Skip to content

Migrate an MKE 3 backup schedule#

When you upgrade from MKE 3 to MKE 4, mkectl upgrade migrates an enabled [backup_schedule_config] schedule to spec.backup.schedule, and scheduled backups resume with no additional configuration. If the schedule is disabled, mkectl upgrade does not migrate it, but it does migrate a non-default notification delay.

Migrated settings#

MKE 3 setting               Result in MKE 4
Cron expression Five-field expressions are converted to equivalent six-field expressions; six-field expressions and supported descriptors are preserved.
Retention count Positive values are copied; zero or negative values become spec.backup.schedule.retain: 0, which keeps all archives.
Included logs Copied unchanged
Path Copied unchanged
Notification delay Non-default values are copied to spec.backup.notificationDelay; the default value, 7, is omitted.
Passphrase Stored in the labelled mke/mke-backup-passphrase Secret; the generated schedule sets encryption.passphraseSecretRef.name: mke-backup-passphrase.

The upgrade also sets replication to AllControllers, which matches the MKE 3 behavior of backing up on every controller.

Cron expression conversion#

MKE 3 interprets a 5-field cron expression as seconds-first, whereas MKE 4 interprets a 5-field expression as standard crontab syntax. To preserve your backup cadence, the upgrade converts the expression to the equivalent 6-field form and displays a warning that describes the change. The converted expression looks different from the MKE 3 original but runs on the same schedule.

Example

The MKE 3 0 2 * * * becomes 0 2 * * * * in MKE 4. Both run hourly at minute 2, second 0. Keeping the original five-field expression in MKE 4 would instead schedule a daily backup at 02:00. Six-field expressions and supported descriptors such as @daily remain unchanged.

Backup passphrase#

If the MKE 3 schedule is encrypted, mkectl upgrade creates and labels the mke-backup-passphrase Secret in the mke namespace from the MKE 3 passphrase.

If mke/mke-backup-passphrase already exists with a different passphrase, automatic passphrase migration fails during operator installation, after node migration. Resolve the conflict before upgrading, or use --skip-backup-passphrase-secret if you intend to supply a different passphrase. Retain the original passphrase for existing MKE 3 archives.

Warning

If you skip automatic Secret creation, scheduled backups fail until you create and label the Secret yourself. Refer to Schedule cluster backups.

To set a different passphrase:

  1. Pass --skip-backup-passphrase-secret to mkectl upgrade.
  2. Create the mke-backup-passphrase Secret in the mke namespace. For more information, refer to Schedule cluster backups.

Unsupported schedules#

If MKE 4 cannot represent the MKE 3 schedule, the upgrade fails before it modifies any node and displays an error that describes the problem. Unsupported schedules include:

  • Cron expressions that MKE 4 cannot parse
  • Schedules that run more often than every 5 minutes
  • Relative @every schedules, such as @every 24h, which are incompatible with the migrated AllControllers replication mode

To resolve the error:

  1. Fix or disable the schedule in MKE 3.
  2. Run the upgrade again.