# Velero on OCI OKE: Complete Kubernetes Backup, Restore & Scheduled Backup Guide (Production Ready)

Kubernetes workloads running on **Oracle Kubernetes Engine (OKE)** require a reliable backup and disaster recovery strategy. **Velero** is one of the most trusted open-source tools to back up and restore Kubernetes cluster resources and persistent volumes.

In this guide, you’ll learn how to:

*   Install Velero on OKE
    
*   Configure OCI Object Storage (S3-compatible)
    
*   Take namespace backups (e.g., monitoring)
    
*   Restore workloads
    
*   Set up production-grade scheduled backups
    

## Why Use Velero on OKE?

Velero provides:

*   Backup & restore of Kubernetes resources
    
*   Disaster recovery for namespaces and apps
    
*   Migration between clusters
    
*   Scheduled backups (cron-based)
    
*   OCI Object Storage integration (S3-compatible API)
    

## Architecture Overview

Velero works by:

1.  Backing up Kubernetes objects (YAML manifests)
    
2.  Storing them in **OCI Object Storage bucket**
    
3.  Optionally backing up volumes (via node-agent or snapshots)
    

## Prerequisites

Before installing Velero:

*   OKE Cluster up and running
    
*   `kubectl` and `velero` binary configured
    
*   OCI Object Storage bucket created
    
*   S3-compatible credentials file (`/root/credentials-velero`
    

IAM Permissions

```plaintext
Allow group <Group-Name>to manage object-family in tenancy
Allow group <Group-Name> to manage object-family in compartment <compartment_name>
```

### Install Velero on OKE (OCI Object Storage)

Run the following command:

```plaintext
# Create credentials file
cat > /root/credentials-velero << EOF
[default]
aws_access_key_id = your_oci_access_key
aws_secret_access_key = your_oci_secret_key
EOF

# Install Velero
velero install \
  --provider aws \
  --image docker.io/velero/velero:v1.16.2 \
  --plugins docker.io/velero/velero-plugin-for-aws:v1.12.2 \
  --bucket Velero-Backup \
  --prefix OKE-DEMO-DEV \
  --use-volume-snapshots=false \
  --secret-file /root/credentials-velero \
  --backup-location-config \
    region=<region>,s3ForcePathStyle=true,s3Url=https://<namespace>.compat.objectstorage.<region>.oraclecloud.com \
  --use-node-agent \
  --wait
```

Important Tip (Production Naming)

```plaintext
--prefix OKE-DEMO-DEV
```

Replace this with meaningful naming like:

*   Cluster name
    
*   Environment (prod/dev)
    
*   Tenancy namespace
    

Example:

```plaintext
--prefix OKE-DEMO-DEV
```

## Verify Backup Storage Location

After installation, verify:

```plaintext
velero backup-location get

[root@demo ~]# velero backup-location get
NAME      PROVIDER   BUCKET/PREFIX                PHASE       LAST VALIDATED                  ACCESS MODE   DEFAULT
default   aws        Velero-Backup/OKE-DEMO-DEV   Available   2026-04-21 12:29:27 +0000 GMT   ReadWrite     true
[root@demo ~]#
```

Expected output:

*   PHASE : `Available`
    
*   ACCESS MODE: `ReadWrite`
    
*   DEFAULT: `true`
    

If not available → check IAM Permissions, credentials, bucket name, or endpoint.

### Backup Kubernetes Namespaces (Monitoring Example)

Backup Monitoring Namespace

```plaintext
velero backup create monitoring-app --include-namespaces monitoring
```

### Verify Backup Status

```plaintext
[root@demo ~]# velero backup get
NAME             STATUS      ERRORS   WARNINGS   CREATED                         EXPIRES   STORAGE LOCATION   QUEUE POSITION   SELECTOR
monitoring-app   Completed   0        0          2026-04-21 10:09:03 +0000 GMT   29d       default                             <none>
[root@demo ~]#
```

Check details:

```plaintext
velero backup describe monitoring-app
```

Quick status check:

```plaintext
[root@demo ~]# velero backup describe monitoring-app | grep Phase:
Phase:  Completed
[root@demo ~]#
```

Expected:

```plaintext
Phase: Completed
```

### Restore Namespace from Backup

To restore the monitoring namespace:

```plaintext
velero restore create --from-backup monitoring-app
```

Restore with Namespace Mapping (Optional)

```plaintext
velero restore create \
  --from-backup monitoring-app \
  --namespace-mappings monitoring=monitoring-restore
```

### Production-Grade Scheduled Backups

Manual backups are not enough for production. Use Velero schedules.

Daily Backup (Production) velero schedule create monitoring-daily  
\--schedule "0 2 \* \* \*"  
\--include-namespaces monitoring  
\--ttl 168h

Runs daily at 2 AM & Retains backups for 7 days

Weekly Full Backup velero schedule create full-weekly  
\--schedule "0 1 \* \* 0"  
\--ttl 720h

This Runs every Sunday & Retains for 30 days

### Best Practices for Production (OKE + Velero)

### 1\. Naming Convention

Use structured prefixes:

```plaintext
prod-oke-cluster1
dev-oke-cluster1
```

### 2\. Backup Strategy

| Type | Frequency | Retention |
| --- | --- | --- |
| Namespace (monitoring) | Daily | 7 days |
| Full cluster | Weekly | 30 days |
| Critical apps | Hourly (optional) | 24 hours |

### 3\. Security

*   Store credentials securely
    
*   Use OCI IAM policies
    
*   Restrict bucket access
    

### 4\. Testing Restore (VERY IMPORTANT)

Always test:

```plaintext
velero restore create --from-backup monitoring-app
```

Backup without restore testing = risk

### 5\. Monitoring Velero

Check logs:

```plaintext
kubectl logs deployment/velero -n velero
```