Learn Velero - CSI Snapshot & Cross-provider

#Introduction

In episode 8, we covered cloud snapshots only as "native" EBS/PD snapshots handled by the provider plugin. But the modern storage world doesn't stop there: CSI (Container Storage Interface) lets volumes from dozens of providers — from Rook Ceph and Portworx to NFS drivers — be used as persistent volumes in Kubernetes. Velero must be able to back up all of them. Episode 19 covers how: CSI snapshots.

Imagine backing up the contents of archive shelves in different buildings (EBS, PD, Azure Disk, Ceph). Old provider plugins only know specific buildings. A CSI snapshot is the "standard container" that can pull out shelf contents in any building — as long as that building has a standard door (VolumeSnapshotClass).

#CSI Snapshots in Velero

#The Concept

Since Velero 1.14, CSI support is stable. The flow: Velero creates a VolumeSnapshot object (a Kubernetes CRD from external-snapshotter), then the CSI driver — not Velero — creates the actual snapshot. This moves the snapshot work from the Velero plugin to the established CSI ecosystem.

Cluster prerequisites:

• external-snapshotter (the volumesnapshotclasses, volumesnapshots, volumecontentsnapshots CRDs) is installed.
• A VolumeSnapshotClass is available for your PVCs' storage class.
• Velero is installed with the CSI plugin.

#VolumeSnapshotClass

Create/check the VolumeSnapshotClass for the storage your PVC uses:

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: csi-snapclass
driver: rbd.csi.ceph.com
deletionPolicy: Retain

deletionPolicy: Retain is important: the snapshot survives even if the VolumeSnapshot object is deleted — protecting against accidental deletion.

#Install the CSI Plugin

velero plugin add velero/velero-plugin-for-csi:v0.10.0

#Backup with CSI Snapshots

velero backup create csi-backup \
  --include-namespaces app \
  --snapshot-volumes=true

Velero processes every PVC with an available VolumeSnapshotClass, creates the VolumeSnapshot, and records it in the backup. On restore, Velero creates new PVCs and restores the snapshots via the CSI driver.

#File-level Backup for CSI Volumes

Not every CSI driver provides a compatible VolumeSnapshotClass. If none exists, the safe path is file-level backup (kopia) — completely independent of the driver's snapshot features:

velero backup create csi-fs-backup \
  --include-namespaces app \
  --default-volumes-to-fs-backup

File-level backup copies the volume's file contents to the BSL. Slower, but it works for all volume types.

#Cross-provider: Moving Volumes Between Clouds

#The Problem

Snapshots are cloud-specific: an EBS snapshot can't become a GCP PD. Cross-cloud, you must use a path both sides can read — and the only portable one is file-level backup on a shared BSL.

#Strategy 1: File-level (Recommended)

# On the AWS cluster: file-level backup
velero backup create cross-migrate --include-namespaces app --default-volumes-to-fs-backup
 
# On the GCP cluster: restore with the same BSL (S3 bucket read via interop)
velero restore create cross-restore --from-backup cross-migrate \
  --storage-class-mappings gp2:standard-rwo

The volume data moves as plain files. --storage-class-mappings adapts the destination storage class (episodes 10-11).

#Strategy 2: Snapshot Conversion

For certain cases (very large data, limited time), you can combine: snapshot in the source cloud → create a volume → file-level backup → restore in the destination cloud. In practice this is "snapshot as an intermediary" to speed up reading, not carrying the snapshot itself.

#Limitations You Should Know

• CSI snapshots aren't cross-cloud: a Ceph snapshot can't become an EBS. Cross-cloud always goes through file-level.
• Region: regular snapshots are region-bound; file-level is region-free (a BSL in any region can be read).
• Speed: file-level for large volumes takes time — plan RTO with real numbers (episode 12).

#Closing

Key takeaways:

• CSI snapshots use VolumeSnapshotClass + external-snapshotter; stable in Velero since 1.14.
• Back up CSI volumes: install the CSI plugin, make sure a VolumeSnapshotClass exists, --snapshot-volumes=true.
• Without a matching snapshot class, use file-level (kopia), which works for all volume types.
• Cross-provider: file-level backup on a shared BSL is the only portable path; snapshots don't cross clouds.
• Always combine with --storage-class-mappings when storage classes differ.

In episode 20 next, we measure and optimize: Performance & Data Management — tuning parallelism, Velero pod resource limits and node-agent scaling, plus analyzing and exporting backup sizes.