Self-managed installation and maintenance > Backup and restore > Back up procedure > Back up secrets

Back up secrets¶

DataRobot encrypts sensitive data at rest and secures backend services with passwords. When backing up a DataRobot cluster, you must also back up the secrets used to secure the DataRobot environment. These secrets must be backed up at the same time as the databases.

If these files and directories are not backed up and restored as part of the DataRobot cluster, you may lose access to data and analytics stored in the DataRobot environment.

Important

These secrets cannot be recovered by DataRobot—it is critical that they are secured as part of your data management policy.

Back up DataRobot platform secrets¶

Note

You must fulfill the prerequisites before proceeding.

DataRobot platform secrets include authentication and connection data used by various internal platform services. This includes connection details to persistent critical services, such as MongoDB, PostgreSQL, RabbitMQ, and Elasticsearch.

The following command retrieves all secrets with the label app.kubernetes.io/instance=dr and saves the data as JSON files (named after the secret saved in the file):

mkdir -p ${BACKUP_LOCATION}/secrets/dr
for secret in $(kubectl -n $NAMESPACE get secrets -l app.kubernetes.io/instance=dr -o name); do
  kubectl -n "$NAMESPACE" get "$secret" -o json | jq '{data}' > "${BACKUP_LOCATION}/secrets/dr/${secret#*/}.json"
done

Back up encryption keys¶

While encryption keys are included in the general secrets backup above, DataRobot recommends creating dedicated backups for these critical keys for MongoDB data decryption.

Back up MongoDB encryption keys¶

mkdir -p ${BACKUP_LOCATION}/secrets
kubectl -n $NAMESPACE get secret/core-credentials -o jsonpath="{.data.asymmetrickey}" \
| base64 -d > ${BACKUP_LOCATION}/secrets/ASYMMETRIC_KEY_PAIR_MONGO_ENCRYPTION_KEY.txt
kubectl -n $NAMESPACE get secret/core-credentials -o jsonpath="{.data.drsecurekey}" \
| base64 -d > ${BACKUP_LOCATION}/secrets/DRSECURE_MONGO_ENCRYPTION_KEY.txt

Back up persistent critical services secrets¶

Note

This step is required for installations on 9.x through 10.x.

The following command retrieves all secrets with the label app.kubernetes.io/instance=pcs and saves the data in JSON files:

mkdir -p ${BACKUP_LOCATION}/secrets/pcs
for secret in $(kubectl -n $NAMESPACE get secrets -l app.kubernetes.io/instance=pcs -o name); do
  kubectl -n "$NAMESPACE" get "$secret" -o json | jq '{data}' > "${BACKUP_LOCATION}/secrets/pcs/${secret#*/}.json"
done