Recovery set
Back up:
- The externally managed PostgreSQL database.
- The complete protected OneView installation backup produced by the approved host procedure.
- Client-managed TLS certificates and keys, when used.
Treat the database and protected installation backup as one coordinated recovery set. An incomplete set may not recover encrypted vendor credentials or installation identity.
The client-approved retention schedule must cover database snapshots, replicas, exported records, installation-file backups, repair backups, and disaster-recovery copies. See Data boundary & responsibilities; a production-record deletion does not by itself establish that every backup or provider copy has reached its approved end of life.
Testing recovery
Test restoration in an isolated environment according to organisational policy. Validate database integrity, installation identity, secret permissions, license recovery, and vendor credential decryption.
Do not restore one installation identity onto two simultaneously active servers. License installation limits and identity binding still apply.
Stopping OneView services does not delete the externally managed PostgreSQL database.
Update and repair safety backups do not replace the client's scheduled, encrypted, retained, and restore-tested coordinated recovery set. Protect and dispose of those temporary backups under client policy.
Use the disaster-recovery runbook to assign restore ownership, keep one installation identity active, restore a compatible coordinated set, validate service, and record return-to-service approval.