AKS备份与恢复的Terraform实现全流程技术咨询

一、Terraform分步实现流程 #

1. 订阅级别注册必要资源提供者 #

注册AKS备份相关的核心资源提供者：

resource "azurerm_resource_provider" "kubernetes_configuration" {
  name = "Microsoft.KubernetesConfiguration"
}

resource "azurerm_resource_provider" "recovery_services" {
  name = "Microsoft.RecoveryServices"
}

resource "azurerm_resource_provider" "container_service" {
  name = "Microsoft.ContainerService"
}

2. 为AKS集群启用CSI驱动与快照功能 #

在AKS集群配置中开启CSI相关组件：

resource "azurerm_kubernetes_cluster" "aks_cluster" {
  # 集群基础配置（名称、资源组、节点池等）...

  addon_profile {
    azure_csi_blob_driver {
      enabled = true
    }

    csi_snapshot_controller {
      enabled = true
    }
  }
}

3. 创建存储账户、Blob容器并配置可信访问 #

创建存储资源，为备份扩展分配必要的存储权限：

# 存储账户
resource "azurerm_storage_account" "backup_storage" {
  name                     = "aksbackupstorage"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
}

# Blob容器
resource "azurerm_storage_container" "backup_container" {
  name                  = "aks-backup-container"
  storage_account_name  = azurerm_storage_account.backup_storage.name
  container_access_type = "private"
}

# 为备份扩展的系统标识分配存储Blob数据贡献者权限
resource "azurerm_role_assignment" "backup_storage_access" {
  scope                = azurerm_storage_account.backup_storage.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_kubernetes_cluster_extension.aks_backup.identity[0].principal_id
}

4. 创建备份保管库 #

用于存储备份元数据和恢复点的Recovery Services保管库：

resource "azurerm_recovery_services_vault" "backup_vault" {
  name                = "aks-backup-vault"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Standard"
}

5. 创建AKS备份扩展 #

指定官方扩展类型并配置核心参数：

resource "azurerm_kubernetes_cluster_extension" "aks_backup" {
  name                 = "aks-backup-extension"
  kubernetes_cluster_id = azurerm_kubernetes_cluster.aks_cluster.id
  extension_type       = "AzureBackupForKubernetes"
  publisher            = "Microsoft.DataProtection"

  configuration_settings = {
    storageAccountId         = azurerm_storage_account.backup_storage.id
    blobContainerName        = azurerm_storage_container.backup_container.name
    enableResticIntegration  = "true"
  }

  identity {
    type = "SystemAssigned"
  }
}

6. 创建备份策略 #

定义备份频率、保留周期等规则：

resource "azurerm_recovery_services_backup_policy_aks" "aks_backup_policy" {
  name                = "aks-backup-policy"
  recovery_vault_id   = azurerm_recovery_services_vault.backup_vault.id
  timezone            = "UTC"

  backup {
    frequency = "Daily"
    time      = "02:00"
  }

  retention_daily {
    count = 7
  }

  retention_weekly {
    count    = 4
    weekdays = ["Sunday"]
  }
}

7. 配置AKS集群备份 #

关联集群、保管库与备份策略，启用备份保护：

resource "azurerm_recovery_services_protected_aks_cluster" "protected_aks" {
  name                = "protected-aks-cluster"
  recovery_vault_id   = azurerm_recovery_services_vault.backup_vault.id
  aks_cluster_id      = azurerm_kubernetes_cluster.aks_cluster.id
  backup_policy_id    = azurerm_recovery_services_backup_policy_aks.aks_backup_policy.id
}

二、常见问题解答 #

1. AKS Backup对应的extension_type是什么？ #

AKS备份扩展的官方extension_type为：AzureBackupForKubernetes，发布者固定为Microsoft.DataProtection。

2. 如何定义configuration_settings值？ #

configuration_settings用于传递备份扩展的核心配置，常用参数包括：

• storageAccountId：备份数据存储的存储账户ID
• blobContainerName：存储备份的Blob容器名称
• enableResticIntegration：是否启用Restic集成（用于备份持久卷，取值true或false）
• backupTimeoutInMinutes：备份超时时间（可选，默认120分钟）

具体配置示例可参考上述备份扩展创建代码。

3. 如何通过Terraform在订阅级别注册Microsoft.KubernetesConfiguration资源提供者？ #

直接使用azurerm_resource_provider资源完成注册：

resource "azurerm_resource_provider" "kubernetes_configuration" {
  name = "Microsoft.KubernetesConfiguration"
}

执行terraform apply后，该资源提供者会被注册到当前订阅中。

内容的提问来源于stack exchange，提问作者Bokambo