sanitize¶

Filter a full Rancher backup tarball to keep selected downstream cluster(s) for migration restore.

Bosch / multi-RKE1 (typical)¶

Keep every RKE1 custom cluster; remove imported, RKE2-provisioned, and local-cluster artifacts:

rancher-polymorph sanitize \
  --input ./backups/source-full.tar.gz \
  --output ./backups/sanitized-rke1-only.tar.gz \
  --keep-rke1-only \
  --report ./backups/report.txt

Single downstream cluster¶

rancher-polymorph sanitize \
  --input ./backups/source-full.tar.gz \
  --output ./backups/sanitized.tar.gz \
  --keep-cluster c-aaaaa \
  --report ./backups/report.txt

Append restore (2nd+ restore on live target, any origin)¶

Use when target Rancher already runs after a prior restore. Strips global config (users, settings, auth) and local; keeps only selected downstream cluster(s).

rancher-polymorph sanitize \
  --input ./backups/other-rancher-full.tar.gz \
  --output ./backups/si0dcs17-append.tar.gz \
  --keep-cluster c-6zp5c \
  --for-append-restore \
  --for-restore \
  --restore-name rancher-restore-si0dcs17 \
  --report ./backups/report.txt

Then copy the tarball to the backup operator PVC and apply the generated *-restore.yaml (prune: false). Reconnect RKE1 agents on the new cluster.

Flags¶

Flag	Description
`-i, --input`	Full backup `.tar.gz` (required)
`-o, --output`	Sanitized output path (required)
`--keep-rke1-only`	Keep all RKE1 custom clusters; remove imported/RKE2/local
`--keep-cluster`	Keep this one downstream cluster ID only
`--remove-cluster`	Explicit cluster ID to strip (repeatable; orphan ghosts)
`--no-auto-orphans`	Disable orphan ghost auto-detection (`--keep-cluster` only)
`--for-append-restore`	Strip globals; clusters-only tarball for 2nd+ restore on live target (any origin)
`--for-restore`	Write Restore CR YAML (`prune: false`) as `<output-stem>-restore.yaml`
`--restore-name`	Restore CR `metadata.name` (default: `rancher-restore` or `rancher-restore-append`)
`--restore-manifest`	Custom path for Restore CR YAML
`--fast`	gzip level 1
`--compress-level`	gzip 1–9 (default 3)
`-r, --report`	Write full removal report
`--log-file`	Append timestamped log

Note

--keep-rke1-only ignores defaults.keep_cluster from config. Do not combine with --keep-cluster.

What gets removed¶

Other downstream clusters (management CRs, nodes, Fleet mappings)
Local cluster artifacts (recreated on restore)
Auto-detected orphan cluster IDs in paths without management definitions (with --keep-cluster)
Fleet debris for removed clusters

See Keep vs drop.