Federated Mode
Applicable to Federated mode only
Portworx Backup supports a Federated mode (also referred to as Managed Service Provider mode or Workload Identity mode) designed for large-scale, multi-cluster, and service provider environments such as Gardener.
In Federated mode:
- The Portworx Backup server is deployed on a dedicated backup cluster and sends instructions to application clusters.
- All backup operations are handled locally by Stork on each application cluster.
- Cloud credentials are never stored centrally. Each application cluster connects directly to the backup location using cloud-native Workload Identity (for example, Azure Managed Identity, AWS IRSA (IAM Roles for Service Accounts), or GCP Workload Identity Federation).
Federated mode is designed for large-scale, multi-cluster environments and integrates with Gardener for automatic shoot cluster discovery. You can also manually onboard non-Gardener Kubernetes clusters using a kubeconfig, so Gardener is not required. For more information, see Onboard a standalone shoot cluster. Federated mode supports Azure Blob Storage (Portworx Backup 3.0.0 or later), AWS S3 (Portworx Backup 3.1.0 or later), and Google Cloud Storage (GCS) (Portworx Backup 3.1.0 or later) as backup locations. For a comparison with Classic mode, see Operation Modes.
Scope of this section
The topics in this section are specific to Federated mode and cover the areas where Federated mode differs from Classic mode: specifications, installation, cluster management, and backup location configuration.
Most other operations — backups, restores (excluding KubeVirt VMs), schedules, rules, policies, labels, and sharing — work the same way in both modes. However, some capabilities differ:
- Not supported in Federated mode: NFS backup locations, KDMP-based backups, and KubeVirt virtual machine backup and restore.
- Behaves differently in Federated mode: backup deletion, backup sync, cloud file-missing checks, and backup location validation are handled locally by Stork on each application cluster (using Workload Identity) rather than by the Portworx Backup server. For the operation-by-operation comparison of how each behaves in Classic versus Federated mode, see Operation specifications.
See Federated Mode Specifications before using procedures in the Operate section.
The following sections provide the information specific to Federated mode:
- Federated Mode Specifications — Architecture overview, platform requirements, terminology, supported operations, and known limitations.
- Install Portworx Backup in Federated Mode — Step-by-step installation guide including Stork configuration, Helm installation, and verification.
- Upgrade Portworx Backup in Federated Mode — How to upgrade an existing Federated mode deployment to 3.1.0, including the backup cluster Helm upgrade and the Stork upgrade on application clusters.
- Manage Clusters (Federated Mode) — How to onboard and manage Gardener shoot clusters and non-Gardener clusters in Federated mode.
- Configure Backup Locations (Federated Mode) — How to add, validate, sync, share, and delete backup locations using Azure Managed Identity, AWS IRSA, or GCP Workload Identity Federation.
Federated Mode Specifications
Understand the specifications, requirements, supported platforms, and constraints for running Portworx Backup in Federated mode.
Install Portworx Backup in Federated Mode
Learn how to install Portworx Backup in Federated mode, including prerequisites, Stork configuration on application clusters, Helm installation, and verification.
Upgrade Portworx Backup in Federated Mode
Learn how to upgrade a Portworx Backup Federated mode deployment to 3.1.0, including the supported upgrade path, pre-upgrade checks, the Helm upgrade of the backup cluster, and the Stork upgrade on application clusters.
Manage Clusters (Federated Mode)
Learn how to onboard, validate, edit, sync, and remove Gardener shoot clusters and non-Gardener clusters in Portworx Backup Federated mode.
Configure Backup Location (Federated Mode)
Learn how to add, view, edit, sync, share, and delete backup locations in Portworx Backup Federated mode (Workload Identity mode), which uses Azure Managed Identity, AWS IRSA (IAM Roles for Service Accounts), or GCP Workload Identity instead of stored cloud credentials. Supports Azure Blob Storage, AWS S3, and GCS buckets (including object lock / retention-policy immutability).
Force Delete Backups
Learn how to force delete backups in Federated mode when a shoot cluster is unreachable or a backup is in an unrecoverable state.