Skip to main content

Backup Exporter

The backup exporter is a Prometheus exporter that monitors the health of your backup infrastructure. It exposes metrics and ships PrometheusRule alerts for PostgreSQL, Velero, MongoDB, MariaDB, and Sealed Secrets backups.

It ships in the kubeaid-agent chart, as its own Deployment alongside the agent, so one Argo CD application covers both.

What It Monitors​

Backup SystemAlertFires When
PostgreSQLPostgresBackupExporterJobFailedThe exporter job itself reports an error (backup_exporter_postgres_error == 1)
PostgreSQLPostgresLogicalBackupExceededRPOLatest logical backup age exceeds max_rpo
PostgreSQLPostgresCNPGWALBackupExceededRPOLatest CNPG WAL backup age exceeds max_rpo
PostgreSQLPostgresLogicalBackupMissingNo logical backup has ever been recorded
PostgreSQLPostgresWALBackupMissingNo WAL backup has ever been recorded
VeleroVeleroBackupExporterJobFailedThe exporter job itself reports an error (backup_exporter_velero_error == 1)
VeleroVeleroBackupExceededRPOOne or more volumes in a namespace have a latest backup older than max_rpo (one alert per namespace, the description lists each volume and its age)
VeleroVeleroNoBackupSchedulesVelero is not installed, or declares no Schedule resources, so no volume on the cluster is protected. One warning per cluster, after 24h
VeleroVeleroBackupMissingOne or more volumes in a namespace have never had a backup recorded (one alert per namespace, the description lists each volume). Volumes in namespaces no schedule covers, and volumes younger than max_rpo still awaiting their first scheduled run, are excluded
MongoDBMongoDBBackupExporterJobFailedThe exporter job itself reports an error (backup_exporter_mongodb_error == 1)
MongoDBMongoDBDumpBackupExceededRPOLatest dump backup age exceeds max_rpo
MongoDBMongoDBDumpBackupMissingNo dump backup has ever been recorded
MariaDBMariaDBBackupExporterJobFailedThe exporter job itself reports an error (backup_exporter_mariadb_error == 1)
MariaDBMariaDBDumpBackupExceededRPOLatest dump backup age exceeds max_rpo
MariaDBMariaDBDumpBackupMissingNo dump backup has ever been recorded
Sealed SecretsSealedSecretsBackupExporterJobFailedThe exporter job itself reports an error (backup_exporter_sealedsecrets_error == 1)
Sealed SecretsSealedSecretsKeyBackupExceededRPOLatest key backup age exceeds max_rpo
Sealed SecretsSealedSecretsKeyBackupMissingNo key backup has ever been recorded

MariaDB clusters whose Backup resources are all suspended (spec.schedule.suspend: true) are not monitored — a schedule switched off on purpose is not a missing backup.

The *BackupExporterJobFailed alerts fire on collector failures only. The exporter also emits backup_exporter_*_error series for resources that are deliberately out of scope (type="backup_not_enabled", and for Postgres cronjob_not_found / no_scheduled_backups) — a PVC in a namespace no Velero schedule includes, for instance. Those types are excluded from the JobFailed alerts and suppress the matching *BackupMissing alert, so a resource nobody chose to back up stays silent.

All alerts default to critical severity and fire after 5 minutes. These are configurable via the values file. MongoDB, MariaDB and Sealed Secrets monitoring are opt-in (enabled: false by default) since not every cluster runs those backups.

Deployment​

It is deployed with the kubeaid-agent Argo CD application, but is off by default — it needs S3 credentials for each backend it reports on, and there is no sane default for those. Set backup-exporter.enabled: true along with the credentials below. The Helm dependency condition and parent values key are both hyphenated (backup-exporter), matching Chart.yaml.

Key values, all under the backup-exporter key in values-kubeaid-agent.yaml (sibling of appConfig, not nested under it):

backup-exporter:
  enabled: true

  exporter:
    # Postgres and Velero collectors run when the chart is enabled; fill S3 for each.
    postgres:
      s3:
        secretName: ""            # Secret with access-key-id / secret-access-key (etc.)
    velero:
      s3:
        url: ""                   # S3 endpoint URL
        secretName: ""            # Or accessKeyId / secretAccessKey / region / bucket
    # Opt-in backends (default false):
    mongodb:
      enabled: false
      s3:
        secretName: ""
    mariadb:
      enabled: false
      s3:
        secretName: ""
    sealedSecrets:
      enabled: false
      s3:
        bucket: ""                # Must match sealed-secrets chart backup.s3Bucket
        endpoint: ""              # Must match backup.s3Endpoint
        secretName: ""

  # Enable Prometheus alerting rules
  prometheusRule:
    enabled: true
    postgres:
      enabled: true
      namespace: monitoring        # Where the PrometheusRule is created
      severity: critical
      alertForDuration: 5m
    velero:
      enabled: true
      namespace: monitoring
      severity: critical
      alertForDuration: 5m
    mongodb:
      enabled: false               # Follows exporter.mongodb.enabled
      namespace: monitoring
      severity: critical
      alertForDuration: 5m
    mariadb:
      enabled: false               # Follows exporter.mariadb.enabled
      namespace: monitoring
      severity: critical
      alertForDuration: 5m
    sealedSecrets:
      enabled: false               # Follows exporter.sealedSecrets.enabled
      namespace: monitoring
      severity: critical
      alertForDuration: 5m

The exporter also ships a ServiceMonitor for automatic Prometheus scraping and supports HorizontalPodAutoscaler configuration.

Integration with Existing Monitoring​

The backup exporter complements KubeAid's existing monitoring stack:

  • kube-prometheus scrapes the exporter's metrics via the ServiceMonitor
  • Alertmanager routes the backup failure alerts to your configured notification channels
  • Grafana can visualise the backup health metrics alongside your cluster dashboards

See Also​