Why protecting Kubernetes clusters matters
#Kubernetes manages the full lifecycle of your workloads, but it does not protect the data that keeps those workloads running. Three distinct layers are at risk:
- etcd: The key-value store that holds all cluster state. If too many nodes fail simultaneously, etcd cannot recover on its own. Without an independent backup, the cluster configuration is gone.
- Manifests: Resource definitions, namespace configurations, and workload specs can be accidentally deleted, overwritten by bad deployments, or lost during a cluster migration. Kubernetes versioning does not give you a restore point.
- Persistent Volumes: Stateful workloads store data in PVCs that live outside the cluster’s built-in resilience model. A misconfigured storage class, a deleted PVC, or a failed migration can result in permanent data loss.
Each layer requires a different backup strategy. Plakar handles all three.
What happens when a cluster is compromised?
#Kubernetes clusters are increasingly targeted by attackers who gain access through misconfigured RBAC, leaked credentials, or supply chain vulnerabilities. The consequences can be severe:
- Total state loss: With sufficient API access, an attacker can delete namespaces, wipe persistent volumes, and corrupt etcd — in seconds.
- Ransomware on persistent storage: PVCs attached to compromised pods can be encrypted or exfiltrated without any cluster-level protection.
- No clean rollback: Without independent snapshots stored outside the cluster, there is no verified state to recover from.
Plakar stores snapshots in an isolated Kloset, encrypted end-to-end and independent of the cluster itself. The backups remain intact even if the cluster is fully compromised.
How Plakar protects your Kubernetes infrastructure
#Plakar covers Kubernetes backups at three levels, each independent and composable:
- etcd backup: A full snapshot of cluster state, intended as the last line of defense in a catastrophic failure scenario.
- Manifest backup: All Kubernetes resources across the cluster (or scoped to a specific namespace) stored as a browsable, searchable Plakar snapshot. Restore the full cluster, a single namespace, or one deployment. Browse past snapshots to investigate what the cluster looked like at any point in time.
- Persistent volume backup: PVC contents captured via CSI driver snapshots, ingested into a Kloset store, and restorable into any PVC, on the same cluster or a different one.
Because Plakar connectors are composable, data is not locked to a single environment. A persistent volume backed up from one cluster can be restored to another, archived to S3, or exported as a portable ptar archive.
