Create an Object Lock-Enabled Scheduled Backup

Applicable to both Classic and Federated modes

Object lock-enabled backups protect backup data from modification or deletion for a specified retention period, providing immutability for compliance, ransomware protection, and long-term data retention requirements. Portworx Backup supports creating scheduled backups on S3-compatible backup locations that have S3 Object Lock enabled, Azure Blob immutable storage containers, and GCS buckets with a bucket-level retention policy configured.

note

Immutable object storage behavior depends on the underlying storage provider.

• Amazon S3 Object Lock

  • Supports Compliance and Governance modes.
  • Compliance mode prevents deletion by any user, including the root account, until the retention period expires. In this mode, Portworx Backup retention pruning cannot override the lock by design. If Portworx Backup attempts to delete a locked object before its retention period expires, the object store rejects the delete. These failed deletes until expiry are expected behavior in Compliance mode, not a misconfiguration.
  • Governance mode allows authorized users to bypass retention restrictions.

• Azure Immutable Blob Storage

  • Supports immutable storage using time-based retention and legal hold policies.

• Google Cloud Storage (GCS) bucket-level retention policy

  • Enforces time-based retention at the bucket level. All objects in the bucket are subject to the same retention period.
  • Supports locked (irreversible, policy cannot be removed or shortened) and unlocked (policy can be removed or shortened) retention policy configurations.
  • Requires object versioning and uniform bucket-level access to be enabled on the bucket.

See the respective cloud provider documentation for provider-specific retention behavior and limitations.

Prerequisites

Before creating an object lock-enabled scheduled backup, ensure the following:

• Object lock-enabled backup location: An object lock-enabled backup location must already be added to Portworx Backup. For AWS S3, Object Lock must be enabled at bucket creation time. For GCS, a bucket-level retention policy can be configured on a new or existing bucket. For supported providers, see the Backup Location Support Matrix. For setup instructions, see:
  • Add an object lock-enabled S3 backup location
  • Add an immutable Azure backup location
  • Add an immutable GCS backup location
• Bucket versioning: S3 Object Lock requires bucket versioning, because the object store enforces immutability on individual object versions; object lock cannot function on a bucket without versioning. On Amazon S3, versioning is enabled automatically when you create the bucket with Object Lock enabled. Other S3-compatible providers (for example, FlashBlade S3 and MinIO) may require you to enable versioning explicitly. Check your provider's documentation and confirm that versioning is enabled on the bucket.
• Locked schedule policy: A locked schedule policy with a retention period greater than the schedule interval must be configured. For more information, see Schedule policies.
• Storage lifecycle management policy: Configure lifecycle management policies on the immutable object store to manage retained object versions and expired delete markers. Without lifecycle management, retained object versions and delete markers may accumulate over time and increase storage usage.

For provider-specific configuration details, see:

• AWS S3 Lifecycle Management
• Azure Blob Storage lifecycle management
• GCS Object Lifecycle Management
• Supported versions: Immutability support and minimum Stork and Portworx Backup versions differ by provider. Azure immutable blob storage in particular has provider-specific minimum requirements. Confirm that your environment meets the supported and minimum versions for your provider before relying on object lock. For the per-feature requirements, see the Feature Support Matrix, and for the supported component combinations, see the Compatibility Matrix.

note

Immutable retention is enforced by the underlying object storage, not by Portworx Backup. The bucket's Object Lock (default) retention period takes precedence and cannot be overridden by Portworx Backup. The schedule-policy retention period only controls when Portworx Backup attempts to prune older backups; it does not shorten the lock.

Set the retention values so that they do not conflict:

• The schedule-policy retention period must be greater than or equal to the bucket's Object Lock default retention period (matching them is recommended), so that Portworx Backup does not attempt to delete an object before its lock expires.
• The schedule-policy retention period must also be greater than the schedule interval (the frequency at which backups run), so that a backup is not scheduled for deletion before the next run completes.

If the schedule-policy retention period is shorter than the bucket retention, the following can occur:

• Over-retention — Backups are retained longer than the schedule-policy retention period because the bucket lock keeps them, increasing storage costs.
• Delete failures — Portworx Backup cannot delete backups until the bucket retention period expires, and delete attempts are rejected by the object store until then.

Create an object lock-enabled scheduled backup

Before you begin, note that the immutability behavior described earlier (Amazon S3 Governance versus Compliance mode, and Azure immutable blob retention) is not configured in the Create Backup steps below. The retention mode and retention period are properties of the bucket and the backup location, and the pruning behavior is governed by the locked schedule policy. The Create Backup steps only point Portworx Backup at those already-configured resources: you select the object lock-enabled backup location, set the backup type to run on a schedule, and choose the locked schedule policy.

As a general guide for choosing a mode when you set up the bucket and backup location: use Compliance mode (or Azure time-based immutability) when backups must be tamper-proof for regulatory or ransomware-protection reasons and no one, including administrators, should be able to delete them before expiry; use Governance mode when you want immutability by default but need authorized users to be able to remove backups early in exceptional cases.

To create an object lock-enabled backup:

1. On the Portworx Backup clusters page, select the cluster you want to back up.

2. Select the namespaces and apply label selectors to filter the resources you want to back up.

3. Click Backup.

4. In the Create Backup window, specify the following fields. For more information, see Create a backup.

   info

   The Create Backup form is the same form used for regular backups. Only three choices make a backup object lock-enabled, so get these right:

   1. Backup location — select the object lock-enabled backup location you created previously.

   2. Backup type — set this to On a schedule.

   3. Choose a schedule policy — select a locked schedule policy.

   Before selecting them, confirm that the backup location is successfully validated for object lock (the Backup location field lists only validated locations) and that the schedule policy you choose is a locked policy. Selecting a non-locked policy or a location without object lock does not produce immutable backups. The remaining fields below behave the same as for any other backup.

   • Enter name for Backup: provide a relevant name for your backup

   • Backup location: search for and select the object lock-enabled backup location you created previously. Enter a keyword to filter the list by name.

     note

     The Backup location field displays only successfully validated object store or NFS backup locations.

   • Cross Cloud Backup/Restore: you can enable or disable this option. For more information on this option, see Create backup.

   • Snapshot Class Mapping: facilitates mapping of your storage provisioner with volume snapshot class

     • CSI Provisioner: lists the CSI provisioners associated with the PVCs present in the namespaces selected for the backup

     • Volume snapshot class: lists all the volume snapshot class (vsc) resources along with default vsc

     • Offload CSI snapshots to backup location: offloads the CSI snapshot to the specified backup location

   • Backup type: allows you to choose the type of backup required (manual or scheduled backup)

     • On a schedule: enable this option to create an object lock-enabled scheduled backup

       • Choose a schedule policy: select a locked schedule policy from the drop-down list. Confirm that the policy you select is a locked policy before selecting it; only a locked schedule policy produces object lock-enabled backups.

       • Allow parallel backup: select this option to enable Portworx Backup to trigger a new scheduled backup even when the previous scheduled backup is still in progress (uploading snapshots to the cloud). See Parallel backup schedules for more information on how this feature works in the backend.

       note

       The parallel backup option is applied only for Portworx volumes and will not work for other volume types.

   • Pre-exec rule: select a rule from the drop-down to execute before the backup is created

   • Post-exec rule: select a post rule you want to execute after the backup is created

   • Backup Labels: any labels that you want to add to the backup you are going to create

   • NAMESPACES LIST: lists all the namespaces selected for backup creation

   note

   When changing the retention period between two scheduled backups, ensure the new retention period is greater than the schedule interval and aligned with the bucket's retention policy, as described in Prerequisites. For example, if backups run every 7 days, the retention period must exceed 7 days. Setting a retention period shorter than the schedule interval may result in backup failures or rejected writes on the object lock-enabled bucket.

5. Click Create.

The object lock-enabled scheduled backup is created. It appears in the Backups list with a lock icon. The lock icon indicates that object lock protection is active: the backup objects are written immutably and cannot be modified or deleted for the retention period enforced by the bucket, according to the bucket's retention mode (for example, Amazon S3 Compliance or Governance, or Azure time-based immutability).

To confirm the configuration is working end to end:

• Go to Backup schedules and confirm that the next run time is displayed, which verifies the schedule is active. For more information, see Backup schedules.
• In Compliance mode, confirm that a delete attempt on a backup is rejected before the retention period expires. A rejected delete confirms that immutability is being enforced and is the expected behavior, not an error.

Update object lock-enabled backups

You can add new labels or delete a pre-applied label on your object lock-enabled backups using the Edit option. To update labels on an object lock-enabled manual or scheduled backup:

1. On the home page, click the Clusters icon.

2. Select the cluster where you have created the object lock-enabled backup.

3. Select the Backup tab to view the list of all object lock-enabled backups you have created.

4. Select the vertical ellipsis of the object lock-enabled backup you need to update and choose Edit.

5. Enter new backup label(s) or delete a pre-applied label and select Update. You can apply multiple labels to your object lock-enabled backup to filter them later based on your needs.

Update the backup schedule

To modify the schedule policy, retention period, or other schedule settings for an object lock-enabled scheduled backup, use the Backup schedules tab in the Portworx Backup UI.

For object lock-enabled schedules, the retention period and the schedule interval are safety-critical and must be changed carefully:

• Keep the retention period greater than the schedule interval, so that a backup is not due for deletion before the next scheduled run completes.
• Keep the retention period greater than or equal to the bucket's Object Lock retention period. Shortening the schedule-policy retention below the bucket lock does not shorten the lock; instead, Portworx Backup attempts to prune objects that the object store still protects, which results in delete failures (and, depending on the provider, rejected writes) until the lock expires.
• Lengthening the retention period is generally safe. Shortening it below the bucket retention or the schedule interval is the change most likely to cause delete failures, so review the bucket's retention before reducing it.

For the steps to edit a schedule, see Backup schedules.

Troubleshooting

Because immutability is enforced by the object store, some operations that succeed for regular backups are expected to fail while an object lock is active.

• Symptoms: Backup cleanup, retention pruning, or delete operations fail while the lock is active, and in some cases writes are rejected by the bucket. In Compliance mode these failures continue until the object's retention period expires and are expected behavior, not a misconfiguration.
• Where to look: Check the backup or backup-schedule status in the Portworx Backup UI and the associated logs for the failed delete or cleanup operation. Compare the schedule-policy retention period against the bucket's Object Lock retention period.
• How to recover:
  • Wait for the bucket retention period to expire, after which Portworx Backup can prune the objects.
  • In Governance mode, an authorized user with the required bypass permission can remove a locked object before expiry. This is not possible in Compliance mode.
  • Verify that the schedule-policy retention period is greater than or equal to the bucket's Object Lock retention period and greater than the schedule interval, and adjust the schedule policy if it was set too short. See Schedule policies.