# Aerospike Backup Service on Kubernetes

::: caution
AKO version 4.x or later does not support Aerospike Backup Service version 2.x. Upgrade to Aerospike Backup Service v3.0.0 or later. See [Upgrade ABS](https://aerospike.com/docs/kubernetes/tools/backup/upgrade-backup-service) for more information.
:::

## Overview

Aerospike Backup Service (ABS) is an external service that runs alongside an Aerospike Database deployment and manages backup and restore operations. It reads configurations in a YAML format. On a Kubernetes deployment, the configuration is provided in the ABS Custom Resource (CR) file.

## Requirements

Before deploying ABS, install AKO on your Kubernetes cluster using either:

-   [OLM](https://aerospike.com/docs/kubernetes/4.1.x/install/olm)
-   [Helm](https://aerospike.com/docs/kubernetes/4.1.x/install/helm)

## Install and deploy

We recommend using one ABS deployment per Aerospike cluster.

1.  Run the following command to create the ABS service account in the namespace where ABS is deployed.
    
    ```plaintext
    kubectl create serviceaccount aerospike-backup-service -n aerospike
    ```
    
    ::: note
    You can use a different service account name. Refer to the [ABS CR file](https://aerospike.com/docs/kubernetes/4.1.x/tools/backup/backup-service-configuration) to set the service account name.
    :::
    
2.  Configure S3 backup storage (optional)
    
    ABS supports S3-compatible storage and local storage for backups. If you use S3-compatible storage, add the credentials or roles to the ABS CR file so ABS can connect to the remote storage.
    
    -   [S3 Static Credentials (Kubernetes Secrets)](#tab-panel-1210)
    -   [IAM Roles for Service Accounts (IRSA)](#tab-panel-1211)
    
    Create a Kubernetes secret with the S3 credentials.
    
    ```plaintext
    kubectl -n aerospike create secret generic aws-secret --from-file=PATH_TO_AWS_CREDENTIALS
    ```
    
    See the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) for the format of the credentials file.
    
    Mount the `aws-secret` secret in the ABS pod by adding the `secrets` field in the ABS CR.
    
    ```yaml
    secrets:
    
      - secretName: aws-secret
    
        volumeMount:
    
          name: aws-secret
    
          mountPath: /home/absuser/.aws/credentials
    
          subPath: credentials
    ```
    
    Create and attach an IAM role with the required permissions to the ABS service account `aerospike-backup-service`. Change the serviceaccount and role ARN in the following example to the ARN of the IAM role you created.
    
    ```yaml
    kubectl annotate serviceaccount -n aerospike aerospike-backup-service eks.amazonaws.com/role-arn=arn:aws:iam::123456789012:role/MyServiceRole
    ```
    
    See the IRSA documentation for more information on [IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html).
    
3.  Prepare your ABS CR file.
    
    Aerospike publishes sample CR files in the [main Aerospike Kubernetes Operator GitHub repository](https://github.com/aerospike/aerospike-kubernetes-operator/tree/v4.1.2/config/samples).
    
    See [Backup Service Configuration](https://aerospike.com/docs/kubernetes/4.1.x/tools/backup/backup-service-configuration) for details of the available configuration parameters.
    
    You can edit the ABS CR file at any time to manage and change the backup service configuration.
    
4.  Deploy ABS.
    
    Run `kubectl apply` on the CR file you created to deploy ABS.
    
    ```plaintext
    kubectl apply -f aerospikebackupservice.yaml -n aerospike
    ```
    
5.  Verify ABS status.
    
    Run `kubectl get deployment` to check that AKO has created the ABS deployment.
    
    ```plaintext
    $ kubectl get deployment -n aerospike
    
    NAME                            READY   UP-TO-DATE   AVAILABLE   AGE
    
    aerospikebackupservice-sample   1/1     1            1           9s
    ```
    
    Run `kubectl get pods` to check the pods to confirm the status. This step may take time as the pods provision resources, initialize, and become ready. Wait for the pods to switch to the **Running** state before you continue.
    
    ```plaintext
    $ kubectl get pods -n aerospike
    
    NAME                                             READY   STATUS    RESTARTS   AGE
    
    aerospikebackupservice-sample-7b7f7b5648-kpfxh   1/1     Running   0          43s
    ```
    

## Next steps

Now that the backup service is running, you can use another CR file to perform a backup or a restore.

See [Backup](https://aerospike.com/docs/kubernetes/4.1.x/tools/backup/backup) and [Restore](https://aerospike.com/docs/kubernetes/4.1.x/tools/backup/restore) for more information.