---
title: Charmhub | Deploy Velero Operator Charm using Charmhub - The Open Operator
  Collection
description: Deploy the latest version of Velero Operator Charm on any cloud.
url: https://charmhub.io/velero-operator/docs/integrate-with-gcp
---

# Velero Operator Charm

[Kubeflow Charmers](https://charmhub.io/publisher/ckfbot "View all packages from Kubeflow Charmers")

* [Kubeflow Charmers](https://charmhub.io/publisher/ckfbot "View all packages from Kubeflow Charmers")

Platform:

24.04

edge 503

```
juju deploy velero-operator --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://github.com/canonical/velero-operator)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/velero-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Integrate with a GCP Kubernetes cluster

This guide describes how to back up and restore with Charmed Velero on a GCP cluster. Charmed Velero leverages the credentials provided by the `gcs-integrator` and persistent-disk (PD) snapshots for backing up.

## [Requirements](https://charmhub.io/velero-operator/docs/integrate-with-gcp#p-41204-requirements)

* A GCP Juju controller.
* A GCS bucket unique to the cluster.
* `gcloud` and `gsutil` CLI installed and configured.

## [Set permissions with a GCP service account](https://charmhub.io/velero-operator/docs/integrate-with-gcp#p-41204-set-permissions-with-a-gcp-service-account)

To set permissions, create a dedicated GCP service account and attach the
minimum GCS/Compute policy following these steps.

1. Set environment variables:

   ```
   export PROJECT_ID=$(gcloud config get-value project)
   export BUCKET=velero
   export SA_NAME=velero
   ```
2. Create the service account:

   ```
   gcloud iam service-accounts create $SA_NAME \
     --display-name "Velero service account"
   ```
3. Create and assign the required roles:

   ```
   SA_EMAIL=$(gcloud iam service-accounts list \
     --filter="displayName:Velero service account" \
     --format="value(email)")

   ROLE_PERMISSIONS=(
     compute.disks.createSnapshot
     compute.disks.get
     compute.disks.setLabels
     compute.projects.get
     compute.snapshots.create
     compute.snapshots.delete
     compute.snapshots.get
     compute.snapshots.setLabels
     compute.snapshots.useReadOnly
     compute.zones.get
     iam.serviceAccounts.signBlob
     storage.objects.create
     storage.objects.delete
     storage.objects.get
     storage.objects.list
   )

   gcloud iam roles create velero.server \
       --project $PROJECT_ID \
       --title "Velero Server" \
       --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")"

   gcloud projects add-iam-policy-binding $PROJECT_ID \
       --member serviceAccount:$SA_EMAIL \
       --role projects/$PROJECT_ID/roles/velero.server
   ```
4. Create and download a JSON key file:

   ```
   gcloud iam service-accounts keys create credentials.json \
     --iam-account $SA_EMAIL
   ```

   Save the path to `credentials.json` for the next steps.

## [Create the GCS bucket](https://charmhub.io/velero-operator/docs/integrate-with-gcp#p-41204-create-the-gcs-bucket)

```
gsutil mb -p $PROJECT_ID gs://$BUCKET
```

Grant the service account access to the bucket:

```
gsutil iam ch serviceAccount:$SA_EMAIL:objectAdmin gs://$BUCKET
```

## [Deploy and configure the GCS-Integrator charm](https://charmhub.io/velero-operator/docs/integrate-with-gcp#p-41204-deploy-and-configure-the-gcs-integrator-charm)

Use the service account key retrieved above to configure `gcs-integrator`. This allows Charmed Velero to access the GCS bucket and leverage Compute Engine persistent-disk snapshots.

1. Deploy the integrator:

   ```
   juju deploy gcs-integrator --channel 1/edge
   ```
2. Store the service account key as a Juju secret and grant it to the
   integrator:

   ```
   SECRET_URI=$(juju add-secret gcs-sa-secret secret-key="$(cat credentials.json)" | tr -d '\n')

   juju grant-secret gcs-sa-secret gcs-integrator
   ```
3. Configure the bucket and credentials:

   ```
   juju config gcs-integrator \
     bucket="$BUCKET" \
     credentials="$SECRET_URI"
   ```

Bucket and credentials are mandatory. The integrator should reach `active`
status once correctly configured.

## [Deploy Velero and relate to the GCS-Integrator](https://charmhub.io/velero-operator/docs/integrate-with-gcp#p-41204-deploy-velero-and-relate-to-the-gcs-integrator)

Deploy Charmed Velero and integrate it with `gcs-integrator` as follows:

```
juju deploy velero-operator --trust
juju integrate gcs-integrator velero-operator
```

The relation supplies the bucket name and service account credentials to Velero. Charmed Velero configures the GCP plugin accordingly. After both charms are in `ready` state, the cluster is ready for backup/restore.

See [gcs-integrator charm](https://charmhub.io/gcs-integrator) and [Velero plugin for GCP](https://github.com/vmware-tanzu/velero-plugin-for-gcp/blob/main/README.md) for more details.

---