Vault: Backup & Restore

[christiaan78]

Vault Backup & Restore

Goal

Implement a reliable and repeatable backup and restore capability for Vault so the platform can recover from accidental deletion, misconfiguration, or cluster loss with minimal data loss.

Why

Vault is a critical dependency (secrets, credentials, operators). Without a tested restore path, any outage or rebuild becomes high-risk and time-consuming. A documented, automated approach also strengthens the “production-like” credibility of this lab.

Scope

• Define the backup strategy appropriate for the Vault deployment mode (e.g., integrated storage/Raft vs external backend).
• Implement scheduled backups and retention.
• Store backups in a durable off-cluster location (e.g., object storage) with encryption.
• Provide a documented, step-by-step restore procedure and validation checks.
• Run a restore test and capture evidence (logs/screenshots/notes) for the demo docs.

Definition of Done

• Backups run on a schedule and produce versioned artifacts.

• Backups are stored off-cluster with retention configured.

• Restore procedure is documented and reproducible.

• A restore test is executed successfully:

  • Vault starts healthy
  • expected secrets/paths are present
  • consumers (e.g., VSO / apps) can read secrets again

• A short “lessons learned” section is added to docs.

Acceptance Criteria / Validation

• vault status healthy post-restore (sealed/unsealed state handled as expected).
• Can retrieve a known secret from a test path after restore.
• Any dependent secret-sync (e.g., VSO) reconciles without errors after restore.
• Backup artifacts can be decrypted/validated and are within expected size/time bounds.

Notes / Risks

• Restore workflow depends heavily on storage backend and unseal method (manual vs auto-unseal).
• Backup handling must avoid leaking sensitive material; ensure encryption and access controls.