Read the cluster-state backup policy.

GET

/v1/backup/admin/config

Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/backup/admin/config \
  --header 'Authorization: Bearer <token>'

Cedar action backup:Read. v1 — the singleton operator policy for the cluster-state backup producer: enabled flag, cadence, keep-last-N retention, target, and the age recipient the bundles are encrypted to. The matching private identity lives OFF the cluster; this API never sees it.

Authorizations

bearerAuth

Responses

200

The backup policy.

application/json

The cluster-state backup policy (v1,) — the core.backup_config singleton.

object

enabled

required

boolean

cadenceSeconds

required

Seconds between scheduled backups; the control-plane RPO.

integer

>= 300

retentionCount

required

Keep-last-N verified-complete bundles on the target.

integer

>= 1

targetKind

required

string

Allowed values: directory s3

targetPath

required

Directory kind — absolute path visible inside the control-plane container (mount an off-cluster NFS export there; an on-cluster path is not DR-valid). Ignored for s3.

string

targetOptions

Per-kind target knobs. Only the fields for the active targetKind are meaningful; everything is optional.

object

requireMountpoint

Directory kind — refuse backup runs unless targetPath is a mountpoint (catches an unmounted NFS export before it silently collects bundles on the node’s own disk).

boolean

s3Endpoint

Http(s):// endpoint of any S3-compatible store (R2, garage, MinIO).

string

s3Bucket

Bucket name; must already exist.

string

s3Prefix

Optional key prefix for the bundles.

string

s3Region

Region; defaults to “auto” (correct for R2).

string

s3AccessKey

string

s3SecretKey

Write-only - GET returns the mask (“********”); sending the mask back on PUT keeps the stored value.

string

volumeTargetKind

Optional separate target for per-volume tenant-data backups. Empty falls back to the cluster-state target above — e.g. cluster-state → s3/R2, tenant-data volumes → directory/NFS.

string

Allowed values: "" directory s3

volumeTargetPath

string

volumeTargetOptions

Per-kind target knobs. Only the fields for the active targetKind are meaningful; everything is optional.

object

requireMountpoint

Directory kind — refuse backup runs unless targetPath is a mountpoint (catches an unmounted NFS export before it silently collects bundles on the node’s own disk).

boolean

s3Endpoint

Http(s):// endpoint of any S3-compatible store (R2, garage, MinIO).

string

s3Bucket

Bucket name; must already exist.

string

s3Prefix

Optional key prefix for the bundles.

string

s3Region

Region; defaults to “auto” (correct for R2).

string

s3AccessKey

string

s3SecretKey

Write-only - GET returns the mask (“********”); sending the mask back on PUT keeps the stored value.

string

ageRecipient

required

Age X25519 recipient (age1…) the bundles are encrypted to.

string

incrementalBackups

Opt volume backups into rbd export-diff chains: a full base then diffs shipping only changed blocks. Default false (full exports).

boolean

runRequestedAt

string format: date-time

nullable

updatedAt

required

string format: date-time

Example

{
  "targetKind": "directory",
  "volumeTargetKind": ""
}