This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Restoring the Policy Workbench

Restoring the Policy Workbench data for AWS and Azure.

The Policy Workbench supports restoring data from daily scheduled backups or manual backups created using Velero. This section describes how to restore the Policy Workbench from a backup on AWS and Azure deployments.

1 - Restoring the Policy Workbench for AWS

Restore the Policy Workbench data for AWS using an existing backup.

Before you begin

Before starting a restore, ensure that the following prerequisites are met:

  • An existing backup is available. Backups are taken automatically as part of the default installation of the Policy Workbench using scheduled backup mechanisms. The backups are available in the encrypted AWS S3 bucket that you created when you deployed PPW. You can also manually back up the data.

    For more information about the AWS S3 bucket, refer to the section Creating AWS KMS Key and S3 Bucket.

    For more information about manually backing up the data, refer to the section Backing up the Policy Workbench for AWS.

  • A restored PPC cluster is available. The Policy Workbench is restored on a restored PPC cluster. For information about restoring the PPC, refer to the section Restoring the PPC for AWS.

    Note: You can restore the Policy Workbench without first restoring the PPC if only the Policy Workbench is corrupted.

    Important: Before you restore the data, ensure that Velero CLI version 1.18 or later is installed.

Restore the Policy Workbench data

To restore the data:

  1. Ensure that the main.tf file in the root module, which is the working directory for executing the OpenTofu commands, contains the following code block. If the root module is not available, create a root module with the main.tf file.

    module "policy_workbench" {
  source = "oci://<Container_Registry_Path>/policy-workbench/opentofu/modules/policy-workbench/<cloud>?tag=<version>"

  cluster_name = var.cluster_name
}

variable "cluster_name" {
  type        = string
  description = "EKS cluster name."
  nullable    = false

  validation {
    condition     = length(trimspace(var.cluster_name)) > 0
    error_message = "cluster_name must be provided and cannot be empty."
  }
}

    This code block adds the Policy Workbench OpenTofu module.

  2. Run the following commands on the jump box.

    Note: You do not need to run these commands if you only uninstall PPW and delete the namespace. These commands are required if you destroy the PPW cluster using tofu destroy. They are also required if you are restoring to a new PPC cluster where PPW was not previously installed.

    tofu init​
tofu plan -var="cluster_name=<Restored-PPC-cluster-name>"​
tofu apply -var="cluster_name=<Restored-PPC-cluster-name>"

    Specify the name of the restored PPC cluster as the value of the cluster_name variable.

    For information about restoring the PPC, refer to the section Restoring the PPC for AWS.

  3. Run the following command on the jump box.

    velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
 --from-backup <backup-name> \
 -n pty-backup-recovery --wait

    For example:

    velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
 --from-backup workbench-backup-schedule-20260331094735 \
 -n pty-backup-recovery --wait

    For more information about the velero restore command, refer to the section Restore Reference in the Velero documentation.

  4. Run the following command to list all the restore operations in the specific namespace.

    velero restore get -n pty-backup-recovery

    Ensure that the status of the restore operation is WaitingForPluginOperations.

  5. Run the following command to annotate the Kubernetes resources.

    kubectl annotate productconfiguration workbench -n pty-admin kopf.zalando.org/last-handled-configuration- --overwrite

    The following output appears if the annotation is added successfully.

    productconfiguration.pty.com/workbench annotated

  6. Run the following commands to monitor the restore status.

    1. Run the following command to retrieve the list of existing restores.

      velero restore get -n pty-backup-recovery

    2. Run the following command to obtain details of a specific restore.

      velero restore describe workbench-restore-<timestamp> -n pty-backup-recovery

    3. Run the following command to obtain the log details for a specific restore.

      velero restore logs workbench-restore-<timestamp> -n pty-backup-recovery

      Note: Verify that the log output contains no entries with level=error. Entries with level=warning are acceptable and do not indicate a restore failure.

Uninstall Policy Workbench before restoring on the same cluster

Note: Perform these steps only if you are restoring the Policy Workbench on the same cluster where it was previously installed. If you are restoring to a new cluster, skip this section.

  1. Uninstall the policy-workbench module from the existing PPC cluster by running the following command on the jump box:

    helm uninstall policy-workbench -n <namespace>

    For example:

    helm uninstall policy-workbench -n policy-workbench

    The following output appears if the module is uninstalled successfully:

    release "policy-workbench" uninstalled

  2. Delete the namespace where the Policy Workbench is installed by running the following command on the jump box:

    kubectl delete namespace <namespace>

    For example:

    kubectl delete namespace policy-workbench

    The following output appears if the namespace is deleted successfully:

    namespace "policy-workbench" deleted

2 - Restoring the Policy Workbench for Azure

Restore the Policy Workbench data for Azure using an existing backup.

Before you begin

Before starting a restore, ensure that the following prerequisites are met:

  • An existing backup is available. Backups are taken automatically as part of the default installation of the Policy Workbench using scheduled backup mechanisms. The backups are available in the encrypted Azure Blob Storage container that is created by the PPC installation. You can also manually back up the data.

    For more information about the Azure Blob Storage container, refer to the section Creating Azure Storage Account and Container.

    For more information about manually backing up the data, refer to the section Backing up the Policy Workbench for Azure.

  • A restored PPC cluster is available. The Policy Workbench is restored on a restored PPC cluster. For information about restoring the PPC, refer to Restoring the PPC on Azure.

    Note: You can restore the Policy Workbench without first restoring the PPC if only the Policy Workbench is corrupted.

    Important: Before you restore the data, ensure that Velero CLI version 1.18 or later is installed.

Restore the Policy Workbench data

To restore the data:

  1. Ensure that the main.tf file in the root module, which is the working directory for executing the OpenTofu commands, contains the following code block. If the root module is not available, create a root module with the main.tf file.

    module "policy_workbench" {
  source = "oci://<Container_Registry_Path>/policy-workbench/opentofu/modules/policy-workbench/<cloud>?tag=<version>"

  cluster_name = var.cluster_name
}

variable "cluster_name" {
  type        = string
  description = "AKS cluster name."
  nullable    = false

  validation {
    condition     = length(trimspace(var.cluster_name)) > 0
    error_message = "cluster_name must be provided and cannot be empty."
  }
}

    This code block adds the Policy Workbench OpenTofu module.

  2. Run the following commands on the jump box.

    Note: You do not need to run these commands if you only uninstall PPW and delete the namespace. These commands are required if you destroy the PPW cluster using tofu destroy. They are also required if you are restoring to a new PPC cluster where PPW was not previously installed.

    tofu init​
tofu plan -var="cluster_name=<Restored-cluster-name>"​
tofu apply -var="cluster_name=<Restored-cluster-name>"

    Specify the name of the restored PPC cluster as the value of the cluster_name variable.

    For information about restoring the PPC, refer to the section Restoring the PPC on Azure.

  3. Run the following command on the jump box.

    velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
--from-backup <backup-name> \
--resource-modifier-configmap workbench-restore-resource-modifier \
-n <Namespace where data is backed up> --wait

    For example:

    velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
--from-backup workbench-backup-schedule-20260702112543 \
--resource-modifier-configmap workbench-restore-resource-modifier \
-n pty-backup-recovery --wait

    The following output appears if the restore operation is completed successfully:

    Restore request "workbench-restore-20260702112543" submitted successfully.
Waiting for restore to complete. You may safely press Ctrl+C to stop waiting, but the restore will continue to run in the background.

    After the restore operation is completed, the following output appears:

    Restore completed with status: Completed. You may check for more information using the commands `velero restore describe workbench-restore-20260702-112955` and `velero restore logs workbench-restore-20260702-112955`.

    For more information about the velero restore command, refer to the section Restore Reference in the Velero documentation.

  4. Run the following command to list all the restore operations in the specific namespace.

    velero restore get -n pty-backup-recovery

    Ensure that the status of the restore operation is WaitingForPluginOperations.

  5. Run the following command to annotate the Kubernetes resources.

    kubectl annotate productconfiguration workbench -n pty-admin \
kopf.zalando.org/last-handled-configuration- --overwrite

    The following output appears if the annotation is added successfully.

    productconfiguration.pty.com/workbench annotated

  6. Run the following commands to monitor the restore status.

    1. Run the following command to retrieve the list of existing restores.

      velero restore get -n pty-backup-recovery

      The following output appears if the restore operation is completed successfully.

      NAME                                BACKUP                                      STATUS      STARTED                         COMPLETED                       WARNINGS    ERRORS   CREATED                         SELECTOR
workbench-restore-20260702-112955   workbench-backup-schedule-20260702112543    Completed   2026-07-02 11:29:55 +0000 UTC   2026-07-02 11:30:55 +0000 UTC   0           11       2026-07-02 11:29:55 +0000 UTC   <none>

    2. Run the following command to obtain details of a specific restore.

      velero restore describe workbench-restore-<timestamp> -n pty-backup-recovery

      For example:

      velero restore describe workbench-restore-20260702-112955 -n pty-backup-recovery

      The following output appears if the restore operation is completed successfully.

      Name:         workbench-restore-20260702-112955
Namespace:    pty-backup-recovery
Labels:       app.kubernetes.io/managed-by=Helm
              deployment=policy-workbench
              velero.io/schedule-name=workbench-backup-schedule
              velero.io/storage-location=default
Annotations:  <none>

  Phase:  Completed

    3. Run the following command to obtain the log details for a specific restore.

      velero restore logs workbench-restore-<timestamp> -n pty-backup-recovery

      For example:

      velero restore logs workbench-restore-20260702-112955 -n pty-backup-recovery

      The following code block shows a snippet of the output.

      time="2026-07-02T11:30:01Z" level=warning msg="No annotations found in policy-workbench/sh.helm.release.v1.policy-workbench.v1, using restore spec setting: false" groupResource=secrets logSource="pkg/restore/restore.go:2630" namespace=policy-workbench original name=sh.helm.release.v1.policy-workbench.v1 restore=pty-backup-recovery/workbench-restore-20260702-112955

      Note: Verify that the log output contains no entries with level=error. Entries with level=warning are acceptable and do not indicate a restore failure.

Uninstall Policy Workbench before restoring on the same cluster

Note: Perform these steps only if you are restoring the Policy Workbench on the same cluster where it was previously installed. If you are restoring to a new cluster, skip this section.

  1. Uninstall the policy-workbench module from the existing PPC cluster by running the following command on the jump box:

    helm uninstall policy-workbench -n <namespace>

    For example:

    helm uninstall policy-workbench -n policy-workbench

    The following output appears if the module is uninstalled successfully:

    release "policy-workbench" uninstalled

  2. Delete the namespace where the Policy Workbench is installed by running the following command on the jump box:

    kubectl delete namespace <namespace>

    For example:

    kubectl delete namespace policy-workbench

    The following output appears if the namespace is deleted successfully:

    namespace "policy-workbench" deleted