Restore the full server on Red Hat OpenShift Container Platform

Run flightctl-restore with a backup archive from flightctl-backup to recover Red Hat Edge Manager on Red Hat OpenShift Container Platform at the same version. The command verifies checksum and deployment type, restores database, PKI, and configuration, and reconciles device state.

Before you begin

  • A valid archive and .sha256 file from a Kubernetes or Helm backup of the same Red Hat Edge Manager version.
  • Prerequisites for backup and restore are satisfied.
  • Permission to scale Red Hat Edge Manager deployments to zero in the target namespace during restore.

Procedure

  1. Verify that flightctl and flightctl-restore match the Red Hat Edge Manager deployment:

    From a workstation where flightctl is configured to reach the Red Hat Edge Manager API, run flightctl version (use flightctl login first if needed). The command reports Client Version (the CLI binary) and, when connected, Server Version (the running Red Hat Edge Manager instance). Run flightctl-restore version to report the restore binary version.

    flightctl version
flightctl-restore version

    Compare the output: Client Version, Server Version, and the flightctl-restore version must all report the same Red Hat Edge Manager release. If Server Version is missing or any version differs, update the mismatched binaries before you continue. For more information about prerequisites for backup and restore, see Additional resources.

    Important

    Cross-version restore is not supported. The CLI client, the running server, and flightctl-restore must be on the same release before you continue.
  2. Verify archive integrity before you scale down workloads. Run the command from the directory that contains the archive and .sha256 file, or pass the full path to the checksum file. The output must include OK: 
    sha256sum -c /path/to/flightctl-backup-YYYYMMDDTHHMMSSZ.tar.gz.sha256

    If verification fails, do not continue. For more information about the checksum file, see Additional resources.

  3. Scale down application deployments in the Red Hat Edge Manager namespace (replace rhem-chart-namespace): 
    export RHEM_NS=rhem-chart-namespace
kubectl scale deployment flightctl-api --replicas=0 -n "$RHEM_NS"
kubectl scale deployment flightctl-worker --replicas=0 -n "$RHEM_NS"
kubectl scale deployment flightctl-periodic --replicas=0 -n "$RHEM_NS"
kubectl scale deployment flightctl-alert-exporter --replicas=0 -n "$RHEM_NS"
kubectl scale deployment flightctl-alertmanager-proxy --replicas=0 -n "$RHEM_NS"
kubectl get pods -n "$RHEM_NS"
  4. Run restore with the archive path. When the command needs database and KV access from your workstation, retrieve Secrets and use port-forwarding as documented in the manual PostgreSQL restore procedure on Red Hat OpenShift Container Platform. For more information about the restore procedure (manual database steps), see Additional resources. Then pass credentials: 
    DB_APP_PASSWORD=$(kubectl get secret flightctl-db-app-secret -n "$RHEM_NS" -o jsonpath='{.data.userPassword}' | base64 -d)
KV_PASSWORD=$(kubectl get secret flightctl-kv-secret -n "$RHEM_NS" -o jsonpath='{.data.password}' | base64 -d)
export DB_PASSWORD="$DB_APP_PASSWORD" KV_PASSWORD="$KV_PASSWORD"
flightctl-restore /path/to/flightctl-backup-YYYYMMDDTHHMMSSZ.tar.gz

    Monitor the command output until it completes successfully. flightctl-restore is not transactional: a mid-run failure can leave the deployment partially restored. Do not scale deployments back up until restore finishes without error.

    Important

    If the command fails or logs per-device KV errors, keep workloads scaled to zero. For more information about recovering from a failed or partial restore, see Additional resources before you continue.

     Note

    Apply Helm values from the archive manually if the restore output directs you to config/helm-values.yaml in the extracted layout. Your runbook should match the version of flightctl-restore you are running.
  5. Scale deployments back to their normal replica counts: 
    kubectl scale deployment flightctl-api --replicas=1 -n "$RHEM_NS"
kubectl scale deployment flightctl-worker --replicas=1 -n "$RHEM_NS"
kubectl scale deployment flightctl-periodic --replicas=1 -n "$RHEM_NS"
kubectl scale deployment flightctl-alert-exporter --replicas=1 -n "$RHEM_NS"
kubectl scale deployment flightctl-alertmanager-proxy --replicas=1 -n "$RHEM_NS"
kubectl get pods -n "$RHEM_NS"
  6. Validate the API, console, and device inventory.

Results

  • Pods are running and the API responds.
  • Devices reconnect without full re-enrollment when PKI and endpoints are unchanged.