Encrypted Kubernetes backups.
xbackupman snapshots every resource manifest in your cluster — Deployments, Services, ConfigMaps, Secrets, Ingress, PVCs, RBAC and more — into one encrypted YAML archive stored in a bucket you own. A read-only kubeconfig is all it needs.
What gets captured
- Namespaced resources across every namespace — workloads, services, config, secrets, ingress, PVCs and RBAC.
- Cluster-scoped resources — namespaces, nodes, persistent volumes, storage classes, cluster roles and CRDs.
- Everything exported as YAML with kubectl, concatenated into one document, gzipped and sealed with AES-256-GCM.
- A SHA-256 checksum per snapshot for on-demand integrity verification.
How it works
Add a kubeconfig
Paste a read-only (view ClusterRole) kubeconfig. It is encrypted with your organization key; the worker only needs to reach your API server.
Export every manifest
The worker runs kubectl to list and export every namespaced and cluster-scoped resource as YAML — a faithful manifest snapshot of the cluster.
Archive, encrypt, upload
The manifests are concatenated, gzipped and sealed with AES-256-GCM in the worker, then the ciphertext is uploaded to your own S3-compatible bucket.
Verify and schedule
Each archive is SHA-256 checksummed. Run it on any cadence and let retention prune old snapshots while keeping the latest.
Your storage, your keys
Your cluster manifests are written to your own bucket — S3, R2, B2 or MinIO. Encryption happens in the worker before upload, so your provider only holds ciphertext. Your cluster's declarative state stays in your custody.
xbackupman never stores your backups on its own servers. It orchestrates the pipeline and records metadata — the encrypted artifacts live only in the S3-compatible bucket you connect. See how encryption works.
One-click restore
A Kubernetes backup is a YAML archive of every resource. Download it and re-apply to any cluster with kubectl apply -f — ideal for disaster recovery, cloning an environment or migrating between clusters. This is a manifest-level backup; persistent-volume data is out of scope.
Questions
QWhat resources are captured?
Namespaced resources across all namespaces (Deployments, Services, ConfigMaps, Secrets, Ingress, PVCs, RBAC and more) plus cluster-scoped ones (Namespaces, Nodes, PVs, StorageClasses, ClusterRoles, CRDs).
QDoes it back up persistent-volume data?
No — this is a manifest-level backup of your declarative cluster state. Pair it with volume or database backups for the data inside your PVs.
QHow do I restore?
Download the YAML archive and run kubectl apply -f against any cluster to recreate the resources — a clean path for DR, migration or environment cloning.
Back up more
One engine covers every source you run — on a single schedule, in one dashboard, encrypted into the same storage.