Note:

Enable Backup Policy Restoration and Customer-Managed Keys for OCI Block Storage with OCI Full Stack Disaster Recovery

Introduction

Oracle Cloud Infrastructure Full Stack Disaster Recovery (OCI Full Stack DR) orchestrates the transition of compute, database, and applications between Oracle Cloud Infrastructure (OCI) regions from around the globe with a single click. Customers can automate the steps needed to recover one or more business systems without redesigning or re-architecting existing infrastructure, databases, or applications and without the need for specialized management or conversion servers.

Initial Deployment Architecture

Deployment Architecture

Note: Primary region is Frankfurt and standby region is London.

Objectives

Configure the newly introduced feature in OCI Full Stack DR that enables the application of custom encryption keys and backup policy settings for volume groups that are members of a DR protection group.

The following tasks will be covered in this tutorial.

Prerequisites

Task 1: Add the Compute Instance (vmapp01) to Primary DR Protection Group

  1. In the primary DR protection group (DRPG_CMK_BKP_FRA), select Members and click Add member.

    Add new members

  2. Add the compute VM (vmapp01) as a member.

    Add new members

    Add new members

Task 2: Add the Volume Group (vgapp01) to Primary DR Protection Group

  1. In the primary DR protection group (DRPG_CMK_BKP_FRA), select Members and add the volume group (vgapp01) as a member.

    Add new members

    Note: A new section with the destination backup policy and encryption will be presented.

  2. Once you select the backup policy you want to apply to the volume group, you will be asked for three options while applying the encryption keys, select one and click Add.

    • Option 1: Do not update encryption keys for volumes in this volume group.

      This option will not apply an encryption key to the volume group or the volumes in the destination region.

      Add new members

    • Option 2: Use common encryption key for all volumes in this volume group.

      This option will apply a single common encryption key to all volumes that belong to the volume group, in the destination region.

      Add new members

    • Option 3: Customize volume encryption keys.

      This option will assign a unique key to each volume that belongs to the volume group, in the destination region.

      Add new members

Task 3: Generate a Switchover Plan

Switchover plan is a type of DR plan that performs a planned transition of services from the primary DR protection group to the standby DR protection group.

Create a switchover plan in standby DR protection group (DRPG_CMK_BKP_LON).

  1. Select Plans and click Create plan.

    Switchover Plan

  2. Enter Name as Switchover and select Plan type as Switchover (planned).

    Switchover Plan

  3. Click Create.

    Switchover Plan

Task 4: Execute the Switchover Plan in Standby DR Protection Group

Note:

Run the prechecks for the switchover plan created in Task 3 in the current standby region, then run the switchover plan if the prechecks succeed. Execute prechecks as an independent operation first as a best practice.

  1. Open the switchover plan in the standby region.

  2. Click Run Prechecks.

  3. Again, click Run Prechecks in the confirmation window to continue.

    Switchover precheck

    Ensure the prechecks complete successfully as shown in the following image. You may need to remediate any failed precheck steps at this point and then run the precheck again until all steps succeed.

    Switchover precheck status

  4. To run the switchover plan, click Execute plan.

  5. Again, click Execute plan in the confirmation window to continue.

    Monitor the plan execution to ensure all steps in the plan succeed.

    Run Disaster Recovery Plan

    The following image shows the successful completion of the switchover plan. However, you may encounter failed steps even though the prechecks completed successfully; there is a chance steps will fail as the recovery steps are being executed in reality. Remediate any failed steps and try again.

    Run Disaster Recovery Plan Status

Task 5: Verify the Backup Policies and Encryption on New Volume Groups and Volumes

  1. Go to the standby region, navigate to Storage, Volume Groups and look for vgapp01. You will see that the backup policy was applied to the volume group.

    Volume Group

  2. Go to Boot Volumes and verify that the Encryption key was applied.

    Boot Volume

Next Steps

There are two best practices that should be incorporated into the normal day-to-day operations to help ensure the readiness of your DR plans.

Think about scheduling weekly prechecks of all DR plans in the standby DR Protection Group. Prechecks can be run at any time and have zero impact on production workloads. This will help ensure the integrity of your DR plans, catching missing member resources, missing networks, the inability to find expected scripts called by user-defined steps and so on.

Another very important way of validating the readiness of your DR is to schedule periodic DR drills once a month or quarter. DR drills also have zero impact on production workloads, but give you the ability to validate recovery of compute, storage, Oracle databases and backend sets for load balancers in the standby region with the click of a single button. For more information, see:

Acknowledgments

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.