Restoring the PPC using in-cluster deployment

Before you begin

Use this procedure to restore PPC from an existing backup onto an existing AWS EKS cluster. The cluster and its supporting resources must already be provisioned; this procedure does not create an EKS cluster. The backup must be available in the original AWS S3 Account. The target cluster must be able to access it. Also confirm that storage_class_name matches the storage class used on the source cluster. Review the in-cluster deployment prerequisites before proceeding.

For more information about backing up the PPC, refer to Backing up the PPC.

Listing the backups created on the source cluster

To obtain a list of available PPC backups, run the following command:

kubectl get backups -n pty-backup-recovery \
  -l velero.io/schedule-name=authnz-postgresql-schedule-backup \
  -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,COMPLETED:.status.completionTimestamp \
  --sort-by=.status.completionTimestamp

To obtain a list of available Insight backups, run the following command:

kubectl get backups -n pty-backup-recovery \
  -l velero.io/schedule-name=insight-configmaps-secrets \
  -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,COMPLETED:.status.completionTimestamp \
  --sort-by=.status.completionTimestamp

Alternatively, the backup names can be obtained from the AWS S3 bucket.

Note: Note the name of the backup, which is required to perform the restore option. This information is required in the terraform.tfvars file.

Restoring PPC using in-cluster deployment

Complete the following steps in order as mentioned. Follow the below mentioned steps for in-cluster deployment instructions.

Updating terraform.tfvars for restore

To restore the terraform.tfvars file, perform the following steps:

1. Navigate to the Helm releases module directory.

   cd iac/aws/cluster/modules/05_helm_releases
   

2. Set the following variables in the terraform.tfvars file.

   Variable	Description
   architecture	Worker node architecture: amd64 or arm64.
   aws_region	AWS region where the EKS cluster is deployed.
   backup_bucket	S3 bucket used for PPC backups.
   backup_bucket_kms_arn	KMS key ARN used to encrypt the backup bucket.
   backup_storage_class_name	StorageClass used for backup PVCs and snapshots.
   eks_cluster_name	Name of the existing EKS cluster.
   global_image_reg	Container image registry endpoint: <Container_Registry_Path>. Note: If deploying from the Protegrity Container Registry, use registry.protegrity.com:9443. Specify the local registry endpoint if a local registry is used.
   harbor_secret	Kubernetes secret used for an authenticated private registry. Set to harbor-secret, or leave empty for an unauthenticated registry.
   ingress_fqdn	Fully qualified domain name for the PPC ingress.
   node_os	Worker node OS image string, such as BOTTLEROCKET_x86_64_FIPS.
   owner_email	Email address of the cluster owner.
   private_subnet_ids	IDs of the private subnets used by the cluster, one per Availability Zone.
   pty-bkp	Backup StorageClass used by Velero for snapshot storage.
   storage_class_name	Existing storage class used for PPC workloads.
   vpc_cidr_block	CIDR block of the VPC containing the EKS cluster.

   For more information about the configuration of variables, refer to In-cluster deployment.

   Note: Registry credentials are passed as environment variables (TF_VAR_username and TF_VAR_password), they are not set directly in terraform.tfvars file.

3. Add the following variables to terraform.tfvars. Set each to the value shown before allowing Stage 05 to apply.

   run_readiness_check = true
   check_prev_stage    = false
   

   These variables ensure that PPC performs a readiness check on the existing EKS environment. They skip the previous automated stage validation. That validation is not required because those resources were created outside the installer.

4. Set the restore values in the same file.

   restore             = true                                # Set to true to restore from a previous backup
   
   backup_name         = "authnz-postgresql-schedule-backup" # Velero backup name used when restore = true
   
   insight_backup_name = ""                                  # Insight Velero backup name (K8s resources only); leave empty to auto-resolve latest
   

   Note: The backup_name must be a real Velero backup name, not the schedule name. The shipped default backup_name = "authnz-postgresql-schedule-backup" is a schedule name, not an actual backup. Tofu passes it verbatim into keycloak.dr.backupName, so with the default value the restore silently no-ops. The actual backup name must be listed, such as, aws s3 ls s3:///velero/backups/. Additionally, set the exact timestamped name, such as, authnz-postgresql-schedule-backup-20260928100004.

5. Save the file and exit the editor.

6. Continue with Step 9: Running the readiness check and Step 10: Applying the OpenTofu configuration. Review the plan and confirm that it targets the intended cluster and backup before applying it.