Performing Elasticsearch Backups

OneTrust enables you to perform Elasticsearch backups to rollback the DSAR automation index. This backup procedure leverages Amazon S3 repositories to create a policy for the creation snapshots so you can revert to a previous working state.

Prerequisites

  • Create a S3 bucket in AWS without public access.

  • Create a user account with programmatic access in AWS with read/write permissions to the S3 bucket. Copy the access key ID and secret for later use.

  • In the .envs file there are several variables that need to be provided in order to configure the S3 repository for an Elasticsearch backup. The below variables will need to be provided during the installation process:

    CODE 
    #S3 Bucket configuration for Elasticsearch backup

export DR_ES_BACKUP="disabled"  ## set to "enabled" to switch on backups
export DR_ES_BACKUP_SCHED=""    ## sample format: 0 30 1 * * ?
export DR_ES_AWS_ACCESS_KEY_ID=""
export DR_ES_AWS_SECRET_ACCESS_KEY=""
export DR_ES_S3_BUCKET=""
export DR_ES_S3_REPOSITORY="" 

Installation

  1. Create a new worker node and enable indexing. Both manual and guided installations are supported. These instructions will reference manual installation as a use case.

    Note:

    For more information on worker node installation, see the following:

  2. During the worker node setup, input the required fields for the #S3 Bucket configuration for Elasticsearch backup section in the .envs file. See third list item in the Prerequisites.

  3. Deploy the worker node.

  4. Once deployed, you can check the policy configuration via the following command:

    CODE 
    kubectl exec -it dd-elasticsearch-0 -c dd-elasticsearch -n <namespace-name> -- /bin/bash 

  5. List the policies with the following:

    CODE 
    curl -X GET "localhost:9200/_slm/policy?pretty"

  6. List the snapshot(s) with the following:

    CODE 
    curl "localhost:9200/_snapshot/<repository-name>/_all?pretty" 

  7. List all the policies in Elasticsearch as this will show the cron job time and repository name. The output of the policies should be similar to the following:

    JSON 
    [root@dd-elasticsearch-0 elasticsearch]# curl -X GET "localhost:9200/_slm/policy?pretty"

{
"snapshots" : {
"version" : 1,
"modified_date_millis" : 1632748859372,
"policy" : {
"name" : "<snapshot-name>",
"schedule" : "0 0/15 * * * ?",
"repository" : "<repository-name>",
"config" : {
"indices" : [
"*"
]
},
"retention" : {
"expire_after" : "30d",
"min_count" : 5,
"max_count" : 50
}
},
"next_execution_millis" : 1632749400000,
"stats" : {
"policy" : "snapshots",
"snapshots_taken" : 0,
"snapshots_failed" : 0,
"snapshots_deleted" : 0,
"snapshot_deletion_failures" : 0
}
}
}

  8. Create a new Data Source and initiate a scan. Given Indexing is enabled, this will populate indexes in elasticsearch.

  9. Once the scan is completed, port forward elasticsearch and open a browser to view the indexed values

    CODE 
    kubectl port-forward --namespace namespacename service/dd-elasticsearch 9200:9200 2 3 

http://localhost:9200/pii_index/_search 

  10. To back up the data, run the following command after you exec into the elasticsearch pod for the new namespace:

    Note:

    You can replace the variable "indices": "pii_index" with: "indices": "*" which means that all indices will be restored.

    JSON 
    curl -X POST "localhost:9200/_snapshot/<your-repository-name>/<snapshot-recovern-name>/_restore?pretty" -H 'Content-Type: application/json' -d'
{
"indices": "pii_index",
"ignore_unavailable": true,
"include_global_state": false
}

  11. Navigate to the Index tab of the worker node in the OneTrust application to verify if the indexes were backed up.

Backup of Vault Stateful Application

If backup for the vault stateful application is required, OneTrust recommends using a third-party credential store option. For more information on the credential stores that OneTrust supports , see, Credential Vault Options for Data Sources.

Additional Backup Guidance

Beyond the elasticsearch rollback procedure listed above, OneTrust Data Discovery users can also rollback Kubernetes deployments (stateless) in two additional ways:

  1. Download the older package version and run the installer/deploy script. This will apply the older docker image for the respective deployments along with deploying all other Kubernetes resources.

  2. To undo only deployments, the Kubernetes inbuilt support undo is supported using the below commands:

    • Check rollout history of a deployment:

      CODE 
      kubectl rollout history deployments.v1.apps/<name-of-deployment>

    • Rollback to the previous version (pick the revision number from the output of the above command):

      CODE 
      kubectl rollout undo deployments.v1.apps/<name-of-deployment> --to-revision=1