Back up automation orchestrator

Back up your automation orchestrator deployment regularly so you can recover from failures or migrate to a new cluster. automation orchestrator does not include built-in backup tooling. Use your organization's existing backup tools and processes to capture each component.

Before you begin

You have cluster administrator access to the OpenShift namespace where automation orchestrator is deployed.
You have oc CLI access to the cluster.
You have access to a PostgreSQL client that can run pg_dump against your database instance.
You have a secure location to store backup files.

Procedure

Export all application secrets from the deployment namespace:
```
$ oc get secrets -n namespace -l app.kubernetes.io/managed-by=automation-orchestrator-operator -o yaml > app-secrets-backup.yaml
```
If you provided your own secrets through spec.secrets or spec.tls in the custom resource (CR), back up those secrets as well.
Export the database connection secrets and any other infrastructure secrets:
```
$ oc get secret backend-db-secret temporal-db-secret -n namespace -o yaml > infra-secrets-backup.yaml
```
For the full list of infrastructure secrets to include, see automation orchestrator backup components.
Export the AutomationOrchestrator CR.
Backing up the CR avoids the need to reconstruct every configuration value manually during a restore.
```
$ oc get automationorchestrator instance -n namespace -o yaml > cr-backup.yaml
```

Back up all three PostgreSQL databases in the same maintenance window:

$ pg_dump -h postgres-host -U username -d orchestrator -F custom -f orchestrator.dump
$ pg_dump -h postgres-host -U username -d temporal -F custom -f temporal.dump
$ pg_dump -h postgres-host -U username -d temporal_visibility -F custom -f temporal_visibility.dump

If S3 file storage is configured, consider pausing write traffic before you take the backup to avoid database references to files that are missing from S3.

If you configured S3 file storage through spec.fileStorage in the CR, back up the S3 bucket contents:
```
$ aws s3 sync s3://bucket-name ./s3-backup/ --endpoint-url s3-endpoint
```
If you did not configure spec.fileStorage, skip this step.

Automation orchestrator backup components

A complete automation orchestrator backup includes application secrets, infrastructure secrets, the custom resource (CR), PostgreSQL databases, and optionally S3 file storage.

Application secrets

Application secrets contain cryptographic keys that the automation orchestrator operator generates during the initial deployment. If you lose these secrets, the automation orchestrator operator generates new ones during restore. The new secrets cannot decrypt existing credentials or validate existing authentication tokens.

Important:

The credential encryption key is the most critical backup target. If you lose this key, all encrypted credentials in the database are permanently unrecoverable. You would need to re-enter every stored credential and reconfigure every identity provider.

Replace instance with the name of your AutomationOrchestrator CR (for example, my-orchestrator).

Table 1. Application secrets
Secret	Purpose	Impact if lost
`instance-secret-encryption-key`	Advanced Encryption Standard (AES)-256-GCM key that encrypts all stored credentials	Permanent data loss. All encrypted credentials become unrecoverable.
`instance-jwt-primary`	ES256 private key for JSON Web Token (JWT) signing	All active user sessions are invalidated. Users must log in again.
`instance-jwt-backup`	Backup signing key for JWT key rotation	Key rotation capability is lost until a new backup key is generated.
`instance-initial-admin-password`	Password for the initial administrator account	No impact after the first deployment. The password is used only during initial setup.
`instance-redis-password`	Redis authentication password	The automation orchestrator operator regenerates this secret automatically. Redis is used for caching only, so no data is lost.
`instance-internal-ca`,`instance-backend-tls`,`instance-worker-tls`,`instance-background-worker-tls`,`instance-temporal-tls`,`instance-ui-tls`	Internal mutual TLS (mTLS) certificates for communication between automation orchestrator components	The automation orchestrator operator regenerates these secrets automatically. No data is lost.

If you provided your own secrets through spec.secrets or spec.tls in the CR, back up those secrets as well. The automation orchestrator operator does not regenerate customer-provided secrets.

Infrastructure secrets

Back up these infrastructure secrets if they exist in your deployment:

PostgreSQL CA certificate secret (referenced by spec.postgres.caCertSecretRef)
PostgreSQL client certificate secret (referenced by spec.postgres.clientCertSecretRef)
S3 credentials secret (referenced by spec.fileStorage.credentialSecretRef)
S3 CA certificate secret (referenced by spec.fileStorage.caCertSecretRef)
Image pull secrets (referenced by spec.imagePullSecrets)
OpenTelemetry (OTEL) API key and certificate secrets (referenced by spec.otel.*SecretRef)

PostgreSQL databases

Automation orchestrator uses three PostgreSQL databases. Back up all three databases in the same maintenance window to keep them consistent.

Table 2. PostgreSQL databases
Database	Content
`orchestrator`	Application data including workflow definitions, credentials, user accounts, and project configuration.
`temporal`	Workflow execution state including running, completed, and pending workflows.
`temporal_visibility`	Workflow search indexes that support listing and filtering workflows by status, time, and other attributes.

The pg_dump command captures a consistent point-in-time snapshot without causing downtime. The application can remain running during the backup.

If S3 file storage is configured, consider pausing write traffic before you take the backup. The database stores references to files in S3. Files uploaded between the database backup and the S3 backup will not exist in the S3 backup.

Components you can skip

The following components are temporary or rebuilt automatically on startup. You do not need to include them in your backup.

Table 3. Components that do not require backup
Component	Reason
Redis	Cache only. Data is rebuilt automatically on startup.
Active user sessions	Sessions are not stored permanently. Users log in again after a restore.
Operator deployment	Installed separately through Operator Lifecycle Manager (OLM). Not part of the application backup.
Container images	Pulled from the container registry at deployment time.
In-flight workflow executions	Workflows that were running during the backup might not resume correctly. Completed and pending workflows are preserved.