Export the blobstore into a file.

tux > kubectl exec --namespace kubecf singleton-blobstore-0 --
tar cfz - --exclude=/var/vcap/store/shared/tmp /var/vcap/store/shared >
blob.tgz

The current UAA database configuration does not allow exporting of a mysqldump, so need to be more permissive.

tux > cat <<EOF | kubectl exec --stdin database-0 --namespace kubecf
-- mysql
SET GLOBAL pxc_strict_mode=PERMISSIVE;
SET GLOBAL
sql_mode='STRICT_ALL_TABLES,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION';
set GLOBAL innodb_strict_mode='OFF';
EOF

Export the UAA database into a file.

tux > kubectl exec --stdin database-0 --namespace kubecf --
mysqldump uaa > uaadb-src.sql

Export the Cloud Controller Database (CCDB) into a file.

tux > kubectl exec --stdin database-0 --namespace kubecf --
mysqldump cloud_controller > ccdb-src.sql

Save the CCDB encryption key(s). Adjust the A flag as needed to include all keys.

tux > kubectl exec --stdin --tty --namespace kubecf api-0 -- bash
-c "cat /var/vcap/jobs/cloud_controller_ng/config/cloud_controller_ng.yml | grep
-A 10 db_encryption" > enc_key

Deploy the target SUSE Cloud Application Platform cluster following the steps for your platform.

The current UAA database configuration does not allow importing of a mysqldump, so needs to be made more permissive.

tux > cat <<EOF | kubectl exec --stdin database-0 --namespace kubecf
-- mysql
SET GLOBAL pxc_strict_mode=PERMISSIVE;
SET GLOBAL
sql_mode='STRICT_ALL_TABLES,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION';
set GLOBAL innodb_strict_mode='OFF';
EOF

Import the UAA database.

tux > kubectl exec --stdin database-0 --namespace kubecf -- mysql
uaa < uaadb-src.sql

Verify the import is successful. The output should list the users from the deployment the backup was taken from.

tux > echo "select username from uaa.users;" | kubectl exec -i
database-0 --namespace kubecf -- mysql

Import the blobstore and restart the pod for changes to take affect.

tux > kubectl exec --stdin singleton-blobstore-0 --namespace kubecf -- tar xfz - -C
/ < blob.tgz

tux > kubectl delete pod --namespace kubecf singleton-blobstore-0

Drop the current CCDB and create a new instance.

tux > echo "drop database cloud_controller; create database
cloud_controller;" | \
     kubectl exec -i database-0 --namespace kubecf -- mysql

Import the CCDB.

tux > kubectl exec --stdin database-0 --namespace kubecf -- mysql
cloud_controller < ccdb-src.sql

Update the encryption key.

1. Create a YAML configuration file containing the encryption key information. The file structure should look similar to the following example, called enc_key_values.yaml. Replace the example values using the values from the enc_key file generated earlier. Depending on the state of the cluster the encryption keys were retrieved from, the key labels may differ and not be encryption_key_0.

   ccdb:
     encryption:
       rotation:
         key_labels:
         - encryption_key_0
         current_key_label: encryption_key_0
   
   credentials:
     cc_db_encryption_key:
   elqdi7TARO6NYELa9cUr6WwMYIvqaG4U0nMyfL1loDYi02C1Rrneov6fxxfd64je
     ccdb_key_label_encryption_key_0:
   tPhZZbMNYVWKs0II8e8pMxsJMokeReUrJAnQNdLaXEheTZVv5OpMe7vdyThhrkEP

   In the above, the key credentials.ccdb_key_label_encryption_key_0 is based on the generic form credentials.ccdb_key_label_XYZ. The XYZ should be replaced with the value of the current_key_label.

   For example, if the current_key_label is new_key, then credentials.ccdb_key_label_new_key should be used.

2. Perform a helm upgrade for the changes to take affect.

   tux > helm upgrade kubecf suse/kubecf
   \
   --namespace kubecf \
   --values kubecf-config-values.yaml \
   --values enc_key_values.yaml \
   --version 2.7.13

When all pods are fully running, verify the restore is successful. Example commands to run include cf apps, cf marketplace, or cf services.