Chapter 2. Restoring from a backup You can restore Red Hat Advanced Cluster Security for Kubernetes from an existing backup by using the roxctl command-line interface (CLI). Depending upon your requirements and the data you have backed up, you can restore from the following types of backups: Restore Central database from the Central database backup : Use this to recover from a database failure or data corruption event. It allows you to restore and recover the Central database to its earlier functional state. Restore Central from the Central deployment backup : Use this if you are migrating Central to another cluster or namespace. This option restores the configurations of your Central installation. 2.1. Restoring Central database by using the roxctl CLI You can use the roxctl CLI to restore Red Hat Advanced Cluster Security for Kubernetes by using the restore command. You require an API token or your administrator password to run this command. 2.1.1. Restoring by using an API token You can restore the entire database of RHACS by using an API token. Prerequisites You have a RHACS backup file. You have an API token with the administrator role. You have installed the roxctl CLI. Procedure Set the ROX_API_TOKEN and the ROX_ENDPOINT environment variables by running the following commands: USD export ROX_API_TOKEN=<api_token> USD export ROX_ENDPOINT=<address>:<port_number> Restore the Central database by running the following command: USD roxctl central db restore <backup_file> 1 1 For <backup_file> , specify the name of the backup file that you want to restore. 2.1.2. Restoring by using the administrator password You can restore the entire database of RHACS by using your administrator password. Prerequisites You have a RHACS backup file. You have the administrator password. You have installed the roxctl CLI. Procedure Set the ROX_ENDPOINT environment variable by running the following command: USD export ROX_ENDPOINT=<address>:<port_number> Restore the Central database by running the following command: USD roxctl -p <admin_password> \ 1 central db restore <backup_file> 2 1 For <admin_password> , specify the administrator password. 2 For <backup_file> , specify the name of the backup file that you want to restore. 2.1.3. Resuming the restore operation If your connection is interrupted during a restore operation or you need to go offline, you can resume the restore operation. If you do not have access to the machine running the resume operation, you can use the roxctl central db restore status command to check the status of an ongoing restore operation. If the connection is interrupted, the roxctl CLI automatically attempts to restore a task as soon as the connection is available again. The automatic connection retries depend on the duration specified by the timeout option. Use the --timeout option to specify the time in seconds, minutes or hours after which the roxctl CLI stops trying to resume a restore operation. If the option is not specified, the default timeout is 10 minutes. If a restore operation gets stuck or you want to cancel it, use the roxctl central db restore cancel command to cancel a running restore operation. If a restore operation is stuck, you have canceled it, or the time has expired, you can resume the restore by running the original command again. Important During interruptions, RHACS caches an ongoing restore operation for 24 hours. You can resume this operation by executing the original restore command again. The --timeout option only controls the client-side connection retries and has no effect on the server-side restore cache of 24 hours. You cannot resume restores across Central pod restarts. If a restore operation is interrupted, you must restart it within 24 hours and before restarting Central, otherwise RHACS cancels the restore operation. 2.2. Restoring Central deployment using the roxctl CLI You can restore your Central deployment to its original configuration by using the backups you made. You must first restore certificates by using the roxctl CLI, and then restore the Central deployment by running the Central installation scripts. 2.2.1. Restore certificates using the roxctl CLI Use the roxctl CLI to generate Kubernetes manifests to install the RHACS Central component to your cluster. Doing this allows you to ensure that authentication certificates for Secured clusters and the API tokens remain valid for the restored version. If you backed up another instance of RHACS Central, you can use the certificate files from that backup. Note With the roxctl CLI, you can not restore the entire Central deployment. Instead, first you use the roxctl CLI to generate new manifests using the certificates in your central data backup. Afterwards, you use those manifests to install Central. Prerequisites You must have the Red Hat Advanced Cluster Security for Kubernetes backup file. You must have installed the roxctl CLI. Procedure Run the interactive install command: USD roxctl central generate interactive For the following prompt, enter the path of the Red Hat Advanced Cluster Security for Kubernetes backup file: Enter path to the backup bundle from which to restore keys and certificates (optional): _<backup-file-path>_ For other following prompts, press Enter to accept the default value or enter custom values as required. On completion, the interactive install command creates a folder named central-bundle , which has the necessary YAML manifests and scripts to deploy Central. 2.2.2. Running the Central installation scripts After you run the interactive installer, you can run the setup.sh script to install Central. Procedure Run the setup.sh script to configure image registry access: USD ./central-bundle/central/scripts/setup.sh To enable the policy as code feature (Technology Preview), manually apply the config.stackrox.io CRD that is located in the .zip file at helm/chart/crds/config.stackrox.io_securitypolicies.yaml . Important Policy as code is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . To apply the CRD, run the following command: Create the necessary resources: Check the deployment progress: After Central is running, find the RHACS portal IP address and open it in your browser. Depending on the exposure method you selected when answering the prompts, use one of the following methods to get the IP address. Exposure method Command Address Example Route oc -n stackrox get route central The address under the HOST/PORT column in the output https://central-stackrox.example.route Node Port oc get node -owide && oc -n stackrox get svc central-loadbalancer IP or hostname of any node, on the port shown for the service https://198.51.100.0:31489 Load Balancer oc -n stackrox get svc central-loadbalancer EXTERNAL-IP or hostname shown for the service, on port 443 https://192.0.2.0 None central-bundle/central/scripts/port-forward.sh 8443 https://localhost:8443 https://localhost:8443 Note If you have selected autogenerated password during the interactive install, you can run the following command to see it for logging into Central: USD cat central-bundle/password 2.3. Restore Central deployment using the RHACS Operator You can restore your Central deployment to its original configuration by using the RHACS Operator. To successfully restore, you need the backup of your Central custom resource, central-tls , and the administrator password. Prerequisites You must have the central-tls backup file. You must have the Central custom resource backup file. You must have the administrator password backup file. Procedure Use the central-tls backup file to create resources: USD oc apply -f central-tls.json Use the central-htpasswd backup file to create secrets: USD oc apply -f central-htpasswd.json Use the central-cr.yaml file to create the Central deployment: USD oc apply -f central-cr.yaml 2.4. Restore Central deployment using Helm You can restore your Central deployment to its original configuration by using Helm. To successfully restore, you need the backup of your Central custom resource, the central-tls secret, and the administrator password. Prerequisites You must have the Helm values backup file. You must have a Red Hat Advanced Cluster Security for Kubernetes backup file. You must have installed the roxctl CLI. Procedure Generate values-private.yaml from the RHACS database backup file: USD roxctl central generate k8s pvc --backup-bundle _<path-to-backup-file>_ --output-format "helm-values" Run the helm install command and specify your backup files: USD helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f central-values-backup.yaml -f central-bundle/values-private.yaml 2.5. Restoring central to another cluster or namespace You can use the backups of the RHACS Central database and the deployment to restore Central to another cluster or namespace. The following list provides a high-level overview of installation steps: Depending upon your installation method, you must first restore Central deployment by following the instructions in the following topics: Important Make sure to use the backed-up Central certificates so that secured clusters and API tokens issued by the old Central instance remain valid. If you are deploying to another namespace, you must change the namespace in backed-up resources or commands. Restoring Central deployment using the roxctl CLI Restore Central deployment using the RHACS Operator Restore Central deployment using Helm Restore Central database by following the instruction in the Restoring Central database by using the roxctl CLI topic. If you have an external DNS entry pointing to your old RHACS Central instance, you must reconfigure it to point to the new RHACS Central instance that you create.

Commands:
export ROX_API_TOKEN=<api_token>
export ROX_ENDPOINT=<address>:<port_number>
roxctl central db restore <backup_file> 1
export ROX_ENDPOINT=<address>:<port_number>
roxctl -p <admin_password> \ 1 central db restore <backup_file> 2
roxctl central generate interactive
Enter path to the backup bundle from which to restore keys and certificates (optional): _<backup-file-path>_
./central-bundle/central/scripts/setup.sh
cat central-bundle/password
oc apply -f central-tls.json
oc apply -f central-htpasswd.json
oc apply -f central-cr.yaml
roxctl central generate k8s pvc --backup-bundle _<path-to-backup-file>_ --output-format "helm-values"
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f central-values-backup.yaml -f central-bundle/values-private.yaml