Skip to content

Prerequisites

Before installing Retour, ensure your environment meets these requirements.

Kubernetes Cluster

  • Kubernetes 1.24+ (tested with 1.28+)
  • kubectl configured and able to reach the cluster

CSI VolumeSnapshot Support

Retour uses CSI VolumeSnapshots for consistent PV backups. Your cluster must have:

  1. CSI driver with snapshot support (e.g., Rook-Ceph, AWS EBS CSI, GCE PD CSI)
  2. VolumeSnapshot CRD and VolumeSnapshotClass installed

Check if VolumeSnapshot is available:

kubectl get crd volumesnapshots.snapshot.storage.k8s.io

If not installed, add the snapshot controller and a VolumeSnapshotClass for your storage provisioner.

Storage Backend

You need at least one storage backend for backups:

Type Use Case
S3 / MinIO Object storage (most common)
Ceph On-prem or Ceph RGW
Local Development, single-node
Crypt Encrypted wrapper around any backend

Azure and SFTP

Retour uses rclone and supports S3-compatible, local, and crypt backends. Azure Blob Storage can be used via its S3-compatible API (where available). SFTP is supported by rclone but not as a direct StorageBackend type in Retour; use an S3-compatible or local backend instead.

Database (UI only)

  • PostgreSQL 12+, only if you deploy the optional UI

The database stores UI connection settings and Dex/OIDC session state — nothing else. Backup and restore state lives in the CRs and on the storage backend, so the operator, worker, and carrier never touch Postgres. If you run Retour without the UI, skip the database entirely.

Optional: Dex (Identity Provider)

The Retour UI authenticates against any number of OIDC/OAuth2 and SAML identity providers: Okta, Keycloak, Entra ID, Ping, JumpCloud, OneLogin, CyberArk, a generic OIDC issuer, or Dex. Each configured provider gets its own button on the login page, and group-to-role mapping can be set per provider. Dex is one option among them, useful when you want to federate LDAP, GitHub, or Google through a single connector.