Purpose
Replication is not a backup. Three copies protect a pool against a disk or a host dying; they do nothing about an operator purging the pool, a tenant encrypting their own volumes, or a fire in the rack that holds all three. This checklist is the gate that proves a second, independent copy exists and that somebody has restored from it recently enough to believe the procedure still works.
Order of work
The list runs in three passes and the frontmatter is in that order. The siting
pass is independent-failure-domain and backup-cadence: decide where the
copy lives and how often it is taken before arguing about tooling, because
those two fix the blast radius and the RPO everything downstream has to meet.
The per-front-end pass is rbd, cephfs and rgw; each of the three
storage interfaces has its own capture path, and a cluster serving two of them
owes a procedure for both. The proof pass is restore-test, dr-plan and
encryption - a rehearsed restore, a runbook someone could follow at 03:00,
and protection for the copy itself.
Before you start
Have the RPO and RTO the service owner agreed to, the list of pools grouped by
front end, and the date of the last restore drill. Without that date the
restore-test item cannot be answered honestly.
Verification
The gate passes when every critical item is checked. A warn item left unchecked needs a named owner and a date. Mark an item N/A rather than leaving it unchecked when it does not apply to this cluster.
Escalation
An unmet critical item goes to the storage lead and the service owner together. Relaxing an RPO is their decision, not the reviewer’s.