> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Remove bulk data from disk

### Event Information

#### Meaning

* The "Remove Bulk Data from Disk" event in a Kubernetes cluster indicates that a process or user is attempting to delete a large amount of data from a disk.
* This event could be triggered by a pod or container that is running a script or command to remove a significant volume of data from a persistent volume or local disk.
* It is important to investigate this event to ensure that the data being removed is intended and authorized, as it could potentially lead to data loss or violation of compliance standards.

#### Remediation

To remediate the event "Remove Bulk Data from Disk" using the Python Kubernetes API, you can follow these steps:

1. Identify the affected Pod:
   * Use the event details to determine the Pod name or any other relevant information.
   * Run the following command to get the Pod details:
     ```
     kubectl get pods <pod-name> -o yaml > pod.yaml
     ```

2. Use and Review Role-Based Access Control (RBAC):
   * Ensure that only authorized users and service accounts have permissions to delete data from volumes.
   * Use the following commands to inspect roles and permissions:
   ```bash theme={null}
    kubectl get roles --all-namespaces
    kubectl get rolebindings --all-namespaces
   ```

````

3. Create a Kubernetes Job to restore the deleted data:
 - Create a YAML manifest file (e.g., `remediation-job.yaml`) with the following content:
   ```yaml
   apiVersion: batch/v1
   kind: Job
   metadata:
     name: data-restoration-job
   spec:
     template:
       spec:
         containers:
         - name: data-restoration-container
           image: <image-with-python-and-data-restoration-script>
           command: ["python", "data_restoration_script.py"]
           volumeMounts:
           - name: data-volume
             mountPath: /data
         restartPolicy: Never
         volumes:
         - name: data-volume
           persistentVolumeClaim:
             claimName: <pvc-name>
````

* Replace `<image-with-python-and-data-restoration-script>` with the image that contains the Python script for data restoration.
* Replace `<pvc-name>` with the name of the PersistentVolumeClaim (PVC) that contains the deleted data.

4. Apply the remediation Job:
   * Run the following command to apply the Job manifest:
     ```
     kubectl apply -f remediation-job.yaml
     ```

Please note that the above steps assume you have a Python script (`data_restoration_script.py`) that can restore the deleted data. You need to replace `<image-with-python-and-data-restoration-script>` with the actual image that contains this script. Additionally, make sure to replace `<pod-name>` and `<pvc-name>` with the appropriate values based on your environment.