# openshift/hypershift-oadp-plugin architecture

> Architecture diagram of the GitHub repository openshift/hypershift-oadp-plugin, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/openshift/hypershift-oadp-plugin
- Repository: https://github.com/openshift/hypershift-oadp-plugin

## Overview

HyperShift OADP Plugin is a Velero/OADP plugin for backing up and restoring Hosted Control Planes. Velero dispatches backup and restore item actions; the backup action validates and annotates HCP resources and can coordinate an etcd snapshot, while restore updates resources and signs snapshot URLs when needed. The README documents AWS, Azure, Agent/BareMetal, KubeVirt, and OpenStack support. Edges follow the sampled source, SOURCE INDEX references, and README; unsampled platform-specific behavior is not expanded into inferred call flows.

Main entry points: [`pkg/core/restore.go`](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/restore.go) (Restore action), [`pkg/core/backup.go`](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/backup.go) (Backup action), [`pkg/core/validation`](https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/core/validation) (Action validation), [`main.go`](https://github.com/openshift/hypershift-oadp-plugin/blob/main/main.go) (Plugin server)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Plugin runtime"]
  node_entry["Plugin server<br/>[main.go]"]
end

subgraph group_hcp["HCP lifecycle"]
  node_backup["Backup action<br/>[backup.go]"]
  node_restore["Restore action<br/>[restore.go]"]
  node_validation["Action validation"]
  node_shared["Shared types<br/>[types.go]"]
  node_common["Kubernetes utilities"]
  node_agent["Agent migration<br/>[agent.go]"]
  node_platforms["Platform support"]
end

subgraph group_etcd["Etcd snapshots"]
  node_orchestrator["Etcd backup orchestration<br/>[orchestrator.go]"]
end

subgraph group_cloud["Cloud signing"]
  node_s3["S3 URL signing<br/>[presign.go]"]
  node_sts["AWS STS credentials<br/>[sts.go]"]
  node_azure["Azure Blob SAS<br/>[sas.go]"]
  node_delegation["Azure delegation<br/>[delegation.go]"]
end

node_velero(("Velero"))
node_clusterapi[("Kubernetes API")]
node_objectstore[("Backup object storage")]

node_velero -->|"starts plugin"| node_entry
node_entry -->|"registers action"| node_backup
node_entry -->|"registers action"| node_restore
node_backup -->|"validates backup"| node_validation
node_restore -->|"validates restore"| node_validation
node_validation -->|"uses options"| node_shared
node_backup -->|"uses options"| node_shared
node_restore -->|"uses options"| node_shared
node_backup -->|"uses utilities"| node_common
node_restore -->|"uses utilities"| node_common
node_backup -->|"runs migration tasks"| node_agent
node_backup -->|"creates and awaits snapshot"| node_orchestrator
node_orchestrator -->|"reads and writes resources"| node_clusterapi
node_orchestrator -->|"maps storage location"| node_objectstore
node_restore -->|"presigns snapshot URL"| node_s3
node_restore -->|"resolves AWS credentials"| node_sts
node_restore -->|"gets delegation key"| node_delegation
node_restore -.->|"signs blob URL"| node_azure
node_validation -->|"checks platform type"| node_platforms

click node_entry "https://github.com/openshift/hypershift-oadp-plugin/blob/main/main.go"
click node_backup "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/backup.go"
click node_restore "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/restore.go"
click node_validation "https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/core/validation"
click node_shared "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/types/types.go"
click node_common "https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/common"
click node_agent "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/platform/agent/agent.go"
click node_orchestrator "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/etcdbackup/orchestrator.go"
click node_s3 "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/s3presign/presign.go"
click node_sts "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/s3presign/sts.go"
click node_azure "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/azblobsas/sas.go"
click node_delegation "https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/azblobsas/delegation.go"
click node_platforms "https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/core/validation"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry toneBlue
class node_backup,node_restore,node_validation,node_shared,node_common,node_agent,node_platforms,node_clusterapi,node_objectstore toneAmber
class node_orchestrator toneMint
class node_s3,node_sts,node_azure,node_delegation toneRose
class node_velero toneIndigo
```

## Components

### Plugin runtime

- [Plugin server](https://github.com/openshift/hypershift-oadp-plugin/blob/main/main.go): `main.go`

### HCP lifecycle

- [Backup action](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/backup.go): `pkg/core/backup.go`
- [Restore action](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/restore.go): `pkg/core/restore.go`
- [Action validation](https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/core/validation): `pkg/core/validation`
- [Shared types](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/core/types/types.go): `pkg/core/types/types.go`
- [Kubernetes utilities](https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/common): `pkg/common`
- [Agent migration](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/platform/agent/agent.go): `pkg/platform/agent/agent.go`
- [Platform support](https://github.com/openshift/hypershift-oadp-plugin/tree/main/pkg/core/validation): `pkg/core/validation`

### Etcd snapshots

- [Etcd backup orchestration](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/etcdbackup/orchestrator.go): `pkg/etcdbackup/orchestrator.go`

### Cloud signing

- [S3 URL signing](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/s3presign/presign.go): `pkg/s3presign/presign.go`
- [AWS STS credentials](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/s3presign/sts.go): `pkg/s3presign/sts.go`
- [Azure Blob SAS](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/azblobsas/sas.go): `pkg/azblobsas/sas.go`
- [Azure delegation](https://github.com/openshift/hypershift-oadp-plugin/blob/main/pkg/azblobsas/delegation.go): `pkg/azblobsas/delegation.go`

### Other components

- **Velero**
- **Kubernetes API**
- **Backup object storage**

## Connections

- Velero → Plugin server: starts plugin (evidence: `README.md`)
- Plugin server → Backup action: registers action (evidence: `main.go`)
- Plugin server → Restore action: registers action (evidence: `main.go`)
- Backup action → Action validation: validates backup (evidence: `pkg/core/backup.go`)
- Restore action → Action validation: validates restore (evidence: `pkg/core/restore.go`)
- Action validation → Shared types: uses options (evidence: `pkg/core/validation/backup.go`)
- Backup action → Shared types: uses options (evidence: `pkg/core/backup.go`)
- Restore action → Shared types: uses options (evidence: `pkg/core/restore.go`)
- Backup action → Kubernetes utilities: uses utilities (evidence: `pkg/core/backup.go`)
- Restore action → Kubernetes utilities: uses utilities (evidence: `pkg/core/restore.go`)
- Backup action → Agent migration: runs migration tasks (evidence: `pkg/core/backup.go`)
- Backup action → Etcd backup orchestration: creates and awaits snapshot (evidence: `pkg/core/backup.go`)
- Etcd backup orchestration → Kubernetes API: reads and writes resources (evidence: `pkg/etcdbackup/orchestrator.go`)
- Etcd backup orchestration → Backup object storage: maps storage location (evidence: `pkg/etcdbackup/orchestrator.go`)
- Restore action → S3 URL signing: presigns snapshot URL (evidence: `pkg/core/restore.go`)
- Restore action → AWS STS credentials: resolves AWS credentials (evidence: `pkg/core/restore.go`)
- Restore action → Azure delegation: gets delegation key (evidence: `pkg/core/restore.go`)
- Restore action → Azure Blob SAS: signs blob URL
- Action validation → Platform support: checks platform type (evidence: `pkg/core/validation/backup.go`)