Configure and retain Backups

A full appliance backup contains cluster state and machine configuration, physical and logical database captures, the selected GitOps configuration with captured Git history, and the selected HSM library when one is configured. Applications keep running during capture. The components are not all captured at the same instant.

Capture can run while Management’s temporary cluster access is open. The backup stores the persistent machine configuration with external Kubernetes API and registry access closed. Other differences between active and persistent machine configuration, or persistent configuration changes during capture, cause capture to fail.

Independent database recovery points contain database data only. They cannot replace a full backup for appliance recovery. Management does not offer failed full runs or their component files as downloadable backups.

Full backups exclude metrics history, log history, and Grafana’s local database and UI-created state. Provisioned Grafana configuration remains part of GitOps. External HSM keys require the HSM vendor’s backup procedure.

Changing the hourly schedule may interrupt an hourly capture in progress and starts a fresh backup. Cleanup applies changed retention settings to existing local backups, so reducing retention can remove older completed backups. External copies are unchanged. A successful settings save records the configuration; it does not prove that the next capture or external transfer will succeed.

The Encryption section shows the public backup recipient. The artifact bundle holds the private recovery keys. Changing the encryption recipient requires a separate procedure that preserves old recovery keys and updates the artifact bundle. Changing a backup destination does not rotate encryption keys.

Backup scheduling waits until the appliance verifies that its encryption admission policy is active on every serving Kubernetes API server. If initial backup setup remains pending, inspect Flux status and the backup-admission-ready Job in flux-system through Headlamp. Correct the reported API-server or policy problem; do not bypass the encryption check to start captures.

Backups continue on the appliance without Management or an active Management connection. External publication copies completed full bundles to each enabled destination; hourly database points remain local.

The destination administrator owns external retention and protection. Configure protected retention or snapshots there, and credentials that cannot delete protected backups. Appliance cleanup does not delete external copies.

Local retention can expire a backup even when its external transfer failed. Monitor export failures and verify destination files. The number of retained bundles does not limit their total size. Monitor capacity as well.

An export Job makes up to three attempts. Once those attempts fail, cleanup automatically dispatches another transfer while the backup remains retained locally. Cleanup runs every minute by default and leaves active transfers running. Retry timing also depends on cleanup completion, Kubernetes scheduling and propagation of updated connection settings.

Retries use the destination name and path recorded with the backup, together with the current credentials, host and host-key trust. Changing the destination path affects newly captured backups.

To retry after correcting the destination:

You do not need to delete failed Jobs to retry. Cleanup retains the first failed export Job for logs and alerts until its normal 24-hour expiry or a recorded successful export. After it observes success, cleanup removes the remaining failed Jobs and their Pod logs; monitoring then clears their export-failure alerts. Preserve any needed diagnostics before that cleanup. An alert clearing alone does not confirm a successful transfer.

If cluster access expired, reconnect, return to Appliance > Retained backups, and restart the download. An already-started transfer is not always explicitly cancelled at expiry, but closure of cluster network access can interrupt it. Do not rely on it finishing after access expires. Restart interrupted transfers from Management.

If retention removed the file, refresh the list and select an available backup. If storage cannot be reached, inspect health and logs. An empty list means no eligible completed backups are available; it does not confirm a successful backup schedule.