Backup and Restore Service  ·  View 07 of 26  ·  3 · Structure

Container Architecture

What is deployed where: a small control cluster, agents that run beside each source, and a custody domain administered by different people.

Editable source SVG draw.io All views
bnr-control cluster · Kubernetes Control Platform API Go · console + CLI Policy compiler Argo CD synced Coverage scanner Workflows Temporal 3 history · 2 frontend Restore workers Temporal activities Verifier workers assertion runner Records Catalogue PostgreSQL · Patroni Key management OpenBao · 5 nodes Capture agents · beside each source pgBackRest archive-async XtraBackup + binlog TiDB BR snapshot + log Velero + Kopia CSI data mover Custody domain · separate admins Custody A Ceph RGW · EC 8+3 Custody copier verify then write Custody B independent cluster Isolated cluster rehearsal targets Dead-man monitor Healthchecks run base copy S3 · STS restore into Container Architecture Application we own Data store Security / platform Interface / broker synchronous Omitted here: the ClickHouse and bucket adapters (view 09) and the verifier heartbeat (view 21). v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Capture agents run beside the source (a pgBackRest sidecar or host agent, a Velero node agent), not centrally. Bytes go from source to custody over the backup network and never pass through the control cluster.
  • Temporal holds workflow state for captures, restores and rehearsals. A restore that waits 40 minutes for an approver, retries a throttled read and resumes after a worker restart is exactly what durable workflows exist for.
  • The catalogue is ordinary PostgreSQL under Patroni. At 30 million artefacts it is a modest B-tree workload, not a reason to run a new kind of database.

Numbers

  • Control cluster: 6 worker nodes. Temporal: 3 history, 2 frontend, 2 matching. Catalogue: 3 Patroni members, one of them a synchronous replica.
  • OpenBao: 5 voters across DC-A, DC-B and the vault site, so losing one data centre keeps quorum.

Risks

  • Temporal is a large dependency for a platform that must survive its own control plane. The mitigation is that Tier 1 log shipping, custody and the manual restore path do not use it (view 18).
◀  Layered Architecture All views Integration Surface — Every Interface  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises07-container-architecture