Backup archive structure and integrity verification

Each flightctl-backup run produces a timestamped archive and a companion .sha256 checksum file. Before restoring, verify integrity by running sha256sum -c on the checksum file from the directory that contains both files. The command must report OK. Do not run flightctl-restore if verification fails.

Archive naming
Copy link

Archives use a UTC timestamp in the filename, for example:

flightctl-backup-20260428T120000Z.tar.gz
flightctl-backup-20260428T120000Z.tar.gz.sha256

Top-level contents
Copy link

After extraction, the archive layout includes directories similar to the following:

metadata.json
db/dump.sql
pki/...
config/...
volumes/...    (Podman deployments, when applicable)
Path Description

metadata.json

Backup timestamp, Red Hat Edge Manager version, deployment type (podman or kubernetes), and related metadata used during restore validation

db/dump.sql

PostgreSQL logical dump of the flightctl database (present when the internal database was backed up)

pki/

PKI and TLS material (filesystem copy on Red Hat Enterprise Linux; exported Secret manifests on Red Hat OpenShift Container Platform)

config/

Service configuration (service-config.yaml on Red Hat Enterprise Linux, Helm release Secret helm-release-<name>.yaml on Red Hat OpenShift Container Platform)

volumes/pam-issuer-etc.tar

PAM Issuer volume export (Podman deployments only, optional - backup continues if export fails)

Checksum file
Copy link

The .sha256 file uses the standard sha256sum format:

<hash>  flightctl-backup-20260428T120000Z.tar.gz

Verify integrity from the directory that contains both files:

sha256sum -c flightctl-backup-20260428T120000Z.tar.gz.sha256

A failed check indicates a corrupt or incomplete transfer. Do not run flightctl-restore until you obtain a valid archive.

File permissions
Copy link

Backup archives are created with restrictive permissions (owner read/write only). Preserve those permissions when you copy archives to backup storage.