Free tool · Velero · runs in your browser
Kubernetes Backup Audit
Paste the YAML of your Velero schedules, backups, storage locations, PVCs and workloads. The audit scores the setup from 0 to 100, lists every coverage gap with its severity, the exact Velero flag or field that fixes it and the documentation page behind it, and writes a restore test plan with commands for your cluster.
Schedules, recent backups, restores and storage locations. The one paste the audit cannot do without.
kubectl get schedules,backups,restores,backupstoragelocations,volumesnapshotlocations -n velero -o yamlNeeded for the coverage matrix, the volume data path check and the CSI check.
kubectl get ns,pvc,storageclass,volumesnapshotclass -A -o yamlFinds databases by image, backup hook annotations and the Velero deployment's feature flags.
kubectl get deploy,sts,ds,cronjob -A -o yamlOptional. Adds hook results and snapshot counts for the backups you paste.
velero backup describe <name> --detailsParsed in your browser. Names of namespaces, workloads, PVCs, buckets and backups are replaced by aliases before anything reaches our server; image names become a database family; raw files never leave this page. Free, three written summaries per day.
How the audit works
1. Your browser reads the YAML
Schedules, backups, restores, storage and snapshot locations, namespaces, PVCs, storage and snapshot classes, workloads and the Velero deployment itself are read from any number of pasted documents or lists. Databases are recognised by image name (Postgres, MySQL, MariaDB, MongoDB, Redis, Elasticsearch, etcd and others) and by operator kinds.
2. Fourteen checks, each tied to a Velero doc page
Coverage, data paths, hooks, TTL against the cron interval, storage locations, last results, paused and stalled schedules, cluster-scoped resources, CSI setup, restores and expiry. A check that cannot run because its objects were not pasted says so instead of guessing.
3. Score, plan, then the words
The score is 100 minus 25 per critical finding (at most 60), 10 per high (at most 30), 5 per medium (at most 15) and 2 per low (at most 6), never below 0. The restore test plan ranks namespaces by databases, PVCs and size. Only then does our engine write the summary, the reasons the top findings matter for a cluster of this shape, and a 30-day order, using nothing but the findings and counts.
Related reading and Ledgers
- Velero backup guide: install, schedules, CLI builder
- The 3-2-1-1-0 backup rule, applied
- On-prem Kubernetes Ledger
- Cloud Kubernetes Ledger
- Enterprise Backup Ledger
- Open-Source Backup Ledger
More free tools: the Infrastructure Fact Checker, the Cloud Kubernetes Advisor and the rest on the tools page.
Frequently asked questions
What does the Kubernetes Backup Audit check?
Fourteen checks against your Velero objects: namespaces with workloads but no enabled schedule, PVCs with neither a snapshot class nor file system backup, databases without pre and post hooks, a TTL shorter than the schedule interval, a single storage location, a storage location that is unavailable or not validated, a last backup that failed or partially failed, paused schedules, cluster-scoped resources left out, an unlabelled VolumeSnapshotClass or Velero running without EnableCSI, backups about to expire, and whether a restore was ever run. Each finding links the Velero documentation page it rests on.
Does my cluster data leave the browser?
No. The YAML is parsed in your browser. Before anything is sent to our server, every namespace, workload, PVC, bucket, schedule and backup name is replaced by an alias such as ns-1 or pvc-3, and image names are reduced to a database family. The server receives counts, flags, severities and those aliases, writes the summary and stores that anonymised report behind the share link. Real names are shown only on your screen.
Which backup tools are supported?
Velero in this release, including the CSI snapshot path, file system backup with kopia or restic, and the OpenShift API for Data Protection, which ships Velero. Objects from Kasten K10, CloudCasa, Trilio, Stash and the cloud providers' native backup services are recognised and reported as not supported yet, never guessed at.