Backing up a Kubernetes cluster
Connect a cluster with a service account token — no in-cluster agent to install.
VPS Snaps connects directly to your cluster's Kubernetes API using a service account token. If Velero is already running in your cluster, we detect it and drive it directly for a fuller backup. Otherwise, we back up namespace manifests to your own storage and best-effort snapshot persistent volumes where your cluster's storage driver supports it.
Step 1 — Create a scoped service account
Create a service account with read access to the resources you want backed up, plus create/get/list/delete on volumesnapshots.snapshot.storage.k8s.io if you want volume backups.
kubectl create serviceaccount vpssnaps-backup -n default
kubectl create clusterrole vpssnaps-backup-role \
--verb=get,list,watch --resource=namespaces,configmaps,secrets,services,persistentvolumeclaims,deployments,statefulsets,daemonsets,jobs,cronjobs,ingresses,storageclasses,volumesnapshotclasses
kubectl create clusterrole vpssnaps-backup-snapshot-role \
--verb=get,list,create,delete --resource=volumesnapshots.snapshot.storage.k8s.io
kubectl create clusterrolebinding vpssnaps-backup-binding \
--clusterrole=vpssnaps-backup-role --serviceaccount=default:vpssnaps-backup
kubectl create clusterrolebinding vpssnaps-backup-snapshot-binding \
--clusterrole=vpssnaps-backup-snapshot-role --serviceaccount=default:vpssnaps-backupStep 2 — Get the token and CA certificate
Modern Kubernetes doesn't auto-generate long-lived service account tokens, so request one explicitly:
kubectl create token vpssnaps-backup -n default --duration=8760h
kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -dThe token above lasts a year. Rotate it before it expires by creating a new one and updating the cluster connection in VPS Snaps.
Step 3 — Connect the cluster
In VPS Snaps, go to Kubernetes and add a cluster with your API server URL (from kubectl config view), the token, and the CA certificate.
Without a CA certificate, we can't verify the cluster's identity over TLS. Only skip it if your API server uses a publicly-trusted certificate — most managed clusters don't.
What gets backed up without Velero
- ConfigMaps, Secrets, Services, PersistentVolumeClaims
- Deployments, StatefulSets, DaemonSets
- Jobs, CronJobs, Ingresses
- Persistent volume data — only for PVCs whose StorageClass has a matching VolumeSnapshotClass
This is a well-known set of workload resource kinds, not full dynamic API discovery — it covers what matters for restoring a typical application, not every custom resource in your cluster.
What gets backed up with Velero
If Velero is already installed (in the default 'velero' namespace), we create a Backup custom resource and let Velero do what it's configured to do — including its own volume data mover if you've set one up. The backup lands in Velero's own configured storage location, not the storage destination you pick in VPS Snaps.