Rubrik Mosaic
You set up rubrik mosaic to back up and restore distributed NoSQL data stores. The tool pulls snapshots from nodes and sends copies to safe storage targets. Teams often start by giving backup workers broad database roles to finish setups fast. When those roles stay wide open, one leaked key puts every cluster at risk. How rubrik mosaic architecture works Distributed data stores spread records across many nodes at the same time. Taking a clean copy without stopping writes is a hard task for op
Mosaic: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up rubrik mosaic to back up and restore distributed NoSQL data stores. The tool pulls snapshots from nodes and sends copies to safe storage targets. Teams often start by giving backup workers broad database roles to finish setups fast. When those roles stay wide open, one leaked key puts every cluster at risk.
How rubrik mosaic architecture works
Distributed data stores spread records across many nodes at the same time. Taking a clean copy without stopping writes is a hard task for ops teams. The rubrik mosaic architecture solves this by coordinating snapshots across nodes in the background. It reads data topology maps and pulls changed blocks on a set schedule.
To do this job, the backup engine needs a dedicated database account. Admins create a role that can read system tables and trigger node snapshots. The backup engine stores this key and uses it during every backup run. It also needs write permissions to put data back when a restore starts.
During a recovery, the tool maps backed up blocks to the new cluster layout. It streams records back to the nodes until the cluster reaches the chosen point. This workflow avoids full cluster downtime during normal daily backup jobs. Teams can test recovery plans by spinning up copies in test clusters.
What native backup roles solve and what they miss
Native backup setups solve the problem of recovering from disk failure or bad deletes. If a table drops by mistake, admins can bring back yesterday's snapshot. Native roles also let teams separate backup workers from normal app traffic. You can limit the backup account so it only runs from known network addresses.
Still, a backup tool only guards data at rest after a copy finishes. It does not check what engineers or apps do inside a live database session. Native roles decide who can log in, not what individual queries do in flight. Once an engineer logs in to fix a node, the role stays wide open.
Mosaic: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
During live incidents, engineers often use the same high-level roles that backup tools use. A single typo in a live shell can drop key records before backups run. Also, reading live tables returns raw emails, phone numbers, card numbers, and national IDs. Backup snapshots cannot stop someone from pulling sensitive rows during a live debug session.
Managing live database sessions alongside backups
A complete data safety plan pairs solid backups with strict live session controls. First, scope the backup account down to the exact commands it needs to run. Remove write permissions from the daily backup role until a real restore is needed. Keep backup keys separate from the accounts that humans use for daily work.
Next, look at how engineers run commands against the live data store. Static roles give full permissions for the whole time a user stays logged in. Instead of handing out shared admin keys, tie every session to a single user. Check every command before it runs and mask sensitive fields like card numbers in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What does rubrik mosaic protect?
It protects distributed NoSQL data stores by taking coordinated snapshots across multiple cluster nodes. Teams use it to back up and restore data without stopping live app writes.
Why do backup accounts need careful role scoping?
Backup tools need broad read permissions across all tables and system views to work. If an attacker steals an overly broad backup key, they can read or wipe data.
Do backups replace live database access controls?
No, backups only help you recover data after a bad change or outage happens. Live controls check commands in flight and rewrite emails or phone numbers in query results.