All Products
Search

This Product

    Container Service for Kubernetes:Back up and restore applications in a cluster

    Document Center

    Container Service for Kubernetes:Back up and restore applications in a cluster

    Last Updated:Jun 15, 2026

    Protect ACK applications from accidental deletion, cluster failure, or corruption with scheduled or instant backups.

    Use cases

    • Disaster recovery: Recover applications and volumes after accidental deletion, cluster failure, or data corruption.

    • Cluster migration: Move applications to a cluster with a different Kubernetes version or volume plug-in.

    Limitations

    • Resources being deleted during backup are excluded.

    • Requires Kubernetes 1.16 or later. See Manually upgrade ACK clusters.

    • Disk snapshot backups require Kubernetes 1.18 or later and Container Storage Interface (CSI). Otherwise, use Cloud Backup.

    Prerequisites

    Complete the following before you start:

    Billing

    The backup center is free. Related services incur charges based on usage:

    • Object Storage Service (OSS): Stores backup YAML files. See OSS billing.

    • Snapshots: Backs up disk volumes. See Snapshot billing.

      Starting 11:00 (UTC+8) on October 12, 2023, storage fees and feature usage fees for the instant access feature are no longer charged. See Use the instant access feature. Snapshots created during backups of PL0 ESSD, PL1 ESSD, PL2 ESSD, PL3 ESSD, and ESSD AutoPL disks have the instant access feature enabled by default.

    • Cloud Backup: Backs up non-disk volumes. See Cloud Backup price details.

    Step 1: Create a backup vault

    Backups are stored in an OSS bucket linked to a vault. Create one vault per region—all ACK clusters in that region share it.

    Vaults cannot be updated after creation, only deleted. If a vault shares the name of a deleted vault, clusters that previously used backup cannot use the new vault.

    1. Log on to the ACK console. In the left-side navigation pane, choose Multi-cluster > Backup Center.

    2. On the Backup Center page, click Create Backup Vault.

    3. In the Create Backup Vault panel, configure the following parameters and click OK.

      Parameter Description
      Vault Name Lowercase letters and digits only.
      OSS Bucket Region The region where the OSS bucket is deployed.
      OSS Bucket Name The name of the OSS bucket. For ACK managed clusters, create the bucket in advance and name it in the cnfs-oss**** format.
      OSS Bucket Subdirectory (Optional) A subdirectory within the bucket.
      Visible Scope Who can see this backup vault: Alibaba Cloud accounts and the creator only, or Alibaba Cloud accounts and RAM users.

    Step 2: Create a backup plan or run an instant backup

    The backup center supports two modes:

    • Backup plan: Runs backups on a recurring schedule (daily, weekly, or monthly) until you delete the plan.

    • Instant backup: Runs a one-time backup immediately.

    Both modes create a backup task in the cluster. Track status on the Backup Records tab.

    Create a backup plan

    1. On the Clusters page, click the cluster name. In the left-side navigation pane, choose Operations > Application Backup. If prompted, install the backup service component. For registered and dedicated clusters, also configure permissions.

    2. On the Application Backup page, click Create Backup Plan. In the Create Backup Plan panel, configure the following parameters and click OK.

      Parameter Description
      Name (Required) The name of the backup plan.
      Backup Vault (Required) The vault to store backups in.
      Backup Type Application Backup: backs up cluster resources and application volumes. Data Protection: backs up volume data only (PVCs and PVs). See What are the scenarios for application backups and data protection?
      Select Namespace Include: back up only namespaces in Backup Namespace. Exclude: back up all except listed namespaces; new namespaces are automatically included. Available for backup plans only; instant backups default to Include.
      Backup Namespace (Required) One or more namespaces to back up. The following system namespaces cannot be backed up: kube-system, kube-publish, kube-node-lease, and csdr.
      Backup Volume For Application Backup: Mounted Volumes backs up to ECS snapshots (disk volumes) or Cloud Backup (other types). Disable skips volume data and restores YAML only. For Data Protection: All Volumes, Specified Types of Volumes, or Specified Volumes (by PVC). See In which scenarios do I need to back up volumes in application backups?
      Storage Valid when Backup Type is Data Protection and Backup Volume is Specified Types of Volumes. Specify the volume types to back up.
      Persistent Volume Claims Valid when Backup Type is Data Protection and Backup Volume is Specified Volumes. Specify the PVCs to back up.
      Backup Cycle (Required for backup plans) A crontab expression or interval. Example: 0 2 * * * runs daily at 2:00 AM. See How do I specify the backup cycle when I create a backup plan?

      Advanced settings

      Parameter Description
      Specified Label Back up only applications with this label. One label per plan.
      Specified Resources Comma-separated Kubernetes resource types to include. Example: deploy, configmap.
      Excluded Resources Comma-separated Kubernetes resource types to exclude. Example: pod, secret.
      Validity Period How long backups are retained before expiry. Range: 1–65,536 days. Expired backups cannot be restored.

    3. On the Backup Plans tab, click View Backup Records in the Actions column. Completed indicates success. To modify namespaces or the cycle, click Edit in the Actions column.

    Run an instant backup

    1. On the Clusters page, click the cluster name. In the left-side navigation pane, choose Operations > Application Backup. If prompted, install the backup service component. For registered and dedicated clusters, also configure permissions.

    2. On the Application Backup page, click Instant Backup. In the Instant Backup panel, configure the following parameters and click OK. Advanced settings: Same as backup plans (Specified Label, Specified Resources, Excluded Resources, Validity Period).

      Parameter Description
      Name (Required) The name of the instant backup task.
      Backup Vault (Required) The vault to store the backup in.
      Backup Type Application Backup or Data Protection. See the backup plan table above for details.
      Backup Namespace (Required) One or more namespaces to back up. The kube-system, kube-publish, kube-node-lease, and csdr namespaces cannot be backed up.
      Backup Volume Same options as for backup plans.
      Storage Valid when Backup Type is Data Protection and Backup Volume is Specified Types of Volumes.
      Persistent Volume Claims Valid when Backup Type is Data Protection and Backup Volume is Specified Volumes.

    3. On the Backup Records tab, check the Status column. Completed indicates success. To create a task from a backup record, click Clone in the Actions column.

    Step 3: Restore applications and volumes

    Important

    Restore only creates resources that do not exist in the target cluster—it never overwrites. Delete conflicting resources before restoring.

    1. On the Application Backup page, click Restore Instantly.

    2. In the Restore Instantly panel, configure the following parameters and click OK.

      Parameter Description
      Name Lowercase letters and digits only.
      Backup Vaults Select the vault with the backup. Click Initialize Backup Vault to associate the cluster (one-time setup), then select a backup file.
      Select Backup The backup file to restore.
      Restore Namespace Namespaces to restore. Leave blank to restore all, or if the backup includes cluster-level resources.
      Reset Namespace Remap namespaces during restore. Click Add, select the source, and specify the target after :. Example: old-namespace:new-namespace.
      Reset Image Repository Replace container image registries. Click Add, enter the current address and the replacement after :. Example: docker.io/library:registry.cn-hangzhou.aliyuncs.com/xxx.
      StorageClass Conversion Converts the StorageClass of PVCs during restore. Example: select alicloud-disk to convert NAS volumes to disk. Only FileSystem-type volumes (non-disk, backed up by Cloud Backup) support conversion. ReadWriteMany volumes cannot convert to disk. For ReadOnlyMany volumes, ensure replicas are not mounted on multiple nodes before conversion.

    Verify the restore

    After restoring, verify that applications, volumes, and Services run correctly.

    1. In the left-side navigation pane of the restored cluster, choose Workloads > Deployments. Find the application and click Details in the Actions column. On the Pods tab, check that the status shows Running.

    2. Choose Volumes > Persistent Volume Claims. Confirm that the restored PVCs are listed.

    3. Choose Network > Services. Click the external endpoint of a Service to confirm it is accessible.

    Next steps