1. Documentation
×

OADP virtual machine data protection

Use OpenShift API for Data Protection virtual machine data protection (VMDP) to back up and restore user data from within VMs on OKD Virtualization. This helps you to protect files and directories without relying on cluster administrators.

About OADP virtual machine data protection

You can independently back up and restore your own data from within a virtual machine (VM) by using the OADP VM data protection (VMDP) command-line tool. This approach helps you secure specific files and directories in your encrypted repository without requiring cluster administrator privileges.

What problem is VMDP solving

Cluster administrators manage traditional OADP backups. The administrator owns the backup storage location, controls what to back up, and manages the restore process. This means that VM users must rely on an administrator to recover their data, and the backup scope is limited to the persistent volume claims (PVCs) attached to the VM at the time of backup.

VMDP addresses this gap by shifting data ownership to the VM user. The user creates their own encrypted backup repository, chooses what data to protect, and restores data without administrator involvement. This follows zero-trust architecture principles where the user owns the data, the backup, and the encryption keys. Administrators cannot access or restore the user’s backup data.

What VMDP does

VMDP is a command-line tool that runs inside virtual machines on OKD Virtualization. With VMDP, you can complete the following tasks:

  • Back up and restore files and directories from within the VM by using a single command.

  • Protect data accessible over network file systems such as Common Internet File System (CIFS) and Network File System (NFS) shares, which standard OADP backups typically exclude.

  • Create a personal encrypted repository in S3-compatible or file system storage.

  • Use data deduplication for efficient storage and fast incremental backups.

VMDP is based on Kopia and uses the same repository format.

Who uses VMDP

VMDP is designed for VM users who need to manage their own backups independently. The user is responsible for:

  • Providing their own credentials to create an encrypted backup repository.

  • Choosing what data to back up and restore.

  • Managing backup lifecycle operations such as listing, deleting, and restoring backups.

Cluster administrators are not involved in the backup and restore process. Their role is limited to deploying the OADP Operator. The OADP Operator has the VMDP CLI available for download.

VMDP and VMFR comparison

OADP provides two complementary features for VM data recovery:

VMDP (VM data protection)

The VM user, without cluster-admin privileges, owns the data. The user creates encrypted backups of selected files and directories from within the VM. The user holds the encryption keys and manages the backup lifecycle independently.

VMFR (VM file restore)

The cluster administrator manages the backups and file recovery. VMFR enables file-level recovery from admin-created Velero backups of entire VMs, including all PVCs. The administrator controls the backup and restore process.

Supported platforms for OADP virtual machine data protection

Review the supported guest operating systems and architectures for the OpenShift API for Data Protection virtual machine data protection (VMDP) command-line interface. This helps you to verify that your VM environment is compatible.

VMDP is built for OKD Virtualization certified guest operating systems on the following platforms:

Table 1. Supported guest operating systems
Guest operating system Architectures

Red Hat Enterprise Linux

x86_64, AArch64

Microsoft Windows

x86_64, AArch64

Each binary is statically linked and includes a SHA256 checksum for integrity verification.

OADP virtual machine data protection backend storage

Review the backend storage options for OpenShift API for Data Protection virtual machine data protection (VMDP) backup storage locations. This helps you to configure S3-compatible or file system storage for your backup repository.

S3-compatible storage

Table 2. S3 storage options
Option Description Default

--bucket

Name of the S3 bucket.

(required)

--access-key

Access key ID.

(required)

--secret-access-key

Secret access key.

(required)

--endpoint

S3 endpoint URL.

s3.amazonaws.com

--region

S3 region.

Auto-detect

--prefix

Object prefix in the bucket.

None

--session-token

Session token for temporary credentials.

None

--disable-tls

Disable HTTPS.

false

--disable-tls-verification

Skip TLS certificate verification.

false

--root-ca-pem-path

Path to a custom CA certificate file.

None

--root-ca-pem-base64

Base64-encoded CA certificate.

None

VMDP automatically prepends oadp-vmdp/ to your prefix.

Filesystem storage

Table 3. Filesystem storage options
Option Description Default

--path

Absolute path to the storage directory.

(required)

--owner-uid

User ID for new files.

Current user

--owner-gid

Group ID for new files.

Current group

--file-mode

Permission mode for files.

0600

--dir-mode

Permission mode for directories.

0700

OADP virtual machine data protection configuration

Review the environment variables and file locations for the OpenShift API for Data Protection virtual machine data protection (VMDP) command-line interface (CLI). This helps you to configure credentials, logging, and behavioral settings.

Environment variables

Table 4. Credential environment variables
Variable Description

BSLS_PASSWORD

BSL encryption password. Set this variable to avoid interactive prompts.

AWS_ACCESS_KEY_ID

Access key for S3 storage

AWS_SECRET_ACCESS_KEY

Secret key for S3 storage

AWS_SESSION_TOKEN

Session token for temporary credentials
Table 5. Configuration environment variables
Variable Description Default

OADP_CONFIG_PATH

Path to the configuration file

~/.config/oadp/repository.config

OADP_CACHE_DIRECTORY

Path to the cache directory

System-dependent

OADP_LOG_DIR

Directory for log files

~/.cache/oadp/
Table 6. Behavior environment variables
Variable Description Default

OADP_CHECK_FOR_UPDATES

Enable or disable update checks

true

OADP_PERSIST_CREDENTIALS_ON_CONNECT

Save credentials after connecting

true

OADP_USE_KEYRING

Use the system keyring for password storage

false

OADP_BACKUP_FAIL_FAST

Fail immediately on the first error

false
Table 7. Logging environment variables
Variable Description Default

OADP_LOG_DIR_MAX_FILES

Maximum number of log files

1000

OADP_LOG_DIR_MAX_AGE

Maximum age of log files

720h

OADP_LOG_DIR_MAX_SIZE_MB

Maximum total size of log files in MB

1000

File locations

Table 8. Default file locations
Type Linux Windows

Configuration

~/.config/oadp/repository.config

%APPDATA%\oadp\repository.config

Logs

~/.cache/oadp/

%LOCALAPPDATA%\oadp\

Kopia compatibility

VMDP is based on Kopia and uses the same repository format. Repositories are fully compatible between the two tools.

Table 9. Command mapping between VMDP and Kopia
VMDP command Kopia equivalent

bsl

repository

backup

snapshot

When you connect to a VMDP repository by using the Kopia CLI, include the oadp-vmdp/ prefix that VMDP adds automatically. For example:

$ kopia repository connect s3 \
  --bucket <bucket_name> \
  --prefix oadp-vmdp/<your_prefix>/ \
  ...