Back Up and Restore Tenable Security Center

Tenable recommends performing regular backups of your Tenable Security Center in Tenable Enclave Security data and configurations to ensure you can recover your environment in the event of hardware failure or data loss. By maintaining current backups, you can quickly restore your vulnerability management operations and minimize downtime.

Important Considerations

  • You must perform a restore on the exact version used for the backup. A version mismatch might not cause immediate errors, but it can lead to application issues later.

  • The namespace you use during a restore must be the same as the original deployment. Database names are templated based on the namespace; therefore, using a different namespace results in mismatched database names.

  • Stopping Tenable Security Center inside the container causes the Kubernetes liveness probe to fail, triggering an automatic pod restart once the failure threshold is reached. To prevent interruptions during backup and restore operations, you must temporarily disable the liveness probe before stopping Tenable Security Center.

Back up Tenable Security Center in Tenable Enclave Security

Back up a Tenable Security Center in Tenable Enclave Security deployment:

  1. Scale sc-job-manager to 0 replicas:

    Copy 
    kubectl scale deployment sc-job-manager -n tenable-enclave-security --replicas=0

  2. Stop Tenable Security Center and all running processes:

    Note: These commands stop all jobs, including scans, running on Tenable Security Center.

    1. Disable the liveness probe to prevent Kubernetes from restarting the pod while Tenable Security Center is stopped:

      Copy 
      NS=tenable-enclave-security

      IDX=$(kubectl get statefulset tenable-security-center -n $NS -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\n"}{end}' | grep -n '^sc-runtime-container$' | cut -d: -f1 | awk '{print $1-1}')

      kubectl patch statefulset tenable-security-center -n $NS --type=json -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/${IDX}/livenessProbe\"}]"

    2. Log in to the Kubernetes runtime container:

      Copy 
      kubectl exec -it tenable-security-center-0 -n tenable-enclave-security -- /bin/sh

    3. Stop Tenable Security Center:

      Copy 
      /scbase/SC.sh stop

    4. View all running processes:

      Copy 
      ps -fu tns

    5. If any processes are listed, run the following commands to stop them:

      Copy 
      killall -u tns
      killall httpd

    6. If necessary, repeat step e to confirm all processes are stopped.

  3. Create a backup .tar file:

    Copy 
    tar -Ppzcf /opt/sc_backup.tar.gz /opt/sc

    Note: The .tar file switches are case-sensitive.

    Tenable Security Center creates the sc_backup.tar.gz backup file in the /opt/sc directory.

  4. Exit the container:

    Copy 
    exit

  5. Copy the backup file to your local working directory by running the following command from your local shell:

    Copy 
    kubectl cp tenable-enclave-security/tenable-security-center-0:/opt/sc_backup.tar.gz -c sc-runtime-container sc_backup.tar.gz

    Note: Ensure your local directory has enough space for the backup file.

    Tenable Security Center is backed up to your local directory.

  6. Log in to the Kubernetes runtime container again:

    Copy 
    kubectl exec -it tenable-security-center-0 -n tenable-enclave-security -- /bin/sh

  7. Remove the backup file from the /opt directory:

    Copy 
    rm /opt/sc_backup.tar.gz

  8. Exit the container:

    Copy 
    exit

  9. Depending on your next steps, scale down or restart Tenable Security Center:

    Note: Do not leave Tenable Security Center stopped inside the pod without performing one of the actions described in this step.

    • If you are planning an immediate restore, scale the tenable-security-center StatefulSet to 0 to terminate the pod and prevent Kubernetes from restarting it:

      Copy 
      kubectl scale statefulset tenable-security-center -n tenable-enclave-security --replicas=0

      Caution: Back up your PostgreSQL database before restoring.

    • If this is a periodic backup and you are not restoring now, scale sc-job-manager back to 1 replica:

      Copy 
      kubectl scale deployment sc-job-manager -n tenable-enclave-security --replicas=1

      Then restart the tes-operator pod to restore the liveness probe and restart the Tenable Security Center StatefulSet:

      Copy 
      kubectl delete po -n tenable-enclave-security <tes-operator-pod>

Back Up PostgreSQL Database

After you complete the Tenable Security Center backup, back up the PostgreSQL database connected to the instance before you restart Tenable Security Center or proceed with a restore. For steps, see the PostgreSQL backup documentation.

Restore Tenable Security Center in Tenable Enclave Security

Before you begin

  • Uninstall the existing Helm chart and delete the Tenable Security Center database secret:

    Copy 
    helm uninstall -n tenable-enclave-security tes-operator tes
    kubectl delete secret -n tenable-enclave-security sc-secrets

  • Perform a fresh install of Tenable Security Center using the steps in Install Tenable Enclave Security.

    Caution: The freshly installed version must exactly match the version used when the backup was created.

To restore Tenable Security Center from a backup file:

  1. Scale sc-job-manager to 0 replicas:

    Copy 
    kubectl scale deployment sc-job-manager -n tenable-enclave-security --replicas=0

  2. Stop Tenable Security Center and all running processes:

    1. Disable the liveness probe to prevent Kubernetes from restarting the pod while Tenable Security Center is stopped:

      Copy 
      NS=tenable-enclave-security

      IDX=$(kubectl get statefulset tenable-security-center -n $NS -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\n"}{end}' | grep -n '^sc-runtime-container$' | cut -d: -f1 | awk '{print $1-1}')

      kubectl patch statefulset tenable-security-center -n $NS --type=json -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/${IDX}/livenessProbe\"}]"

    2. Log in to the Kubernetes runtime container:

      Copy 
      kubectl exec -it tenable-security-center-0 -n tenable-enclave-security -- /bin/sh

    3. Stop Tenable Security Center:

      Copy 
      /scbase/SC.sh stop

    4. View all running processes:

      Copy 
      ps -fu tns

    5. If any processes are listed, run the following commands to stop them:

      Copy 
      killall -u tns
      killall httpd

      Note: These commands stop all jobs (including scans) running on Tenable Security Center.

    6. If necessary, repeat step e to confirm all processes are stopped.

  3. Exit the container:

    Copy 
    exit

  4. Confirm that sc_backup.tar.gz is present in your local working directory.

  5. Copy the backup file into the container by running the following command from your local shell:

    Copy 
    kubectl cp sc_backup.tar.gz tenable-enclave-security/tenable-security-center-0:/opt/sc_backup.tar.gz -c sc-runtime-container

  6. Log in to the Kubernetes runtime container:

    Copy 
    kubectl exec -it tenable-security-center-0 -n tenable-enclave-security -- /bin/sh

  7. Restore Tenable Security Center from the backup file:

    Copy 
    tar -Pxvf /opt/sc_backup.tar.gz

  8. Remove the backup file from the /opt directory:

    Copy 
    rm /opt/sc_backup.tar.gz

  9. Exit the container:

    Copy 
    exit

  10. Update .pgvars with the new PostgreSQL password.

    The restored backup overwrites .pgvars with the old PostgreSQL password from the source instance. The freshly installed instance has a new password — update SC_PG_PASSWORD in /opt/sc/.pgvars to reflect this before starting Tenable Security Center.

    Retrieve the new PostgreSQL password from the Kubernetes secrets in the deployment namespace (see Credential reference), then update the file:

    Copy 
    # Get the new Postgres password from the sc-secrets Kubernetes secret
    NEW_PG_PASSWORD=$(kubectl get secret sc-secrets -n tenable-enclave-security -o jsonpath='{.data.SC_DB_PASSWORD}' | base64 -d)

    # Update .pgvars inside the SC pod
    kubectl exec tenable-security-center-0 -n tenable-enclave-security -c sc-runtime-container -- sed -i "s/^export SC_PG_PASSWORD=.*/export SC_PG_PASSWORD=${NEW_PG_PASSWORD}/" /opt/sc/.pgvars

    # Verify
    kubectl exec tenable-security-center-0 -n tenable-enclave-security -c sc-runtime-container -- grep "^export SC_PG_PASSWORD=" /opt/sc/.pgvars

  11. Scale the tenable-security-center StatefulSet to 0 to terminate the pod while the PostgreSQL restore completes:

    Copy 
    kubectl scale statefulset tenable-security-center -n tenable-enclave-security --replicas=0

Restore PostgreSQL Database

After you restore the Tenable Security Center files and scale down the pods, restore the PostgreSQL database before restarting Tenable Security Center.

  • Always restore using the DB superuser, not the application user

    The application DB user does not have superuser privileges. Running pg_restore as the app user fails when replaying SET ROLE statements used to reassign object ownership. Always use the database superuser for the restore. The superuser credentials (host, port, username, password) are stored in the Kubernetes secrets in the deployment namespace.

  • Do not use --no-owner or --no-privileges flags

    Omit these flags so that pg_restore replays object ownership (ALTER ... OWNER TO) and privilege grants (GRANT) exactly as they were in the source database. Using these flags silently drops ownership assignments and access controls, which can cause application errors after the restore.

  • The application user does not need manual setup after restore

    If the application DB user pre-existed on the database instance (that is, the restore process did not drop it), it retains its existing password and privileges. You do not need to run CREATE USER, ALTER USER, or GRANT manually. Verify connectivity using the application user credentials available in the Kubernetes secrets and ConfigMaps in the deployment namespace.

  • Credential reference

    Credential Kubernetes Resource Key

    DB host & port

    tes-pg-secrets (Secret)

    pg_host

    Superuser username

    tes-pg-secrets (Secret)

    pg_user

    Superuser password

    tes-pg-secrets (Secret)

    pg_pass

    App DB username

    sc-config-map (ConfigMap)

    TES_SC_USER

    App DB name

    sc-config-map (ConfigMap)

    TES_SC_DB_NAME

    App DB password

    sc-secrets (Secret)

    SC_DB_PASSWORD

Restart Tenable Security Center

After you complete the PostgreSQL restore, scale sc-job-manager and the tenable-security-center StatefulSet back to 1:

Copy 
kubectl scale deployment sc-job-manager -n tenable-enclave-security --replicas=1
kubectl scale statefulset tenable-security-center -n tenable-enclave-security --replicas=1

Tenable Security Center starts automatically as the pod comes up.