Skip to main content

ADR-0127: Backup, restore and DR separate from HA, on the client's storage

Context​

Kit addendum 20.5, 20.6 and 20.10. HA protects against some node or service failures. A backup recovers from corruption, deletion or an attack. Disaster recovery restores or fails over to a secondary infrastructure.

Decision​

  • One central Backup & Recovery Manager in the console: policies, jobs, artefacts with digest and size, verifications, restores with a dry run plan, a compatibility check, approval by two people other than the requester, execution, verification and configuration rollback. Never a restore into production without a plan and an approval.
  • Backup storage is the client's, through the AWS S3, Azure Blob, GCS, IBM COS and SeaweedFS adapters. Capabilities (versioning, Object Lock, legal hold, retention) are qualified by real calls. An unverified immutability requirement is refused: no WORM feature is simulated.
  • Application aware backups: PostgreSQL by base backup and continuous WAL with point in time recovery (CloudNativePG inside Kubernetes, pgBackRest outside), etcd snapshots, native OpenSearch and Qdrant snapshots, NATS JetStream streams, Temporal state, OCI artefacts, prompts, skills, plugins and models with digests and signatures. Velero backs up Kubernetes resources but never replaces a transactional PostgreSQL backup.
  • Consistency across the parts of one application, encryption with key references, enforced retention, a separate restore privilege, and regular restore tests in an isolated environment with a signed report.
  • Disaster recovery: sites, plans, replication links, recovery sequences and exercises. Active/active only for stateless layers; active/passive, warm or cold standby for transactional data. The old primary is fenced before the secondary is promoted. RPO and RTO objectives are set by the client, and observed values are measured during exercises. The 12 or 36 month licence stays valid during DR and offline.

Consequences​

Default frequencies are not RPO or RTO guarantees. A banking audit profile on storage without verified immutability is reported as non compliant.

Evidence​

  • KIT_AGENT_PLATEFORME_IA_ENTERPRISE/ADDENDUM_INFRA_HA_BACKUP_PRA.md
  • navin-manager/server/src/navin_manager/backup
  • navin-manager/server/src/navin_manager/recovery
  • navin-manager/server/tests/test_backup_recovery.py
  • navin-manager/server/tests/test_recovery_postgres_real.py
  • navin-manager/server/tests/test_backup_apps_real.py
  • deploy/velero