Skip to main content

Backup and restore

Backing up the platform cluster is only part of recovering SKE. You also need to protect the Git repositories, buckets and services that your Promises use or provision. Decide how much data you can afford to lose and how quickly you need to restore the platform. Then test your provider's restore procedure in an isolated environment.

Prerequisites​

  • A backup tool supported by your cluster provider and access to its recovery documentation.
  • A record of installed component versions, configuration and external dependencies.
  • Secure recovery access to credentials and encryption keys.
  • An isolated target environment for a restore rehearsal.

Provider guidance includes Amazon EKS, Google GKE, Microsoft AKS and OpenShift.

Inventory what to protect​

Use this list to identify what your backups must cover. Some items need separate backups outside the platform cluster.

  1. Record the Operator, SKE and optional component versions, Helm values or manifests, Kratix, SKEIntegration and PortalCustomization resources, and customised ConfigMaps such as kratix and portal configuration.
  2. Include Promises, resource requests, Destinations, StateStores, HealthDefinition, HealthSource, and Promise upgrade objects where used. Retain the CRDs required to read them.
  3. Protect referenced Secrets: registry pull credentials, release-storage credentials, StateStore credentials, portal credentials and custom TLS certificates. Include cert-manager configuration if it manages certificates.
  4. Back up or retain the external Git and bucket contents used for workload output, resource request input, portal catalogue output and health records. Record paths and ownership.
  5. Follow each Promise's recovery requirements for provisioned infrastructure and application data. A resource request describes desired state; it is not a backup of the resulting service's data.

Plan restore dependency order​

Reconciliation can change external systems

Restored controllers and GitOps agents can resume applying desired state. Before a rehearsal, isolate the target from production stores and services and review credentials and endpoints. Coordinate recovery of the platform and provisioned resources before resuming reconciliation.

Restore each dependency before the components that use it. Use your backup tool's ordering controls to follow this sequence:

  1. Restore namespaces and the CRDs needed by cert-manager, GitOps agents, the Operator and SKE.
  2. Restore their required configuration and Secrets, then install the matching component versions using your recorded installation method. Verify controllers and webhooks are ready.
  3. Restore StateStores, Destinations and optional integration configuration with their dependencies available.
  4. Restore Promises before their resource requests, because each Promise supplies its request CRD. Restore health and upgrade objects after their referenced resources exist.
  5. Check that workflows can write to the restored StateStores and that Destination GitOps agents can apply the output. If you use a portal, check catalogue updates and request submission too. Follow your recovery plan when re-enabling these components, before giving developers access.

See Velero resource filtering and GKE restore ordering for tool-specific controls. Confirm your provider's ordering behaviour during the rehearsal.

Verify recovery​

Compare restored versions, objects and configuration against your records. Check that controllers are ready, Promises are available and resource requests have the expected status. For Kubernetes workloads, confirm the Destination GitOps agents apply the restored output. If you use health checks or a portal, check that health status and catalogue entries update. Test each provisioned service and its data using that service's recovery checks.

Record how long recovery took, what was missing and how you fixed it. Keep these steps in your recovery plan and repeat the test when your platform configuration or dependencies change.

Troubleshooting and next steps​

Missing resource kinds indicate CRDs or Promises have not been restored yet. Certificate and authentication failures often indicate a missing Secret or a reference to the previous environment. Use Troubleshoot SKE to inspect readiness and events; contact Syntasso support for unresolved SKE recovery issues.