How RestoreTrust works

RestoreTrust separates check coordination from backup access and restore execution.

The validation flow

1. A schedule defines when to run, which project worker and source to use, how to identify a file, and what must pass.
2. At run time, RestoreTrust creates a check and makes it available to the selected worker.
3. The worker reads credential or decryption values from a Kubernetes Secret in your cluster.
4. The worker selects and downloads the artifact, decodes it when configured, and performs the restore or file check.
5. The worker reports statuses, timings, logs, and probe results.
6. RestoreTrust records the result, sends configured notifications, and produces available report/evidence artifacts.

The project worker belongs to one project. The schedules, sources, secret metadata, checks, and access keys associated with that project remain within its project boundary.

Where sensitive values live

When you create secret metadata in the console, you provide a name, type, and Kubernetes Secret name. You put the actual values in that Kubernetes Secret in the worker's job namespace.

This means the RestoreTrust service does not receive source passwords, access keys, ZIP passwords, or age identities/passphrases. You are responsible for creating, rotating, and deleting the Kubernetes Secret on every worker used by a schedule.

Notification webhook URLs and headers are different: they are stored by RestoreTrust so it can deliver messages. Treat them as dedicated, limited, and rotatable credentials.

What determines success

For a database schedule, success requires the artifact to download and decode, the database to restore, its health check to pass, and every configured gate to pass. A file schedule confirms the file criteria you configured and can decode an encryption envelope, but it does not inspect archive or database contents.

Possible outcomes distinguish timeouts from configuration, download, restore, probe, quota, infrastructure, and other failures. See Checks for the customer-facing status model.

Responsibility boundary

RestoreTrust controls scheduling, result recording, and notification delivery. Your organization controls:

• worker cluster availability, capacity, storage, and network access
• backup creation, retention, and source permissions
• Kubernetes Secret values and rotation
• the selected database version, artifact format settings, and path
• the gates that determine whether a restore is useful