手把手教你使用velero做k8s上kafka应用的数据备份和恢复
内容索引
引言
Kafka是由LinkedIn公司采用Scala语言开发的一个多分区、多副本的分布式消息系统，可以架设在k8s平台上基于ZooKeeper协调，达到高吞吐、持久化、水平扩展、支持流数据处理等多种特性，因而被广泛使用在互联网大数据和金融等领域。并且越来越多的开源分布式处理系统如Cloudera、Storm、Spark、Flink等都支持与Kafka集成。
Kafka的消息持久化功能和多副本机制，有效地降低了数据丢失的风险，因此也可以作为长期的数据存储系统来使用。那么如何为部署在k8s中的kafka数据上保险，进一步加强数据保护，挽救数据于黑客攻击、恶意篡改等事件，本文使用开源方案velero带大家一窥究竟。
实验环境
Linux版本：
cat version
Linux version 3.10.0-1127.el7.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) ) #1 SMP Tue Mar 31 23:36:51 UTC 2020Kubernetes版本
kubectl get nodes
NAME STATUS ROLES AGE VERSION
remote-master Ready master 84d v1.18.9
worker-2 Ready <none> 84d v1.18.9安装velero1.7.0
下载velero v1.7.0的安装包，解压。
其余步骤参考
https://velero.cn/d/7-velero-cephcsi
中环境准备部分
部署zookeeper
本文中我们将使用statefulset在kafka-test的namespace中创建2副本的zookeeper和kafka。
第一步，使用kubectl创建kafka-test
kubectl create namespace kafka-test第二步，在kafka-test中部署zookeeper
kubectl -n kafka-test apply -f ./zookeeper-deployment.yamlzookeeper-deployment.yaml 文件内容参考
https://github.com/jibutech/docs/blob/main/examples/workload/kafka/zookeeper-deployment.yaml
具体参数如namespace,replicas和storageClassName等根据需要修改
---
apiVersion: v1
kind: Service
metadata:
name: zk-svc
labels:
app: zk-svc
spec:
ports:
- port: 2888
name: server
- port: 3888
name: leader-election
clusterIP: None
selector:
app: zk
---
apiVersion: v1
kind: ConfigMap
metadata:
name: zk-cm
data:
jvm.heap: "1G"
tick: "2000"
init: "10"
sync: "5"
client.cnxns: "60"
snap.retain: "3"
purge.interval: "0"
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
name: zk-pdb
spec:
selector:
matchLabels:
app: zk
minAvailable: 2
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: zk
spec:
serviceName: zk-svc
replicas: 2
selector:
matchLabels:
app: zk
template:
metadata:
labels:
app: zk
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: "app"
operator: In
values:
- zk
topologyKey: "kubernetes.io/hostname"
containers:
- name: k8szk
imagePullPolicy: IfNotPresent
image: registry.cn-hangzhou.aliyuncs.com/jaxzhai/k8szk:v3
resources:
requests:
memory: "2Gi"
cpu: "500m"
ports:
- containerPort: 2181
name: client
- containerPort: 2888
name: server
- containerPort: 3888
name: leader-election
env:
- name : ZK_REPLICAS
value: "2"
- name : ZK_HEAP_SIZE
valueFrom:
configMapKeyRef:
name: zk-cm
key: jvm.heap
- name : ZK_TICK_TIME
valueFrom:
configMapKeyRef:
name: zk-cm
key: tick
- name : ZK_INIT_LIMIT
valueFrom:
configMapKeyRef:
name: zk-cm
key: tick
- name : ZK_MAX_CLIENT_CNXNS
valueFrom:
configMapKeyRef:
name: zk-cm
key: client.cnxns
- name: ZK_SNAP_RETAIN_COUNT
valueFrom:
configMapKeyRef:
name: zk-cm
key: snap.retain
- name: ZK_PURGE_INTERVAL
valueFrom:
configMapKeyRef:
name: zk-cm
key: purge.interval
- name: ZK_CLIENT_PORT
value: "2181"
- name: ZK_SERVER_PORT
value: "2888"
- name: ZK_ELECTION_PORT
value: "3888"
command:
- sh
- -c
- zkGenConfig.sh && zkServer.sh start-foreground
readinessProbe:
exec:
command:
- "zkOk.sh"
initialDelaySeconds: 30
timeoutSeconds: 10
livenessProbe:
exec:
command:
- "zkOk.sh"
initialDelaySeconds: 30
timeoutSeconds: 10
volumeMounts:
- name: datadir
mountPath: /var/lib/zookeeper
securityContext:
runAsUser: 1000
fsGroup: 1000
volumeClaimTemplates:
- metadata:
name: datadir
spec:
accessModes: [ "ReadWriteOnce" ]
resources:
requests:
storage: 10Gi
storageClassName: managed-nfs-storage第三步，验证zookeeper集群和域名。
for i in {0..1}; do kubectl -n kafka-test exec zk-$i -- hostname -f; done
zk-0.zk-svc.kafka-test.svc.cluster.local
zk-1.zk-svc.kafka-test.svc.cluster.local第四步，暴露zookeeper外部服务。
for i in {0..1}; do kubectl -n kafka-test label pod zk-$i zkInst=$i; done
for i in {0..1}; do kubectl -n kafka-test expose po zk-$i --port=2181 --target-port=2181 --name=zk-$i --selector=zkInst=$i --type=NodePort; done第五步，等待zk pod都ready后，进入pod查看zookeeper是否处于正常服务状态
kubectl -n kafka-test get pod
NAME READY STATUS RESTARTS AGE
zk-0 1/1 Running 0 18m
zk-1 1/1 Running 0 18m
kubectl -n kafka-test exec -it zk-0 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
zookeeper@zk-0:/$ echo stat|nc 127.0.0.1 2181
Zookeeper version: 3.4.10-39d3a4f269333c922ed3db283be479f9deacaa0f, built on 03/23/2017 10:13 GMT
Clients:
/10.100.199.209:47010[1](queued=0,recved=33475,sent=33481)
/127.0.0.1:41870[0](queued=0,recved=1,sent=0)
Latency min/avg/max: 0/0/64
Received: 46663
Sent: 46668
Connections: 2
Outstanding: 0
Zxid: 0x400000096
Mode: follower
Node count: 135
zookeeper@zk-0:/$部署kafka
等待zookeeper服务正常后，开始部署kafka。
第一步，在kafka-test中部署kafka
kubectl -n kafka-test apply -f ./kafka-deployment.yamlkafka-deployment.yaml 文件内容参考
https://github.com/jibutech/docs/blob/main/examples/workload/kafka/kafka-deployment.yaml
具体参数如namespace,replicas和storageClassName等根据需要修改
---
apiVersion: v1
kind: Service
metadata:
name: kafka-svc
labels:
app: kafka
spec:
ports:
- port: 9093
name: server
clusterIP: None
selector:
app: kafka
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
name: kafka-pdb
spec:
selector:
matchLabels:
app: kafka
minAvailable: 2
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: kafka
spec:
serviceName: kafka-svc
replicas: 2
selector:
matchLabels:
app: kafka
template:
metadata:
labels:
app: kafka
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: "app"
operator: In
values:
- kafka
topologyKey: "kubernetes.io/hostname"
podAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 1
podAffinityTerm:
labelSelector:
matchExpressions:
- key: "app"
operator: In
values:
- zk
topologyKey: "kubernetes.io/hostname"
terminationGracePeriodSeconds: 300
containers:
- name: k8skafka
imagePullPolicy: IfNotPresent
image: registry.cn-hangzhou.aliyuncs.com/jaxzhai/k8skafka:v1
resources:
requests:
memory: "1Gi"
cpu: 500m
ports:
- containerPort: 9093
name: server
command:
- sh
- -c
- "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \
--override listeners=PLAINTEXT://:9093 \
--override zookeeper.connect=zk-0.zk-svc.kafka-test.svc.cluster.local:2181,zk-1.zk-svc.kafka-test.svc.cluster.local:2181 \
--override log.dirs=/var/lib/kafka \
--override auto.create.topics.enable=true \
--override auto.leader.rebalance.enable=true \
--override background.threads=10 \
--override compression.type=producer \
--override delete.topic.enable=false \
--override leader.imbalance.check.interval.seconds=300 \
--override leader.imbalance.per.broker.percentage=10 \
--override log.flush.interval.messages=10 \
--override log.flush.interval.ms=100 \
--override log.flush.offset.checkpoint.interval.ms=6000 \
--override log.flush.scheduler.interval.ms=600 \
--override log.retention.bytes=-1 \
--override log.retention.hours=168 \
--override log.roll.hours=168 \
--override log.roll.jitter.hours=0 \
--override log.segment.bytes=1073741824 \
--override log.segment.delete.delay.ms=60000 \
--override message.max.bytes=1000012 \
--override min.insync.replicas=1 \
--override num.io.threads=8 \
--override num.network.threads=3 \
--override num.recovery.threads.per.data.dir=1 \
--override num.replica.fetchers=1 \
--override offset.metadata.max.bytes=4096 \
--override offsets.commit.required.acks=-1 \
--override offsets.commit.timeout.ms=5000 \
--override offsets.load.buffer.size=5242880 \
--override offsets.retention.check.interval.ms=600000 \
--override offsets.retention.minutes=1440 \
--override offsets.topic.compression.codec=0 \
--override offsets.topic.num.partitions=50 \
--override offsets.topic.replication.factor=3 \
--override offsets.topic.segment.bytes=104857600 \
--override queued.max.requests=500 \
--override quota.consumer.default=9223372036854775807 \
--override quota.producer.default=9223372036854775807 \
--override replica.fetch.min.bytes=1 \
--override replica.fetch.wait.max.ms=500 \
--override replica.high.watermark.checkpoint.interval.ms=5000 \
--override replica.lag.time.max.ms=10000 \
--override replica.socket.receive.buffer.bytes=65536 \
--override replica.socket.timeout.ms=30000 \
--override request.timeout.ms=30000 \
--override socket.receive.buffer.bytes=102400 \
--override socket.request.max.bytes=104857600 \
--override socket.send.buffer.bytes=102400 \
--override unclean.leader.election.enable=true \
--override zookeeper.session.timeout.ms=6000 \
--override zookeeper.set.acl=false \
--override broker.id.generation.enable=true \
--override connections.max.idle.ms=600000 \
--override controlled.shutdown.enable=true \
--override controlled.shutdown.max.retries=3 \
--override controlled.shutdown.retry.backoff.ms=5000 \
--override controller.socket.timeout.ms=30000 \
--override default.replication.factor=1 \
--override fetch.purgatory.purge.interval.requests=1000 \
--override group.max.session.timeout.ms=300000 \
--override group.min.session.timeout.ms=6000 \
--override inter.broker.protocol.version=0.10.2-IV0 \
--override log.cleaner.backoff.ms=15000 \
--override log.cleaner.dedupe.buffer.size=134217728 \
--override log.cleaner.delete.retention.ms=86400000 \
--override log.cleaner.enable=true \
--override log.cleaner.io.buffer.load.factor=0.9 \
--override log.cleaner.io.buffer.size=524288 \
--override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \
--override log.cleaner.min.cleanable.ratio=0.5 \
--override log.cleaner.min.compaction.lag.ms=0 \
--override log.cleaner.threads=1 \
--override log.cleanup.policy=delete \
--override log.index.interval.bytes=4096 \
--override log.index.size.max.bytes=10485760 \
--override log.message.timestamp.difference.max.ms=9223372036854775807 \
--override log.message.timestamp.type=CreateTime \
--override log.preallocate=false \
--override log.retention.check.interval.ms=300000 \
--override max.connections.per.ip=2147483647 \
--override num.partitions=1 \
--override producer.purgatory.purge.interval.requests=1000 \
--override replica.fetch.backoff.ms=1000 \
--override replica.fetch.max.bytes=1048576 \
--override replica.fetch.response.max.bytes=10485760 \
--override reserved.broker.max.id=1000 "
env:
- name: KAFKA_HEAP_OPTS
value : "-Xmx512M -Xms512M"
- name: KAFKA_OPTS
value: "-Dlogging.level=INFO"
volumeMounts:
- name: datadir
mountPath: /var/lib/kafka
readinessProbe:
exec:
command:
- sh
- -c
- "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093"
livenessProbe:
initialDelaySeconds: 10
timeoutSeconds: 5
exec:
command:
- sh
- -c
- "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093"
securityContext:
runAsUser: 1000
fsGroup: 1000
volumeClaimTemplates:
- metadata:
name: datadir
spec:
accessModes: [ "ReadWriteOnce" ]
resources:
requests:
storage: 5Gi
storageClassName: managed-nfs-storage第二步，暴露kafka外部服务。
for i in {0..1}; do kubectl -n kafka-test label pod kafka-$i kafkaInst=$i; done
for i in {0..1}; do kubectl -n kafka-test expose po kafka-$i --port=9093 --target-port=9093 --name=kafka-$i --selector=kafkaInst=$i --type=NodePort; done第三步，等待kafka pod都ready后，分别进入两个pod验证kafka日志系统是否正常工作
kubectl -n kafka-test get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kafka-0 1/1 Running 0 18s 10.100.199.224 remote-master <none> <none>
kafka-1 1/1 Running 0 10s 10.100.133.219 worker-2 <none> <none>
zk-0 1/1 Running 0 27m 10.100.199.230 remote-master <none> <none>
zk-1 1/1 Running 0 27m 10.100.133.254 worker-2 <none> <none>
kubectl -n kafka-test exec -it kafka-0 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
kafka@kafka-0:/$ kafka-console-consumer.sh --topic test --bootstrap-server localhost:9093 --from-beginning
aaa
bbb
ccc
ddd
eee
fff
ggg
hhh
iii
jjj
kkk
^CProcessed a total of 11 messages
kafka@kafka-0:/$ exit
kubectl -n kafka-test exec -it kafka-1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
kafka@kafka-1:/$ kafka-console-producer.sh --topic test --broker-list localhost:9093
lll
mmm
nnn
^Ckafka@kafka-1:/$ kafka-console-consumer.sh --topic test --bootstrap-server localhost:9093 --from-beginning
aaa
bbb
ccc
ddd
eee
fff
ggg
hhh
iii
jjj
kkk
lll
mmm
nnn
^CProcessed a total of 14 messages对kafka进行备份和恢复
- 创建备份
# velero backup create kafka-backup1 --include-namespaces=kafka-test --default-volumes-to-restic --volume-snapshot-locations default
Backup request "kafka-backup1" submitted successfully.
Run `velero backup describe kafka-backup1` or `velero backup logs kafka-backup1` for more details.这里备份命令只设置了namespace，并没有对资源进行任何选择。
另外，--default-volumes-to-restic是velero v1.5新引入的参数，这里使用restic文件复制方式，具体备份方式详解参见https://velero.cn/d/8-velero
- 查看备份状态和详细信息
velero backup describe kafka-backup1 --details
Name: kafka-backup1
Namespace: qiming-backend
Labels: velero.io/storage-location=default
Annotations: velero.io/source-cluster-k8s-gitversion=v1.18.9
velero.io/source-cluster-k8s-major-version=1
velero.io/source-cluster-k8s-minor-version=18
Phase: Completed
Errors: 0
Warnings: 0
Namespaces:
Included: kafka-test
Excluded: <none>
Resources:
Included: *
Excluded: <none>
Cluster-scoped: auto
Label selector: <none>
Storage Location: default
Velero-Native Snapshot PVs: auto
TTL: 720h0m0s
Hooks: <none>
Backup Format Version: 1.1.0
Started: 2021-12-13 16:06:27 +0800 CST
Completed: 2021-12-13 16:06:58 +0800 CST
Expiration: 2022-01-12 16:06:27 +0800 CST
Total items to be backed up: 40
Items backed up: 40
Resource List:
apps/v1/ControllerRevision:
- kafka-test/kafka-6d44c778b6
- kafka-test/zk-d8566c99
apps/v1/StatefulSet:
- kafka-test/kafka
- kafka-test/zk
discovery.k8s.io/v1beta1/EndpointSlice:
- kafka-test/kafka-0-8w26n
- kafka-test/kafka-1-8nbk7
- kafka-test/kafka-svc-p8z6c
- kafka-test/zk-0-7zp8f
- kafka-test/zk-1-lb7nw
- kafka-test/zk-svc-wwhlt
policy/v1beta1/PodDisruptionBudget:
- kafka-test/kafka-pdb
- kafka-test/zk-pdb
v1/ConfigMap:
- kafka-test/zk-cm
v1/Endpoints:
- kafka-test/kafka-0
- kafka-test/kafka-1
- kafka-test/kafka-svc
- kafka-test/zk-0
- kafka-test/zk-1
- kafka-test/zk-svc
v1/Namespace:
- kafka-test
v1/PersistentVolume:
- pvc-823ffe85-f4d3-40f3-8c17-6675cb42a92c
- pvc-86059764-1ed6-4b15-9c6b-01106b2e144f
- pvc-a377d3de-cdbc-44c3-aa8c-ba39f62caa95
- pvc-ad56d5c0-8987-4e84-8ed0-12c43e7aa322
v1/PersistentVolumeClaim:
- kafka-test/datadir-kafka-0
- kafka-test/datadir-kafka-1
- kafka-test/datadir-zk-0
- kafka-test/datadir-zk-1
v1/Pod:
- kafka-test/kafka-0
- kafka-test/kafka-1
- kafka-test/zk-0
- kafka-test/zk-1
v1/Secret:
- kafka-test/default-token-87b2l
v1/Service:
- kafka-test/kafka-0
- kafka-test/kafka-1
- kafka-test/kafka-svc
- kafka-test/zk-0
- kafka-test/zk-1
- kafka-test/zk-svc
v1/ServiceAccount:
- kafka-test/default
Velero-Native Snapshots: <none included>
Restic Backups:
Completed:
kafka-test/kafka-0: datadir
kafka-test/kafka-1: datadir
kafka-test/zk-0: datadir
kafka-test/zk-1: datadir等待 Phase: Completed，表示备份完成
等待备份任务成功后，在集群中删除kafka-test这个namespace。
kubectl delete ns kafka-test创建恢复并查看详情
# velero create restore --from-backup kafka-backup1 Restore request "kafka-backup1-20211213163910" submitted successfully. Run `velero restore describe kafka-backup1-20211213163910` or `velero restore logs kafka-backup1-20211213163910` for more details. # velero restore describe kafka-backup1-20211213163910 Name: kafka-backup1-20211213163910 Namespace: qiming-backend Labels: <none> Annotations: <none> Phase: Completed Total items to be restored: 40 Items restored: 40 Started: 2021-12-13 16:39:10 +0800 CST Completed: 2021-12-13 16:39:50 +0800 CST Backup: kafka-backup1 Namespaces: Included: all namespaces found in the backup Excluded: <none> Resources: Included: * Excluded: nodes, events, events.events.k8s.io, backups.velero.io, restores.velero.io, resticrepositories.velero.io Cluster-scoped: auto Namespace mappings: <none> Label selector: <none> Restore PVs: auto Restic Restores (specify --details for more information): Completed: 4 Preserve Service NodePorts: auto等待 Phase: Completed，表示恢复完成
等待恢复任务成功后，检查kafka-test中pod的恢复情况，并进入kafka pod检查数据。
# kubectl -n kafka-test get pod -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES kafka-0 1/1 Running 4 4m58s 10.100.133.233 worker-2 <none> <none> kafka-1 1/1 Running 4 4m58s 10.100.199.255 remote-master <none> <none> zk-0 1/1 Running 0 4m58s 10.100.199.246 remote-master <none> <none> zk-1 1/1 Running 0 4m58s 10.100.133.254 worker-2 <none> <none> # kubectl -n kafka-test exec -it kafka-1 bash kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead. kafka@kafka-1:/$ kafka-console-consumer.sh --topic test --bootstrap-server localhost:9093 --from-beginning aaa bbb ccc ddd eee fff ggg hhh iii jjj kkk lll mmm nnn ^CProcessed a total of 14 messages kafka@kafka-1:/$
小结
本文利用开源方案velero, 实现了多副本kafka和zookeeper在k8s容器中的备份和恢复操作, 并成功恢复了kafka持久卷的数据。