The Complete Production SOP: How to Deploy and Run Velero Kubernetes Disaster Recovery & Backup to S3 in Autonomous AI Agents
Step-by-step SOP to install and run Velero Kubernetes Disaster Recovery & Backup to S3 in Codex, Claude Code, and Cursor. Includes verified prompts and fixes.
Technical Overview & Architectural Context
Autonomous coding and DevOps agents frequently make catastrophic errors when orchestrating Kubernetes disaster recovery. Common failure modes include creating ad-hoc kubectl manifests that bypass volume snapshot controllers, failing to annotate PersistentVolumeClaims (PVCs) for CSI or Restic volume snapshots, and attempting direct etcd dumps instead of coordinating cluster-state metadata with object storage backends. When instructed to migrate or backup clusters, agents often miss critical custom resource definitions (CRDs), secrets, and cluster-scoped bindings, resulting in partial restores that silently leave workloads non-functional. The 'velero-k8s-disaster-recovery-backup' skill solves this by establishing deterministic procedural operating boundaries for agents running in Codex, Claude Code, Cursor, or Windsurf. By structuring Velero operations into validated, staged workflows—plugin registration, schedule generation with explicit cron triggers, label-scoped namespace inclusions, and strict pre-restore verification gates—the skill prevents non-deterministic commands. It forces agents to query BackupStorageLocations and VolumeSnapshotLocations before executing mutating restore actions, guaranteeing recoverable, immutable cluster backups in Amazon S3 or compatible object storage.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into the agent runtime path.
Autonomous agents discover domain skills by scanning workspace-level or global agent skill directories (.agents/skills/ or .claude/skills/). Mounting this skill provides the agent runtime with parsed YAML frontmatter triggers and deterministic step sequences. This prevents the LLM from hallucinating outdated Velero 0.x command syntax or unmaintained Restic commands.
mkdir -p ~/.agents/skills/velero-k8s-disaster-recovery-backup && curl -fsSL https://askills.dev/api/skills/velero-k8s-disaster-recovery-backup/raw -o ~/.agents/skills/velero-k8s-disaster-recovery-backup/SKILL.md---
name: "velero-k8s-disaster-recovery-backup"
description: "Backup and migrate complete Kubernetes cluster state, metadata, and persistent volumes to S3."
metadata:
author: "VMware Tanzu"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "backup k8s cluster velero"
- "restore namespace velero"
- "schedule velero backup s3"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# Velero Kubernetes Disaster Recovery & Backup to S3
Administers disaster recovery with VMware Velero: creating scheduled backups, persistent volume snapshots (CSI / Kopia / Restic), cross-region cluster migrations, and executing granular namespace restores.
## When to Invoke
Invoke this skill whenever you need to:
- backup k8s cluster velero
- restore namespace velero
- schedule velero backup s3
## Execution SOP & Rules
1. Check Velero server status: `velero server status` or verify pods in `velero` namespace.
2. Ensure BackupStorageLocation is Available: `velero backup-location get`.
3. Create recurring backup schedule with target retention: `velero schedule create <name> --schedule='0 2 * * *' --ttl 720h0m0s`.
4. Trigger immediate on-demand backup with persistent volume flags: `velero backup create <name> --include-namespaces <ns> --snapshot-volumes=true`.
5. Verify completed backup state (`Completed`) before initiating downstream restore or migration operations.
6. Execute restore with volume preservation: `velero restore create --from-backup <name> --restore-volumes=true`.Keep the SKILL.md body concise and focused on execution commands; this minimizes token overhead and leaves more context budget for large Kubernetes manifest outputs.
Ensure that your local IDE sandbox gives read permissions to ~/.agents/skills/. In Cursor and Windsurf, explicitly list the path under workspace search configurations if running in restricted container mode.
Cloud Credentials & Backup Storage Location Configuration
Safely map AWS S3 bucket parameters and Velero secret files into the cluster without exposing secrets to LLM logs.
Velero requires cloud credentials to access S3 object storage for metadata manifests and volume snapshots. Rather than passing AWS_ACCESS_KEY_ID or raw secret strings through LLM prompt contexts, prepare a local credentials file adhering to the AWS standard format and apply it directly via the Velero CLI or Kubernetes Secret abstraction.
cat << 'EOF' > credentials-velero
[default]
aws_access_key_id=AKIAEXAMPLEKEY123456
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
EOF
chmod 600 credentials-velero && echo 'credentials-velero' >> .gitignoreWhen using AWS EKS, prefer IAM Roles for Service Accounts (IRSA) over static credentials-velero files to completely eliminate long-lived cloud credentials from disk.
Never allow your AI agent to execute 'cat credentials-velero' or echo keys into stdout, as agent trace logs may persist unredacted secret values in terminal session histories.
Intent Matching & Trigger Invocation
Invoke the skill deterministically using verified triggers to initiate Velero backup or restore procedures.
Provide instructions to Codex, Claude Code, or Cursor matching the exact triggers registered in SKILL.md. The runtime matches triggers like 'schedule velero backup s3' or 'restore namespace velero' to activate the rule set, causing the agent to construct syntactically valid Velero CLI calls rather than ad-hoc scripts.
Use precise namespace flags and clear retention windows (e.g., --ttl 168h0m0s) in your prompt to ensure the agent includes explicit garbage collection parameters.
Do not mix cluster backup triggers with general database backup commands in the same prompt; disambiguate by explicitly citing 'velero' or 'Kubernetes cluster state'.
Verification, Linting & Output Quality Gate
Execute automated status checks and validation gates before accepting backup or restore completion.
Before marking the disaster recovery task complete, the agent must run validation gates against Velero custom resources. This step validates that the BackupStorageLocation reports 'Available', the backup phase indicates 'Completed' (rather than 'PartiallyFailed' or 'Failed'), and PVC bindings on the target restore cluster are active.
velero backup get && velero backup describe prod-backup-daily --details && velero backup-location getInspect the 'velero backup logs <backup-name> | grep -i error' output to catch non-fatal persistent volume snapshot warnings that might invalidate data integrity.
A Velero backup reporting 'Completed' may still contain skipped resources if specific API groups were deprecated; always run 'velero backup describe --details' to verify resource counts.
Real-World Scenario: Automated Cross-Region S3 Disaster Recovery Backup for Production Payments Namespace
“backup k8s cluster velero for the payments-production namespace to our AWS S3 bucket 'finance-dr-backups' in us-east-1. Ensure all persistent volumes are snapshotted, label the backup with env=prod, and set a 30-day retention schedule velero backup s3 daily at 03:00 UTC.”
Runtime Troubleshooting & Failure Modes
Root Cause: The cluster CSI driver is not integrated with the Velero VolumeSnapshotLocation CRD, or the velero-plugin-for-aws plugin is missing the snapshot volume configuration.
velero plugin add velero/velero-plugin-for-aws:v1.9.0 && velero snapshot-location create default --provider aws --config region=us-east-1Root Cause: The AWS IAM role or credentials assigned to the Velero service account lack PutObject, GetObject, ListBucket, and DeleteObject permissions on the target S3 bucket.
aws iam put-role-policy --role-name VeleroBackupRole --policy-name VeleroS3Access --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject","s3:AbortMultipartUpload","s3:ListMultipartUploadParts","s3:ListBucket"],"Resource":["arn:aws:s3:::finance-dr-backups","arn:aws:s3:::finance-dr-backups/*"]}]}'Frequently Asked Questions (Velero Kubernetes Disaster Recovery & Backup to S3 SOP)
Q:Can I use Velero Kubernetes Disaster Recovery & Backup to S3 across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. By placing the file in your root ~/.agents/skills or project-level .agents/skills directory, Codex, Claude Code, Cursor, and Windsurf can simultaneously load and enforce these Velero procedures.
Q:How does Velero Kubernetes Disaster Recovery & Backup to S3 prevent context window overflow during long agent sessions?
The skill provides concise, deterministic SOP rules and standard CLI command syntax rather than dumping full Kubernetes API specifications. It instructs agents to parse structured fields and filter status commands with specific flags (--details, -o jsonpath) rather than outputting megabytes of raw YAML.
Q:Does this skill require escalated root or container permissions?
No. The skill runs with a high security score of 98/100. It requires read-only file access and workspace-bounded file writing for local manifests. Cluster operations are governed entirely through standard Kubernetes RBAC mapped via your active kubeconfig.
Ready to equip your autonomous agent with Velero Kubernetes Disaster Recovery & Backup to S3?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.