Back Up and Restore Container Security

In Tenable Enclave Security 1.6 and later, Container Security state is stored entirely in PostgreSQL. There is no disk (PVC) data to back up. For versions prior to Tenable Enclave Security 1.6, contact Tenable Support.

Important Considerations

• These commands stop all Container Security and platform pods on the system. Plan for downtime accordingly.

• You must perform a restore on the exact version of Tenable Enclave Security used for the backup.

• The namespace you use during a restore must be the same as the original deployment. Database names are templated based on the namespace. Using a different namespace results in mismatched database names.

• You must re-download Container Security Agents from the Container Security UI after the restored instance is running. This ensures the Container Security Agent knows the location of the running Tenable Enclave Security instance.

• You must re-install Container Security Deployment Assessment Agents using the updated configurations downloaded from the Container Security UI after the restored instance is running.

Back Up Container Security in Tenable Enclave Security

To back up Container Security:

1. Scale down all Container Security and platform pods to prevent data drift during the backup:

   Copy

   kubectl scale deploy -n tenable-enclave-security -l blade=container-security --replicas=0
   kubectl scale deploy -n tenable-enclave-security -l blade=platform --replicas=0

2. Back up the PostgreSQL database. For steps, see the PostgreSQL backup documentation.

3. Scale the pods back up to resume normal operation:

   Copy

   kubectl scale deploy -n tenable-enclave-security -l blade=container-security --replicas=1
   kubectl scale deploy -n tenable-enclave-security -l blade=platform --replicas=1

   Note: If you are planning an immediate restore, do not perform this step. Proceed to the restore procedure below instead.

Restore Container Security in Tenable Enclave Security

Before you begin

• Uninstall the existing Helm Chart:

  Copy

  helm uninstall -n tenable-enclave-security tes-operator tes
  kubectl delete secret -n tenable-enclave-security sc-secrets

• Perform a fresh installation of Tenable Enclave Security using the steps in Install Tenable Enclave Security.

  Caution: The freshly installed version must exactly match the version used when the backup was created.

To restore Container Security:

1. Scale down all Container Security and platform pods:

   Copy

   kubectl scale deploy -n tenable-enclave-security -l blade=container-security --replicas=0
   kubectl scale deploy -n tenable-enclave-security -l blade=platform --replicas=0

2. Restore the PostgreSQL database using one of the following methods:

   • Restore the PostgreSQL backup to the database instance that the new Tenable Enclave Security installation connects to, or

   • Point the new Tenable Enclave Security installation to the existing database that already contains the backed-up data.

   For steps, see the PostgreSQL restore documentation.

3. Scale the pods back up to bring Container Security online:

   Copy

   kubectl scale deploy -n tenable-enclave-security -l blade=container-security --replicas=1
   kubectl scale deploy -n tenable-enclave-security -l blade=platform --replicas=1

4. Re-register agents after the restored instance is running:

   1. Re-download Container Security Agents from the Container Security UI.

   2. Re-install Container Security Deployment Assessment Agents using the updated configurations downloaded from the Container Security UI.