From f31109dce1cc96cf2f9bad0944dfc4193e2a3664 Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 2 Jan 2025 15:11:27 -0400 Subject: [PATCH 1/6] Include section on ResourceSets --- .../backup-configuration.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index 2bb79d074b7..5d7fb8db70e 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -25,6 +25,24 @@ Select the first option to perform a one-time backup, or select the second optio | `schedule` | Provide the cron string for scheduling recurring backups. | | `retentionCount` | Provide the number of backup files to be retained. | +## ResourceSet + +While users can create their own resourceSets to backup custom applications, two resourceSets for backing up Rancher itself are officially maintained and are created by default with the `rancher-backup` operator. These are called `rancher-resource-set-basic` and `rancher-resource-set-full`. The difference between them is whether they include secrets or not in the backups. + +When choosing the basic option, no Kubernetes Secrets will be backed up to prevent confidential information from being inserted in the backup files, so the user is responsible for keeping and re-deploying them safely. + +The full option, however, backs up all essential Secrets to ensure Rancher continues running smoothly after a restore or migration. In this case the user is heavily advised to enable encryption with a strong key to prevent sensitive information from being stored in plain-text. + +:::note Important: + +A third resourceSet `rancher-resource-set` is also included by default with the Operator. This is a legacy definition, currently deprecated and no longer maintained, being kept only for compatibility reasons. It will be removed in Rancher v2.12. Please update your Backup CRs to use either `rancher-resource-set-full` or `rancher-resource-set-basic`. + +::: + +| YAML Directive Name | Description | +| ---------------- | ---------------- | +| `resourceSetName` | Provide the name of the ResourceSet to define which resources will be included in this backup. | + ## Encryption The rancher-backup gathers resources by making calls to the kube-apiserver. Objects returned by apiserver are decrypted, so even if [encryption at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) is enabled, even the encrypted objects gathered by the backup will be in plaintext. From f2201cd1707831c82f2f203564c20a008da0a781 Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 2 Jan 2025 15:13:09 -0400 Subject: [PATCH 2/6] Update examples to reference new resourceSets --- .../backup-restore-configuration/examples.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/reference-guides/backup-restore-configuration/examples.md b/docs/reference-guides/backup-restore-configuration/examples.md index d3e55582477..542c49cc872 100644 --- a/docs/reference-guides/backup-restore-configuration/examples.md +++ b/docs/reference-guides/backup-restore-configuration/examples.md @@ -26,7 +26,7 @@ kind: Backup metadata: name: default-location-encrypted-backup spec: - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig ``` @@ -38,7 +38,7 @@ kind: Backup metadata: name: default-location-recurring-backup spec: - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-basic schedule: "@every 1h" retentionCount: 10 ``` @@ -51,7 +51,7 @@ kind: Backup metadata: name: default-enc-recurring-backup spec: - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig schedule: "@every 1h" retentionCount: 3 @@ -72,7 +72,7 @@ spec: bucketName: rancherbackups endpoint: minio.xip.io endpointCA: - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig ``` @@ -92,7 +92,7 @@ spec: folder: ecm1 region: us-west-2 endpoint: s3.us-west-2.amazonaws.com - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig ``` @@ -112,7 +112,7 @@ spec: folder: ecm1 region: us-west-2 endpoint: s3.us-west-2.amazonaws.com - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig schedule: "@every 1h" retentionCount: 10 @@ -134,7 +134,7 @@ spec: folder: ecm1 region: us-west-2 endpoint: s3.us-west-2.amazonaws.com - resourceSetName: rancher-resource-set + resourceSetName: rancher-resource-set-full encryptionConfigSecretName: encryptionconfig ``` From 2efc8cf6e10ce32eabb8e96afe36b2d7fdb2c8e1 Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 9 Jan 2025 11:32:46 -0400 Subject: [PATCH 3/6] Improve ResourceSet description Co-authored-by: Lucas Saintarbor --- .../backup-restore-configuration/backup-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index 5d7fb8db70e..9e62063bd08 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -27,7 +27,7 @@ Select the first option to perform a one-time backup, or select the second optio ## ResourceSet -While users can create their own resourceSets to backup custom applications, two resourceSets for backing up Rancher itself are officially maintained and are created by default with the `rancher-backup` operator. These are called `rancher-resource-set-basic` and `rancher-resource-set-full`. The difference between them is whether they include secrets or not in the backups. +While you can create your own ResourceSets to back up custom applications, two ResourceSets specifically for backing up Rancher are officially maintained and created by default by the `rancher-backup` operator. We refer to these as `rancher-resource-set-basic` and `rancher-resource-set-full`. The difference between them is whether they include secrets or not in the backups. When choosing the basic option, no Kubernetes Secrets will be backed up to prevent confidential information from being inserted in the backup files, so the user is responsible for keeping and re-deploying them safely. From 6135f491af6f94247e75cacc0081441e14b137ec Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 9 Jan 2025 11:33:58 -0400 Subject: [PATCH 4/6] Improve ResourceSet description continued Co-authored-by: Lucas Saintarbor --- .../backup-restore-configuration/backup-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index 9e62063bd08..d55de4e9a76 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -29,7 +29,7 @@ Select the first option to perform a one-time backup, or select the second optio While you can create your own ResourceSets to back up custom applications, two ResourceSets specifically for backing up Rancher are officially maintained and created by default by the `rancher-backup` operator. We refer to these as `rancher-resource-set-basic` and `rancher-resource-set-full`. The difference between them is whether they include secrets or not in the backups. -When choosing the basic option, no Kubernetes Secrets will be backed up to prevent confidential information from being inserted in the backup files, so the user is responsible for keeping and re-deploying them safely. +`rancher-resource-set-basic` does not include any secrets in the backup files to safeguard confidential information. You are responsible for recording any secrets and redeploying them safely. The full option, however, backs up all essential Secrets to ensure Rancher continues running smoothly after a restore or migration. In this case the user is heavily advised to enable encryption with a strong key to prevent sensitive information from being stored in plain-text. From b5badc2ab54ebab38b30ca305205a263f608db03 Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 9 Jan 2025 11:34:54 -0400 Subject: [PATCH 5/6] Improve rancher-resource-set-full description Co-authored-by: Lucas Saintarbor --- .../backup-restore-configuration/backup-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index d55de4e9a76..94493fd26d0 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -31,7 +31,7 @@ While you can create your own ResourceSets to back up custom applications, two R `rancher-resource-set-basic` does not include any secrets in the backup files to safeguard confidential information. You are responsible for recording any secrets and redeploying them safely. -The full option, however, backs up all essential Secrets to ensure Rancher continues running smoothly after a restore or migration. In this case the user is heavily advised to enable encryption with a strong key to prevent sensitive information from being stored in plain-text. +`rancher-resource-set-full` includes all essential secrets in the backup files to ensure Rancher continues running smoothly after a restore or migration. To avoid storing sensitive information in plain text, we strongly advise you to enable encryption with a strong key. :::note Important: From e5a5bdba31105299e3bd6d214c541f0dcac205d4 Mon Sep 17 00:00:00 2001 From: Julia Bier Date: Thu, 9 Jan 2025 11:35:45 -0400 Subject: [PATCH 6/6] Improve rancher-resource-set description Co-authored-by: Lucas Saintarbor --- .../backup-restore-configuration/backup-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index 94493fd26d0..054a6de3daa 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -35,7 +35,7 @@ While you can create your own ResourceSets to back up custom applications, two R :::note Important: -A third resourceSet `rancher-resource-set` is also included by default with the Operator. This is a legacy definition, currently deprecated and no longer maintained, being kept only for compatibility reasons. It will be removed in Rancher v2.12. Please update your Backup CRs to use either `rancher-resource-set-full` or `rancher-resource-set-basic`. +`rancher-resource-set` is also included by default with the `rancher-backup` operator. However, this ResourceSet is deprecated and is only being kept for backwards compatibility reasons. `rancher-resource-set` will be removed in Rancher v2.12. Please update your Backup custom resources to use either `rancher-resource-set-full` or `rancher-resource-set-basic`. :::