Learn Velero - Installation & BSL Configuration

#Introduction

In episode 2 we learned Velero's anatomy: server, CLI, CRDs, and plugins. Now it's time to install everything into the cluster and connect it to object storage. This is the most decisive episode: a BackupStorageLocation misconfiguration here will cause failed backups in the episodes that follow. We use Velero 1.18.

#Preparing Credentials

Velero needs credentials to access object storage. Create a MinIO credential file (it also works for S3 since the two are compatible):

[default]
aws_access_key_id = minioadmin
aws_secret_access_key = minioadmin

For real AWS S3, fill in the access key/secret key of an IAM user; GCS uses a service account JSON. Secure credential patterns (IRSA/Workload Identity) are covered in episode 13.

#Installing with velero install

#MinIO (Local)

The core command:

velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.14.0 \
  --bucket velero \
  --secret-file ./credentials-velero \
  --backup-location-config region=minio,s3ForcePathStyle=true,s3Url=http://localhost:9000,insecureSkipTLSVerify=true \
  --use-volume-snapshots=false \
  --use-node-agent \
  --uploader-type=kopia \
  --default-volumes-to-fs-backup

Key points about the flags above:

• --provider aws + AWS plugin — MinIO is compatible with the S3 API.
• s3ForcePathStyle=true — MinIO uses path-style URLs (host/bucket/key), not virtual-host style.
• s3Url=http://localhost:9000 + insecureSkipTLSVerify=true — MinIO endpoint without TLS; only safe for a lab.
• --use-volume-snapshots=false — MinIO can't create cloud snapshots, so the VSL is turned off.
• --use-node-agent --uploader-type=kopia — file-level backup with kopia (the new default in Velero 1.18).
• --default-volumes-to-fs-backup — automatically back up all volumes via the node-agent.

#AWS S3

For real S3, the command pattern is the same — replace s3Url/insecureSkipTLSVerify with --backup-location-config region=us-east-1, add --snapshot-location-config region=us-east-1, and drop --use-volume-snapshots=false:

velero install --provider aws --plugins velero/velero-plugin-for-aws:v1.14.0 \
  --bucket my-velero-backups --secret-file ./credentials-velero \
  --backup-location-config region=us-east-1 \
  --snapshot-location-config region=us-east-1

--snapshot-location-config also creates a default VolumeSnapshotLocation for EBS snapshots — fast, while file-level kopia remains available for other scenarios.

#Installing with the Helm Chart

For GitOps and centralized configuration, use the vmware-tanzu/velero Helm chart:

helm repo add vmware-tanzu https://vmware-tanzu.github.io/helm-charts
helm repo update
helm install velero vmware-tanzu/velero \
  --namespace velero --create-namespace \
  -f values.yaml

Example values.yaml for MinIO:

credentials:
  existingSecret: velero-secret
configuration:
  provider: aws
  backupStorageLocation:
    name: default
    bucket: velero
    config:
      region: minio
      s3ForcePathStyle: true
      s3Url: http://minio:9000
      insecureSkipTLSVerify: true
  uploaderType: kopia
initContainers:
  - name: velero-plugin-for-aws
    image: velero/velero-plugin-for-aws:v1.14.0
    volumeMounts:
      - mountPath: /target
        name: plugins

The Secret is created separately with the cloud key (the key the chart expects):

Create credential Secret

kubectl create secret generic velero-secret \
  --namespace velero \
  --from-file=cloud=./credentials-velero

#Understanding the BSL and VSL That Were Created

velero install creates a BackupStorageLocation object named default — the direct counterpart of the --backup-location-config flags:

apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: default
  namespace: velero
spec:
  provider: aws
  objectStorage:
    bucket: velero
    prefix: backups
  config:
    region: minio
    s3ForcePathStyle: "true"
    s3Url: http://minio:9000
    insecureSkipTLSVerify: "true"
  accessMode: ReadWrite

While the VolumeSnapshotLocation (only created if cloud snapshots are enabled):

apiVersion: velero.io/v1
kind: VolumeSnapshotLocation
metadata:
  name: default
  namespace: velero
spec:
  provider: aws
  config:
    region: us-east-1

#Verify the Installation

velero version
kubectl get pod -n velero
velero backup-location get
velero snapshot-location get

All pods should be Running and the BSL should show Available. If it's Unavailable, check the server logs (kubectl logs deploy/velero -n velero) — the most common causes are wrong credentials or an unreachable endpoint.

#Closing

Key takeaways:

• Core install: velero install with provider, plugin, bucket, and credentials; or the vmware-tanzu/velero Helm chart.
• BSL = where manifests + data files live; VSL = where cloud snapshots live.
• MinIO needs s3ForcePathStyle=true and an s3Url endpoint; TLS only via https://, and insecureSkipTLSVerify only for labs.
• --use-node-agent --uploader-type=kopia enables file-level backup (the default in 1.18).
• Verify with velero backup-location get; make sure the BSL shows Available.

In episode 4 next, we do our first backup — velero backup create, inspecting the backup contents with velero backup describe, and understanding the role of --include-resources/--exclude-resources in defining the backup scope. This is the "first light" moment of the series.