Configuring external storage in ECS for DRS automatic backups

Before you initiate DRS automatic backups, you must ensure that the prerequisite activities are completed along with the required additional configuration for external storage in Longhorn.

Complete the following prerequisites:
1. Ensure that the following requirements are met depending on the storage you choose for DRS automatic backups:
  - An S3 compatible storage, such as Ozone, must be available in the base cluster. You must have the required access key and secret to the storage, and the provisioned bucket must have a minimum of 5 TB storage space.
  - An NFS v4 storage must have a minimum of 5 TB of free space.
2. You must have SSH access to the base cluster node.
  
  note
  If you are using Ozone storage, ensure that you have the SSH access to the base cluster running the S3 gateway service.
3. You must have SSH access to the ECS master node.
  tip
  After you log into the terminal of the master node, run the following commands to access kubectl utility:
  
  export PATH="/var/lib/rancher/rke2/bin:/opt/cloudera/parcels/ECS/docker/:$PATH"
  
  export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
Perform the following steps to change the default volume snapshot class value from snap (this value saves snapshots in the in-cluster storage in Longhorn) to bak (this value saves snapshots in the external storage in Longhorn):
1. Run the kubectl edit vsclass longhorn kubectl command.
2. Change the type parameter to bak as shown in the following sample snippet:
```
apiVersion: snapshot.storage.k8s.io/v1
deletionPolicy: Delete
driver: driver.longhorn.io
kind: VolumeSnapshotClass
metadata:
name: longhorn
parameters:
type: bak
```
Complete the following steps if you are using Ozone S3 storage in Longhorn:
1. Run the scp root@[***BASE CLUSTER HOST***]:/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_cacerts.pem command to obtain the TLS certificate for Ozone.
  DRS uses this certificate to communicate with the S3 gateway service using HTTPS.
2. Create a secret that Longhorn can use for S3 access. To accomplish this task, you must have the S3 access key, S3 secret, S3 endpoint, and S3 certificate for Ozone storage. You must also enable a virtual host to use the S3 compatible endpoint (Ozone).
  The following sample snippet shows the kubectl command to create a secret:
```
kubectl create secret generic ozone-secret 
--from-literal=AWS_ACCESS_KEY_ID=s3g/drs1-1.drs1.root.hwx.site@ROOT.HWX.SITE
--from-literal=AWS_SECRET_ACCESS_KEY=9d9e46cc77bb510821f0dbc42c584a8b7482b51dec9d3eb63c
--from-literal=AWS_ENDPOINTS=https://drs1.root.hwx.site:9879/longhorn
--from-literal=VIRTUAL_HOSTED_STYLE=true --from-file=AWS_CERT=cm-auto-global_cacerts.pem
-n longhorn-system
```
  For more information, see Longhorn documentation.
  tip
  Longhorn’s URL is built using a combination of the AWS_ENDPOINTS value and the S3 virtual path as explained in Step 5.
Run the kubectl edit deploy cdp-release-thunderhead-drsprovider -n cdp-drs command, and set the TAKE_PVC_CLONE environment value to false.
This step ensures that the backups do not create a PVC clone for external snapshot.
By default, Longhorn configuration is set to in-cluster storage and this storage requires a PVC copy to perform the DRS restore operation (DRS uses CSI snapshot technology). Therefore, to use the external storage, you must configure the volume snapshot class to bak and then configure the TAKE_PVC_CLONE environment value to false.
Configure the volume for NFS storage or bucket for Ozone S3 (on the Setting > General page) in the Longhorn UI to save the backups.
1. Enter the nfs://… URL in the Backup Target field if you are using NFS storage.
2. Enter the required values in the following fields if you are using Ozone S3 storage:
  - s3://[***BUCKET***]@[***DUMMYREGION***]/ URL in the Backup Target field. For example, s3://drs1-1@cdp/.
  - [***SECRET THAT YOU GENERATED IN STEP 3B***] in the Backup Target Credential Secret. For example, ozone-secret.
  The s3://[***BUCKET***]@[***DUMMYREGION***]/ URL is a virtual S3 URL that you can create using the original Ozone S3 URL, where,
  - bucket is the hostname. Longhorn prefixes the AWS_ENDPOINTS to the bucket value. For example, the sample snippet in Step 3 shows the hostname value as drs1-1.drs1.root.hwx.site. In this instance, drs1-1 is the bucket name and the rest of the hostname drs1.root.hwx.site is the AWS_ENDPOINTS hostname.
  - dummyregion can be any value and is not used.
Troubleshooting: To verify whether Longhorn successfully registered the Ozone S3 credential secret, click the Backup page. No errors must appear on the page.
If any error or message appears about the secret and the certificate having newlines or space, run the kubectl edit lhs backup-target-credential-secret -n longhorn-system command and set the value to the secret you created in Step 3b.

Initiate the DRS automatic backups using the updateAutoBackupPolicy CDP CLI command. Alternatively, you can edit the “automatic-backup” (a Kubernetes cron job) to initiate the DRS automatic backups.