Prerequisites for restoring the PPC deployment

Before you begin

Before starting a restore, ensure the following conditions are met:

• An existing backup is available. Backups are taken automatically as part of the default installation using scheduled backup mechanisms. These backups are stored in a Storage Account configured during the original installation.

• Access to the original backup Storage Account. During restore, the same Storage Account that was used during the original installation must be specified.

• Permissions to read from the Storage Account. The user performing the restore must have sufficient permissions to access the backup data stored in the account.

• Use the restore procedure that matches your target environment. Restoring the PPC using the bootstrap script restores as part of a fresh AKS cluster installation. Restoring the PPC onto an existing AKS cluster restores PPC onto an existing AKS cluster. The in-cluster procedure does not create the AKS cluster.

• Ensure that the storage_class_name in iac/azure/c luster/modules/05_helm_releases/terraform.tfvars file is the same for the targeted restore cluster and the source PPC cluster. The backup is created on the source PPC cluster. If this value differs, the restore operation fails.

• Do not perform Create, Read, Update, or Delete (CRUD) operations on the source cluster during the backup. This ensures backup consistency and prevents data corruption during restore.

• Before restoring to a new cluster, if the source cluster is accessible, disable the backup operations. Do this by setting the backup storage location to read‑only. This ensures that no additional backup data is written during the restore process.

  To disable the backup operation on the source cluster, run the following command:

  kubectl patch backupstoragelocation default -n pty-backup-recovery --type merge -p '{"spec":{"accessMode":"ReadOnly"}}'
  

  If the source cluster is not accessible, this step can be skipped.

Required tools on the jump box

The restore bootstrap script installs or updates the following tools on the jump box. If you install tools manually, ensure these are available before running the script:

• Azure CLI - Required to communicate with your Microsoft Azure account.
• OpenTofu - Required to manage infrastructure as code.
• kubectl - Required to communicate with the Kubernetes cluster.
• Helm - Required to manage Kubernetes packages.
• jq - Required to parse JSON.
• skopeo - Required to copy container images between registries.
• bc - Required for version comparisons and resource calculations.
• ORAS - Required to pull OCI artifacts such as deployment packages.
• ssh-keygen - Required to secure SSH access to deployment environments.
• cmctl - Required to validate and manage TLS certificates.

During Disaster management, the backup data is used to restore the cluster and the OpenSearch indexes using snapshots. However, Insight restores OpenSearch data only from the most recent snapshot created by the daily-insight-snapshots policy.
For more information, refer to Backing up and restoring indexes.

Warning: Do not install or manage multiple clusters from the same working directory. Each cluster deployment maintains its own Terraform/OpenTofu state. Reusing a directory can overwrite state files, causing loss of cluster tracking and unintended cleanup behavior.
Use a dedicated directory and jump box per cluster, where possible. Always verify the active kubectl context before running cleanup commands such as ./bootstrap.sh --cloud azure destroy.