Skip to main content
Version: 1.17

Backup and Restore Workload ID

Business Critical Plan Feature

This is a Business Critical Plan feature. For more information, see our pricing plans or contact our sales team.

Prerequisites​

To set up a workload-identity, you'll need:

  • A self-hosted Space cluster
  • Administrator access in your cloud provider
  • Helm and kubectl

About the backup and restore component​

The mxp-controller component handles backup and restore workloads. It needs to access your cloud storage to store and retrieve backups. By default, this component runs in each control plane's host namespace.

Configuration​

Verify your configuration​

After you apply the configuration use kubectl to verify the service account has the correct annotation:

kubectl get serviceaccount mxp-controller -n ${YOUR_CONTROL_PLANE_NAMESPACE} -o yaml

Verify the mxp-controller pod is running:

kubectl get pods -n ${YOUR_CONTROL_PLANE_NAMESPACE} | grep mxp-controller

Restart workload​

You must manually restart a workload's pod when you add the workload identity annotations to the running pod's service account.

kubectl rollout restart deployment mxp-controller -n ${YOUR_CONTROL_PLANE_NAMESPACE}

Use cases​

Configuring backup and restore with workload identity eliminates the need for static credentials in your cluster and the overhead of credential rotation. These benefits are helpful in:

  • Disaster recovery scenarios
  • Control plane migration
  • Compliance requirements
  • Rollbacks after unsuccessful upgrades

Next steps​

Now that you have a workload identity configured for the backup and restore component, visit the Backup Configuration documentation.

Other workload identity guides are: