Run Ark on AWS

To set up Ark on AWS, you:

  • Create your S3 bucket
  • Create an AWS IAM user for Ark
  • Configure the server
  • Create a Secret for your credentials

If you do not have the aws CLI locally installed, follow the [user guide][5] to set it up.

Create S3 bucket

Heptio Ark requires an object storage bucket to store backups in. Create an S3 bucket, replacing placeholders appropriately:

aws s3api create-bucket \
    --bucket <YOUR_BUCKET> \
    --region <YOUR_REGION> \
    --create-bucket-configuration LocationConstraint=<YOUR_REGION>

NOTE: us-east-1 does not support a LocationConstraint. If your region is us-east-1, omit the bucket configuration:

aws s3api create-bucket \
    --bucket <YOUR_BUCKET> \
    --region us-east-1

Create IAM user

For more information, see the AWS documentation on IAM users.

  1. Create the IAM user:

    aws iam create-user --user-name heptio-ark
  2. Attach policies to give heptio-ark the necessary permissions:

    aws iam attach-user-policy \
        --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess \
        --user-name heptio-ark
    aws iam attach-user-policy \
        --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess \
        --user-name heptio-ark
  3. Create an access key for the user:

    aws iam create-access-key --user-name heptio-ark

    The result should look like:

        "AccessKey": {
              "UserName": "heptio-ark",
              "Status": "Active",
              "CreateDate": "2017-07-31T22:24:41.576Z",
              "SecretAccessKey": <AWS_SECRET_ACCESS_KEY>,
              "AccessKeyId": <AWS_ACCESS_KEY_ID>
  4. Create an Ark-specific credentials file (credentials-ark) in your local directory:


    where the access key id and secret are the values returned from the create-access-key request.

Credentials and configuration

In the Ark root directory, run the following to first set up namespaces, RBAC, and other scaffolding. To run in a custom namespace, make sure that you have edited the YAML files to specify the namespace. See Run in custom namespace.

kubectl apply -f examples/common/00-prereqs.yaml

Create a Secret. In the directory of the credentials file you just created, run:

kubectl create secret generic cloud-credentials \
    --namespace <ARK_SERVER_NAMESPACE> \
    --from-file cloud=credentials-ark

Specify the following values in the example files:

  • In examples/aws/00-ark-config.yaml:

  • In examples/common/10-deployment.yaml:

    • Make sure that spec.template.spec.containers[*] is “AWS_SHARED_CREDENTIALS_FILE”.
  • (Optional) If you run the nginx example, in file examples/nginx-app/with-pv.yaml:

    • Replace <YOUR_STORAGE_CLASS_NAME> with gp2. This is AWS’s default StorageClass name.

Start the server

In the root of your Ark directory, run:

kubectl apply -f examples/aws/00-ark-config.yaml
kubectl apply -f examples/common/10-deployment.yaml
Getting Started

To help you get started, see the documentation.