Luca BertonDR for Kubernetes Is Different
Traditional disaster recovery focuses on VMs, databases, and storage. Kubernetes adds complexity: you need to recover not just data, but cluster state (etcd), application configuration (manifests, ConfigMaps, Secrets), persistent volumes, custom resources (CRDs), and the relationships between them. Getting this wrong means your recovery doesn't work when you need it most.
RTO/RPO Planning
Definitions
- RTO (Recovery Time Objective): Maximum acceptable downtime. How quickly must the service be restored?
- RPO (Recovery Point Objective): Maximum acceptable data loss. How much data can you afford to lose? (Measured in time: RPO of 1 hour = up to 1 hour of data loss)
DORA requirement: Article 11 requires documented RTOs and RPOs for all critical ICT services, reviewed annually and after significant changes.
| Tier | RTO | RPO | Strategy |
|---|---|---|---|
| Tier 1 (Critical) | < 15 minutes | Near-zero | Active-active multi-cluster |
| Tier 2 (Important) | < 4 hours | < 1 hour | Active-passive with async replication |
| Tier 3 (Standard) | < 24 hours | < 24 hours | Backup and restore (Velero) |
| Tier 4 (Non-critical) | < 72 hours | < 72 hours | Rebuild from Git (GitOps) |
Kubernetes DR Strategies
Velero — Backup & Restore
- Cluster state backup: Backs up all Kubernetes resources (Deployments, Services, ConfigMaps, Secrets, CRDs)
- Persistent volume backup: Snapshots PVs via CSI snapshots or Restic/Kopia for file-level backup
- Scheduled backups: Cron-based backup schedules with retention policies
- Selective restore: Restore entire clusters, specific namespaces, or individual resources
- Cross-cluster migration: Backup from one cluster, restore to another (DR or migration)
Multi-Cluster Failover
- Active-active: Traffic distributed across clusters. If one fails, the other absorbs all traffic. Requires global load balancing and data replication.
- Active-passive: Standby cluster kept in sync via GitOps (ArgoCD/Flux) and async data replication. Failover requires DNS switch and data promotion.
- Pilot light: Minimal standby cluster (control plane + critical configs). Scale up workers on failover.
📘 Book
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →What to Back Up
- etcd: The cluster's brain. Automated etcd snapshots to external storage (minimum every 30 minutes for critical clusters)
- Kubernetes resources: All manifests, ConfigMaps, Secrets, CRDs — Velero handles this
- Persistent volumes: Database data, file storage, stateful application data — CSI snapshots + cross-region replication
- GitOps repository: Your source of truth. Already backed up in Git, but ensure the Git hosting is also resilient.
- External dependencies: DNS records, certificates, secrets backend (Vault), container registry — these must also be recoverable
- Test your recovery — At least quarterly. A backup you haven't tested is not a backup. Document recovery time achieved vs RTO target.
disaster recovery
Kubernetes
RTO
RPO
Velero
business continuity
regulated enterprises