Restoring the PPC onto an existing AKS cluster

Complete the steps provided in this section to restore a PPC deployment using an existing backup onto an existing Azure Kubernetes Service (AKS) cluster.

Before you begin

Use this procedure to restore PPC from an existing backup onto an existing AKS cluster. The cluster and its supporting resources must already be provisioned; this procedure does not create an AKS cluster. Confirm that the backup is available in the original Azure Storage Account and that the target cluster can access it. Also confirm that storage_class_name matches the storage class used on the source cluster. Review the in-cluster deployment prerequisites before proceeding.

Finding the backup names in Azure Storage

Before editing the restore settings, find the backup names in the Azure portal:

Sign in to the Azure portal with an account that can access the backup Storage Account.
Open the Azure Storage Account that contains the backups.
Go to Data storage > Containers > velero, then open the Velero/backups folder.
Note: velero is the default storage container name. If a different container name was configured when the source cluster was created, use that name in the Azure portal. Set storage_container_name to the same value in the restore configuration.
Choose the Velero backup for the restore point you want and record its full name, including the timestamp. The name follows this pattern: authnz-postgresql-schedule-backup-<timestamp>.
Record the corresponding Insight backup name if you are restoring Insight data. It follows this pattern: insight-configmaps-secrets-<timestamp>. The timestamp varies by backup; copy the exact name shown in the portal.

Use the recorded names for backup_name and insight_backup_name in the terraform.tfvars restore configuration. Replace the placeholders with the exact names from the portal, including their timestamps.

Restoring PPC using in-cluster deployment

Complete the following steps in order. Follow the in-cluster deployment links for Steps 1 through 7, and 9 and 10. For Step 8, use the restore-specific instructions on this page below the table instead of navigating to the in-cluster deployment instructions.

Step	Action	Purpose
1	Preparing a jump box	Creates or identifies a jump box with network access to the AKS API server.
2	Downloading and extracting the release archive	Get the PPC release archive onto the jump box.
3	Installing required tools	Installs the CLI tools needed to configure and restore PPC.
4	Logging in to Azure CLI	Authenticates with Azure and selects the target subscription.
5	Configuring AKS access	Retrieves AKS credentials for `kubectl` and Helm.
6	Verifying cluster connectivity	Confirms that the jump box can reach the cluster and that nodes are ready.
7	Gathering values for `terraform.tfvars`	Collects cluster-specific values, including storage classes, network settings, registry credentials, and federated credentials.
8	Updating `terraform.tfvars` for restore	Set the deployment values and restore parameters.
9	Running the readiness check	Resolve reported errors before applying the configuration.
10	Applying the OpenTofu configuration	Apply the Helm releases configuration to restore PPC.

Updating terraform.tfvars for restore

To update the terraform.tfvars file, perform the following steps:

Navigate to the Helm releases module directory.

cd iac/azure/cluster/modules/05_helm_releases

Set the following variables in the terraform.tfvars file.

Variable	Description
`aks_cluster_name`	AKS cluster.
`azure_subscription_id`	Azure subscription ID.
`backup_storage_class_name`	Storage class used for backup volumes.
`node_pool_name`	AKS user node pool name.
`opensearch_uami_client_id`	Client or Object ID of the OpenSearch user-assigned managed identity.
`pod_cidr`	Pod network CIDR range.
`resource_group_name`	Azure resource group containing the cluster.
`storage_account_name`	Azure storage account used by Velero for backups.
`storage_class_name`	Existing storage class on the cluster.
`storage_container_name`	Azure Blob Storage container used by Velero for backups. Defaults to `velero`.
`velero_uami_client_id`	Client or Object ID of the Velero user-assigned managed identity.
`subnet_id`	The full subnet resource ID.
`ingress_fqdn`	The application hostname (a real, resolvable FQDN).
`global_image_reg`	Container registry host: `<Container_Registry_Path>`. Note: If deploying from the Protegrity Container Registry, use `registry.protegrity.com:9443`. Specify the local registry endpoint if a local registry is used.
`harbor_secret`	Only if the registry needs to be authenticated

Note: Registry credentials are passed as environment variables (TF_VAR_username and TF_VAR_password) and are not set directly in terraform.tfvars.

Add the following variables to terraform.tfvars before allowing Stage 05 to apply.

run_readiness_check = true
check_prev_stage    = false

These variables ensure that PPC performs a readiness check on the existing AKS environment. They skip the previous automated stage validation, since those resources were created outside the installer.

Set the restore values in the same file.

restore             = true
backup_name         = "authnz-postgresql-schedule-backup-<timestamp>"
insight_backup_name = "insight-configmaps-secrets-<timestamp>"

Variable	Value
`restore`	Set to `true` to restore from an existing backup.
`backup_name`	Replace the placeholder with the full Velero backup name from Azure Storage. The name follows `authnz-postgresql-schedule-backup-<timestamp>`. Refer to Finding the backup names in Azure Storage.
`insight_backup_name`	Replace the placeholder with the exact Insight backup name from Azure Storage, following `insight-configmaps-secrets-<timestamp>`. Leave empty only to automatically select the latest Insight backup. Refer to Finding the backup names in Azure Storage.

Save the file and exit the editor.
Continue with Step 9: Running the readiness check and Step 10: Applying the OpenTofu configuration. Review the plan and confirm that it targets the intended cluster and backup before applying it.

Last modified : November 03, 2026

Feedback

Was this page helpful?