How Edges Work

The Control Plane remains responsible for coordinating protection. It schedules operations, manages inventories, stores metadata, and resolves the secrets required to perform a task.

The edge is responsible for executing the operation. It connects to the Control Plane and accesses the source or destination from its own network.

A deployment can contain multiple edges in different environments:

flowchart LR
  PCP["Plakar Control Plane"]

  subgraph Site1["Datacenter A"]
    Edge1["Edge"]
    VM1["Virtual Machines"]
    DB1["Databases"]
  end

  subgraph Site2["Remote Office"]
    Edge2["Edge"]
    NAS["NAS"]
    Files["File Servers"]
  end

  PCP -->|Assign task| Edge1
  PCP -->|Assign task| Edge2

  Edge1 --> VM1
  Edge1 --> DB1

  Edge2 --> NAS
  Edge2 --> Files

The important part of this architecture is that the Control Plane does not need direct access to the protected resources. It only needs to communicate with the edges. Each edge must be able to reach both the Control Plane and the resources it is responsible for.

Task lifecycle

An edge is enrolled once with the Control Plane. During enrollment, PCP gives the edge an authentication token that it stores locally.

After enrollment, the edge maintains its connection to PCP by polling for work. When a scheduled operation is assigned to it, PCP provides the information and secrets required to perform the operation. The edge then connects directly to the source, store or destination, performs the operation, and reports its status to PCP.

A task runs through an integration, such as the S3 integration when backing up an S3 bucket. The edge installs the integrations its tasks need from the Control Plane, not from the internet, so an edge never needs internet access to obtain them.

While a task runs, the edge streams its progress back to PCP. The job details of a task run on an edge therefore show the same information as for a task run on the Control Plane: progress, resource and network graphs, recent paths, and output. The output carries what the task writes to stderr, along with the output of its pre-job and post-job hooks.

sequenceDiagram
  participant Edge as plakar-edge
  participant PCP as Plakar Control Plane
  participant Target as Source / Destination

  Note over Edge,PCP: One-time enrollment
  Edge->>PCP: Register with enrollment key
  PCP-->>Edge: Authentication token

  Note over Edge,PCP: Task execution
  PCP->>Edge: Assign task
  PCP-->>Edge: Resolve and provide required secrets
  Edge->>PCP: Install required integration
  Edge->>Target: Execute operation locally
  Edge-->>PCP: Stream progress and output
  Target-->>Edge: Result
  Edge-->>PCP: Report task status

Because the edge initiates communication with PCP, you do not need to expose an edge to inbound connections from the Control Plane. This also makes it suitable for environments where inbound connectivity is restricted.

Secrets

Secrets required by a task remain managed by the Control Plane.

When PCP assigns a task to an edge, it resolves the secrets required for that operation and provides them to the edge for the duration of the task. This can include repository credentials such as a repository passphrase.

The edge therefore does not need to maintain a separate copy of the credentials required by every task it executes.

Pages

Solutions

Resources

Newsletter