster default remains authoritative.

service:
  ipFamilyPolicy: PreferDualStack

Use PreferDualStack without service.ipFamilies when the same values file may run on both single-stack and dual-stack clusters. Set service.ipFamilies only when the target cluster advertises the requested families.

Security Boundary

The Velero server and default AWS plugin run as the non-root identities declared by their official images. Their containers use read-only root filesystems, drop every Linux capability, block privilege escalation, and use RuntimeDefault seccomp. Writable emptyDir volumes are mounted at /scratch, /plugins, and /tmp; Velero uses /tmp for plugin process files.

When the node-agent uses the default Kopia uploader, both the server and node-agent also receive ephemeral writable volumes at /home/cnb/udmrepo and /home/cnb/.cache. This keeps the rest of each root filesystem read-only while supporting filesystem backups activated globally, by schedule, or by annotation.

The node-agent is the intentional exception: filesystem backup needs kubelet host-path access, so it runs as UID 0. It remains unprivileged, drops all capabilities, blocks privilege escalation, and uses a read-only root filesystem. Enable it only after reviewing Pod Security admission, hostPath policy, and node isolation.

Velero needs its ServiceAccount token and cluster-wide API access to back up and restore Kubernetes resources. The default ClusterRoleBinding targets cluster-admin. Set rbac.create: false only when equivalent, reviewed RBAC is managed outside the chart.

The default NetworkPolicy selects only the server and allows inbound traffic only to the metrics port. Egress remains open because Kubernetes API, DNS, and object-storage destinations are environment-specific. Set networkPolicy.allowExternalEgress: false before adding a restrictive server egress policy; NetworkPolicy rules are additive, so leaving the chart’s allow-all rule enabled defeats a second restrictive policy. Restrict node-agent networking separately when it is enabled.

Operations

Changing metrics.containerPort changes the Velero --metrics-address argument, container port, and all three TCP probes. metrics.service.port is independent and changes only the Service-facing port; the Service uses the named metrics target port.

Charts before 1.6 used configuration.metricsAddress and extraObjects. Retained values using those names remain supported: the legacy metrics address controls the process listener and legacy objects render together with extraManifests. Migrate to metrics.containerPort and extraManifests when editing the configuration.

Before relying on backups, verify that the Deployment is ready and every configured backup storage location is available:

kubectl rollout status deployment/velero -n velero
kubectl get backupstoragelocations.velero.io -n velero
kubectl logs deployment/velero -n velero --since=15m

A successful backup is not a recovery test. Perform scheduled restores into an isolated namespace or cluster and verify application data there. Helm does not remove or roll back Velero CRDs automatically, so review CRD changes separately during upgrades.

Configuration Reference

Core

Image

Plugins

Credentials

RBAC

Configuration

Backup Storage Locations

The default entry uses the AWS plugin in S3-compatible mode. For real AWS S3, omit s3Url.

Schedules

Schedules are rendered as Velero Schedule CRDs. The template.ttl in each schedule overrides the server-level defaultBackupTTL.

Node Agent (Filesystem Backup)

Metrics

Service Networking

Resources and Security

Probes and Network Policy

Service Account

Scheduling

Extra

More Information

Velero v1.18.4 fixes a backup queue that could remain stuck when a dequeued backup completed during its status patch. Review the upstream release before upgrading production recovery infrastructure.

• Velero Official Website
• Velero Documentation
• Velero GitHub Repository
• HelmForge Velero Operations Guide
• HelmForge Velero Security Guide
• HelmForge Velero Chart Source