Issuer Directory — Backup and Restore

Audience: operators and on-call engineers responsible for protecting and recovering the Issuer Directory trust registry (CSAF publisher and VEX issuer metadata, signing keys, and per-tenant trust weights).

This runbook covers the supported, non-Kubernetes backup and restore procedures for Issuer Directory: PostgreSQL tooling, Docker Compose or host/service-manager operations, and approved host secret stores.

Scope: Kubernetes and Helm backup/restore instructions are retired. See Unsupported legacy paths.

Backup

  1. Record the release manifest digest, service version, database name, and backup operator.
  2. Export the database with pg_dump from the supported deployment host or database maintenance host.
  3. Store the dump in the approved encrypted backup location.
  4. Capture the dump SHA-256 and retention expiry.

Restore

  1. Stop Issuer Directory through Docker Compose or the host service manager.
  2. Restore the selected dump with PostgreSQL tooling.
  3. Start Issuer Directory and confirm startup migrations complete.
  4. Run issuer lookup and readiness health checks.
  5. Record the dump hash, restore timestamp, operator approval, and health output.

Unsupported legacy paths

Do not use Kubernetes pod exec, kubectl cp, Kubernetes Secret reapply, or Kubernetes deployment scaling for Issuer Directory backup or restore.