Restoring IBM Business Automation Workflow on Containers

• Set up a new Kubernetes cluster with the same version and configuration as the source cluster.
• Reinstall the Business Automation Workflow operator. You can use the baw-cluster-admin script to deploy the operator and any capability-specific operators (example - Business Automation Studio).
• Ensure all required namespaces (example - baw) are created.

To restore all required secrets for each namespace:

• You can use the provided script to automate the restoration process.
• Before you run the script, ensure that any environment-specific values, such as client-ids or tokens are updated to match the new environment.
• If you are unable to modify these values in the script, manually apply the secrets to avoid configuration issues.

for ns in $(ls -d k8s-backup-secret*/ | cut -d'/' -f2); do
  kubectl get ns $ns >/dev/null 2>&1 || kubectl create ns $ns
  if [ -f k8s-backup-secret*/$ns/secrets.yaml ]; then
    kubectl apply -f k8s-backup-secret*/$ns/secrets.yaml -n $ns
  else
    echo "Missing secrets.yaml for namespace $ns"
  fi
done

Ensure that the following critical secrets are restored before you apply the custom resource (CR):

• ibm-fncm-secret
• ibm-ban-secret
• ibm-baw-wfs-server-db-secret
• ibm-icc-secret
• ldap-bind-secret
• Any other application-specific secrets

Your application relies on specific key value pairs that are stored in Configmap. To restore them:

• You can use the provided script to restore all Configmap.
• Before you run the script, ensure that any environment-specific values such as client-ids or tokens are updated to match the new environment.
• If you are unable to update these values:
  • Either manually apply the backed-up Configmap, or
  • Skip this step and allow the CR to re-create the necessary Configmap automatically.

for ns in $(ls k8s-backup-configmap*/); do
  kubectl apply -f k8s-backup-configmap*/$ns/configmaps.yaml -n $ns
done

If your application uses volume mounts, you must restore the corresponding PVC definitions. Ensure that you are in the correct namespace, then apply the PVC definition YAML file:

kubectl apply -f pvc.yaml -n your-namespace

PVC content includes the actual data that is stored in the volumes. You can restore this content manually or use the example script provided.

NS=your-namespace
BACKUP_DIR=backups-pvc-content
TARGET_DIR=<target-storage-class-path>

kubectl get pvc -n $NS --no-headers=true | while read line; do
  pvc=$(echo $line | awk '{print $1}')
  pv=$(echo $line | awk '{print $3}')
  [[ "$pvc" == ibm-bts-cnpg* ]] && continue
  src="$BACKUP_DIR/$pvc"
  dst="$TARGET_DIR/$NS-$pvc-$pv"

  if [ -d "$src" ]; then
    echo "Restoring $pvc"
    mkdir -p "$dst"
    cp -r "$src/." "$dst/"
  else
    echo "Missing backup content for $pvc"
  fi
done

• Restore the LDAP VM snapshot or manually reconfigure the LDAP database.
• For details on IBM Security® Directory Server (SDS), see IBM Security Directory Server backup and restore .

Restore all required databases by using the appropriate back up images.

• For PostgreSQL, use the pg_restore command to restore the data.
• For Oracle DB, use the Recovery Manager tool (RMAN).
• For Db2®with online backups, use the following commands to restore your databases.

Use the following commands to restore Db2 databases:

db2 restore database UMSDB from '/path/to/backup' taken at <timestamp> into UMSDB replace existing
...
db2 rollforward db UMSDB to end of logs and stop

Repeat for all required databases (for example, TOSDB, GCDDB, AEDB, ICNDB, BAWDB, DOCSDB, DOSDB).

• Copy JDBC drivers to the appropriate runtime paths.
• Restore any custom fonts or configuration files that are used in component PVCs.

• Use OpenSearch snapshot restore APIs. For more information on taking and restoring snapshots of OpenSearch data, see Taking and restoring snapshots of OpenSearch data .
• Map restored indexes to federated runtime and search services. For more information, see Understanding the Federated Data Repository process indexing .

Update the CR with the correct hostname, domain, and database details. Set the following fields:

shared_configuration:
  sc_content_initialization: false
  sc_content_verification: false

Then apply the CR:

kubectl apply -f icp4a-cr-backup.yaml -n your-namespace

If your platform is not Red Hat® OpenShift®, reapply ingress and network policies to enable communication between components. If your application includes custom network policies, ensure those are also restored.

To generate ingress resources, run the following command.

./baw-deployment.sh -m generateIngress -n <your-namespace> --ingress rancher/tanzu

To restore all ingress and network policies across namespaces, use the following script. Review and update parameters such as the client ID before you apply the changes.

for ns in $(ls k8s-backup-network*/); do
  for kind in ingress networkpolicy; do
    kubectl apply -f k8s-backup-network*/$ns/${kind}.yaml -n $ns
  done
done