Restoring the Policy Workbench for AWS

Before you begin

Before starting a restore, ensure that the following prerequisites are met:

• An existing backup is available. Backups are taken automatically as part of the default installation of the Policy Workbench using scheduled backup mechanisms. The backups are available in the encrypted AWS S3 bucket that you created when you deployed PPW. You can also manually back up the data.

  For more information about the AWS S3 bucket, refer to the section Creating AWS KMS Key and S3 Bucket.

  For more information about manually backing up the data, refer to the section Backing up the Policy Workbench for AWS.

• A restored PPC cluster is available. The Policy Workbench is restored on a restored PPC cluster. For information about restoring the PPC, refer to the section Restoring the PPC for AWS.

  Note: You can restore the Policy Workbench without first restoring the PPC if only the Policy Workbench is corrupted.

  Important: Before you restore the data, ensure that Velero CLI version 1.18 or later is installed.

Restore the Policy Workbench data

To restore the data:

1. Ensure that the main.tf file in the root module, which is the working directory for executing the OpenTofu commands, contains the following code block. If the root module is not available, create a root module with the main.tf file.

   module "policy_workbench" {
     source = "oci://<Container_Registry_Path>/policy-workbench/opentofu/modules/policy-workbench/<cloud>?tag=<version>"
   
     cluster_name = var.cluster_name
   }
   
   variable "cluster_name" {
     type        = string
     description = "EKS cluster name."
     nullable    = false
   
     validation {
       condition     = length(trimspace(var.cluster_name)) > 0
       error_message = "cluster_name must be provided and cannot be empty."
     }
   }
   

   This code block adds the Policy Workbench OpenTofu module.

2. Run the following commands on the jump box.

   Note: You do not need to run these commands if you only uninstall PPW and delete the namespace. These commands are required if you destroy the PPW cluster using tofu destroy. They are also required if you are restoring to a new PPC cluster where PPW was not previously installed.

   tofu init​
   tofu plan -var="cluster_name=<Restored-PPC-cluster-name>"​
   tofu apply -var="cluster_name=<Restored-PPC-cluster-name>" 
   

   Specify the name of the restored PPC cluster as the value of the cluster_name variable.

   For information about restoring the PPC, refer to the section Restoring the PPC for AWS.

3. Run the following command on the jump box.

   velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
    --from-backup <backup-name> \
    -n pty-backup-recovery --wait
   

   For example:

   velero restore create workbench-restore-$(date +%Y%m%d-%H%M%S) \
    --from-backup workbench-backup-schedule-20260331094735 \
    -n pty-backup-recovery --wait
   

   For more information about the velero restore command, refer to the section Restore Reference in the Velero documentation.

4. Run the following command to list all the restore operations in the specific namespace.

   velero restore get -n pty-backup-recovery
   

   Ensure that the status of the restore operation is WaitingForPluginOperations.

5. Run the following command to annotate the Kubernetes resources.

   kubectl annotate productconfiguration workbench -n pty-admin kopf.zalando.org/last-handled-configuration- --overwrite
   

   The following output appears if the annotation is added successfully.

   productconfiguration.pty.com/workbench annotated
   

6. Run the following commands to monitor the restore status.

   1. Run the following command to retrieve the list of existing restores.

      velero restore get -n pty-backup-recovery
      

   2. Run the following command to obtain details of a specific restore.

      velero restore describe workbench-restore-<timestamp> -n pty-backup-recovery
      

   3. Run the following command to obtain the log details for a specific restore.

      velero restore logs workbench-restore-<timestamp> -n pty-backup-recovery
      

      Note: Verify that the log output contains no entries with level=error. Entries with level=warning are acceptable and do not indicate a restore failure.

Uninstall Policy Workbench before restoring on the same cluster

Note: Perform these steps only if you are restoring the Policy Workbench on the same cluster where it was previously installed. If you are restoring to a new cluster, skip this section.

1. Uninstall the policy-workbench module from the existing PPC cluster by running the following command on the jump box:

   helm uninstall policy-workbench -n <namespace>
   

   For example:

   helm uninstall policy-workbench -n policy-workbench
   

   The following output appears if the module is uninstalled successfully:

   release "policy-workbench" uninstalled
   

2. Delete the namespace where the Policy Workbench is installed by running the following command on the jump box:

   kubectl delete namespace <namespace>
   

   For example:

   kubectl delete namespace policy-workbench
   

   The following output appears if the namespace is deleted successfully:

   namespace "policy-workbench" deleted