## Why protecting Kubernetes clusters matters

Kubernetes manages the full lifecycle of your workloads, but it does not protect
the data that keeps those workloads running. Three distinct layers are at risk:

- **etcd**: The key-value store that holds all cluster state. If too many nodes
  fail simultaneously, etcd cannot recover on its own. Without an independent
  backup, the cluster configuration is gone.
- **Manifests**: Resource definitions, namespace configurations, and workload
  specs can be accidentally deleted, overwritten by bad deployments, or lost
  during a cluster migration. Kubernetes versioning does not give you a restore
  point.
- **Persistent Volumes**: Stateful workloads store data in PVCs that live
  outside the cluster's built-in resilience model. A misconfigured storage
  class, a deleted PVC, or a failed migration can result in permanent data loss.

Each layer requires a different backup strategy. Plakar handles all three.

## What happens when a cluster is compromised?

Kubernetes clusters are increasingly targeted by attackers who gain access
through misconfigured RBAC, leaked credentials, or supply chain vulnerabilities.
The consequences can be severe:

- **Total state loss**: With sufficient API access, an attacker can delete
  namespaces, wipe persistent volumes, and corrupt etcd — in seconds.
- **Ransomware on persistent storage**: PVCs attached to compromised pods can be
  encrypted or exfiltrated without any cluster-level protection.
- **No clean rollback**: Without independent snapshots stored outside the
  cluster, there is no verified state to recover from.

Plakar stores snapshots in an isolated Kloset, encrypted end-to-end and
independent of the cluster itself. The backups remain intact even if the cluster
is fully compromised.

## How Plakar protects your Kubernetes infrastructure

Plakar covers Kubernetes backups at three levels, each independent and
composable:

- **etcd backup**: A full snapshot of cluster state, intended as the last line
  of defense in a catastrophic failure scenario.
- **Manifest backup**: All Kubernetes resources across the cluster (or scoped to
  a specific namespace) stored as a browsable, searchable Plakar snapshot.
  Restore the full cluster, a single namespace, or one deployment. Browse past
  snapshots to investigate what the cluster looked like at any point in time.
- **Persistent volume backup**: PVC contents captured via CSI driver snapshots,
  ingested into a Kloset store, and restorable into any PVC, on the same cluster
  or a different one.

Because Plakar connectors are composable, data is not locked to a single
environment. A persistent volume backed up from one cluster can be restored to
another, archived to S3, or exported as a portable ptar archive.