Authors: Yip-Hing Ng, Andrew D'Amario, Mat Seto, Arie Sutiono

Date: June 17, 2026

Introduction

IBM Software Hub 5.4 introduces significant advancements in Backup and Restore (BR), focusing on reliability, security, and operational efficiency. Building on previous capabilities while addressing known limitations, this release modernizes the BR architecture with a cluster-native execution model, enhanced access controls through delegated administration, and improved automation.

These updates are designed to reduce operational overhead and empower organizations to manage backup and recovery workflows more effectively in complex, cloud-native environments.

BR Operator

Enhancing Backup & Restore with Improved Architecture and Operational Flexibility

Earlier versions of Software Hub Backup & Restore relied on client workstations—particularly when using cpd-cli—to execute backup and restore operations. This approach introduced performance and reliability constraints, as operations depended heavily on the workstation's network bandwidth and connectivity, as well as local resource availability. Additionally, all activities required cluster administrator privileges, creating operational bottlenecks and limiting flexibility for routine management tasks.

IBM Software Hub Backup and Restore 5.4 addresses these challenges with the introduction of the BR Operator, a cluster-native architecture designed to enhance both performance and operational agility. By executing backup and restore processes directly within the cluster, the BR Operator eliminates dependency on client workstations, ensuring more reliable and scalable operations.

At the same time, it introduces a simplified access model through minimal RBAC delegation, allowing teams to perform backup and restore tasks without requiring full cluster administrator privileges. This evolution enables organizations to streamline operations, improve efficiency, and securely delegate responsibilities while maintaining robust control over their environments.

Key Enhancements Enabled by the BR Operator

1. Cluster-Native Backup & Restore Execution

With the BR Operator, backup and restore operations are executed directly within the cluster infrastructure, rather than through the client workstation.

This shift provides several benefits:

• Improved reliability by eliminating dependency on workstation network conditions

• Consistent performance aligned with cluster capabilities

• Reduced risk of failures caused by network variability between client and cluster environments

By leveraging the same infrastructure as your workloads, backup and restore operations become more stable and predictable.

2. Minimal RBAC and Delegated Administration

The BR Operator introduces role-based responsibility delegation, enabling cluster administrators to assign backup and restore tasks to instance administrators.

This enhancement allows organizations to:

• Distribute operational responsibilities across teams

• Reduce dependency on cluster admins for routine tasks

• Improve responsiveness in day-to-day backup and recovery operations

By using the standard cpd-cli command as follows, cluster administrators will be able to generate roles for managing backup and restore for a Software Hub instance.

3. Declarative Orchestration Framework

The BR Operator is built on a new declarative orchestration model using Kubernetes Custom Resource definitions.

This approach enables:

• Operations defined as desired states

• Greater transparency and traceability into operations

• Alignment with simplified Kubernetes-native management practices

By adopting a declarative model, operations are defined as desired states, allowing the system to consistently execute and maintain them without manual intervention.

Summary

The Backup & Restore (BR) Operator introduces a modern, cluster-native approach that improves the reliability, performance, and flexibility of backup and restore operations. It eliminates reliance on client workstations by running operations directly within the cluster, ensuring consistent and scalable execution.

Additionally, it supports streamlined role-based access control (RBAC), enabling access restrictions without requiring full cluster administrator privileges. With its declarative Kubernetes-based orchestration model, the BR Operator provides greater transparency, automation, and operational efficiency, making backup and recovery processes more streamlined and manageable.

Enhanced BR Operations

Minimized Role Access Control

Further strengthening this model of cleaner separation of duties between cluster and tenant administrators through the introduction of the BR Operator, roles assigned to the cpdbr-tenant have been minimized to ensure backup and restore operations only have the permissions that are strictly required. Additionally, during installation, there is now an option to generate and save the cpdbr-tenant resources as a YAML manifest (via dry run), allowing cluster administrators to review and apply them separately—an important capability for environments that require strict separation of administrative responsibilities.

In addition, Backup & Restore precheck tooling now intelligently identifies the required resources and access verbs for service hooks, ensuring that all necessary permissions are in place and reducing the time between configuration and the first successful backup.

Hook Execution Parallelism

To enhance the efficiency of backup and restore operations, IBM Software Hub now supports parallel execution of backup and restore hooks. This non-linear approach allows multiple operations to run concurrently, significantly reducing overall runtime. The level of parallelism can be customized using the --max-parallel-ops parameter, enabling users to tailor performance based on their system capabilities.

Private Registry Standardization

To improve usability, consistency, and reliability, all backup and restore commands and operations have been enhanced through the standardization of automatic private registry handling through IBM Software Hub's cpd_vars.sh environment variable $PRIVATE_REGISTRY_LOCATION (or the new standardized --private-registry-location parameter across the cpd-cli oadp command line utility), eliminating the need to set manual image prefix flags and reducing the risk of user error.

This makes backup and restore workflows easier to execute and more dependable, with private registry image prefixes now automatically and explicitly defined—removing reliance on cluster-level mappings in alignment with the move away from image digest and tag mirror sets (IDMS and ITMS mappings) in 5.4.x, and ensuring consistent, reliable behavior without user input.

Improved Automation and Backup Pre-check Robustness

Automation and pre-check capabilities have been strengthened to improve reliability and reduce backup failures. New image validation checks ensure that all hook images are accessible before backup execution, while transaction manager permission checks confirm that required privileges are in place. These enhancements are complemented by broader resiliency and automated validation improvements across IBM Software Hub services, along with the introduction of automatic recipe generation for Fusion multi-cluster restores—streamlining operations and ensuring more consistent, failure-resistant backup workflows.

Gather Info Enhancement

The gather-info capability has been enhanced to provide improved visibility into backup and restore environments by collecting the status of scalable resources and clearly identifying any failing components. Performance and efficiency have been significantly improved through parallelization, enabling faster data collection while ensuring background jobs are properly managed, controlled, and cleaned up—even in cancellation scenarios. In addition, a new fully functional script cpdbr-gather-info.sh, is now available to capture the same comprehensive diagnostic information independently. This results in a faster, more efficient, and more consistent experience, delivering complete and reliable diagnostics across any environment and with any version of IBM Software Hub.

Runtime Resilience and Reliability Improvements

Runtime behavior has been significantly improved to enhance stability, observability, and correctness across backup and restore workflows.

• A new executor now handles pre/post and workload hooks with improved live logging and provides complete JSON-parsable execution results.
• System resilience is strengthened through context-based timeouts that prevent indefinite hangs, along with support for overriding hook and ConfigMap-specific timeouts.
• Error handling has been refined to ensure hook failures are reliably propagated while filtering out expected or benign errors (such as "not found" scenarios), resulting in more accurate reporting.
• Backup retention has also been improved by defaulting Velero backups to their maximum lifespan, requiring explicit user action for deletion.
• Additionally, restore reliability is enhanced by eliminating race conditions in resource cleanup, avoiding unnecessary failures, and ensuring waits are scoped only to pods involved in hook execution, preventing stalls and improving overall efficiency.
  

Improved BR Documentation

Backup and Restore documentation has been significantly improved through extensive fixes and refinements across both current and earlier IBM Software Hub versions. Updates include:

• Fully overhauled private registry guidance (eliminating the need to specify image prefix flags and clearly defining required BR image versions), along with scripts for reliably preserving and copying image manifests, and clearer setup recommendations for IDMS and ITMS in pre-5.4.x environments.
• Common environment issues are now proactively addressed with automatic built-in or documented workarounds (such as the automated EDB patch for pre-5.2.x versions). Critical procedures—such as installing the OADP operator and creating the DPA—have been improved with accurate and flexible configuration, variable-driven, and parameterized values to support a wide range of client environments, and now include both automated and manual installation methods to accommodate scenarios where cluster-scoped changes require separate administrative review.
• cpd-cli oadp documentation has also been improved by clearly documenting and separating global flags from command-specific flags.
• Additional updates include improved RSI webhook setup for older versions, resulting in a more accurate, consistent, and user-friendly experience that reduces errors and improves overall usability.

Conclusion

With the 5.4 release, IBM Software Hub Backup and Restore evolves into a more resilient and scalable solution. By shifting execution into the cluster with the BR Operator, separating cluster and tenant admin permissions, and introducing various performance and resiliency improvements, backup and restore workflows are streamlined while reducing administrative burden. Overall, Software Hub 5.4 provides a stronger, more efficient foundation for protecting critical data and ensuring reliable recovery across modern enterprise environments.