Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Deployment Guide for Kubernetes Clusters
  3. Section IV. Maintenance
  4. Patching mechanism for primary, media servers, fluentbit pods, and postgres pods
  5. Patching of primary containers
NetBackup™ Deployment Guide for Kubernetes Clusters

Patching of primary containers

This section describes the procedure for patching the following primary containers:

  • Patching particular pod of primary server

  • Patching Init containers for all pods of primary server

  • Patching Sidecar containers for all pods of primary server

Patching particular pod of primary server
  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Using the following command, check if ServiceImageTag is present:

    kubectl get environment -n <namespace> -o=jsonpath='{$.items[0].spec.primary.serviceImageTag}'

    Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    See Table: Primary container keywords and examples for the list of all the primary container keywords and examples.

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If ServiceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/<container keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/primary.main", "value": "11.0-patch"}]'

      Or

    • If ServiceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/<container keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/primary.main", "value": "11.0-patch"}]'

Table: Primary container keywords and examples

Profile name

Main container keyword

Init container keyword

Sidecar container keyword

Primary

primary.main

For example, netbackup/main:<version>-patch

primary.pod-dependency-init

primary.fluentbit

Nbatd

nbatd.main

For example, netbackup/nbatd-main:<version>-patch

nbatd.nbatd-init

For example, netbackup/nbatd-init:<version>-patch

  • nbatd.pbx

    For example, netbackup/pbx:<version>-patch

  • nbatd.fluentbit

  • nbatd.nbhousekeeping

    For example, netbackup/nbhousekeeping:<version>-patch

Mqbroker

nbmqbroker.main

For example, netbackup/mqbroker:<version>-patch

  • nbmqbroker.nbmqbrokerinit

    For example, netbackup/mqbroker-init:<version>-patch

  • nbmqbroker.pod-dependency-init

nbmqbroker.fluentbit

Webservice

nbwsapp.main

For example, netbackup/ws-app:<version>-patch

  • nbwsapp.nbwsinit

    For example, netbackup/ws-init:<version>-patch

  • nbwsapp.pod-dependency-init

  • nbwsapp.secure-comms

    For example, netbackup/vnetd:<version>-patch

  • nbwsapp.nbhousekeeping

    For example, netbackup/nbhousekeeping:<version>-patch

  • nbwsapp.fluentbit

Policyjob

policyjob.main

For example, netbackup/policyjobmgr:<version>-patch

policyjob.pod-dependency-init

  • policyjob.pbx

    For example, netbackup/pbx:<version>-patch

  • policyjob.fluentbit

  • policyjob.secure-comms

    For example, netbackup/vnetd:<version>-patch

  • policyjob.nbhousekeeping

    For example, netbackup/nbhousekeeping:<version>-patch

Policyjobmgr

policyjobmgr.main

For example, netbackup/policyjobmgr:<version>-patch

policyjobmgr.pod-dependency-init

  • policyjobmgr.pbx

    For example, netbackup/pbx:<version>-patch

  • policyjobmgr.secure-comms

    For example, netbackup/vnetd:<version>-patch

  • policyjobmgr.nbhousekeeping

    For example, netbackup/nbhousekeeping:<version>-patch

  • policyjobmgr.fluentbit

Requestrouter

requestrouter.main

For example, netbackup/requestrouter:<version>-patch

requestrouter.pod-dependency-init

 

Bootstrapper

bootstrapper.main

For example, netbackup/main:<version>-patch

bootstrapper.pod-dependency-init

bootstrapper.fluentbit

Log-viewer

log-viewer.main

For example, netbackup/log-viewer:<version>-patch

log-viewer.pod-dependency-init

 

Patching Init containers for all pods of primary server:
  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Use this when you want to patch a specific Init container for all the profiles (wherever applicable) of the primary server.

    Init container keyword: pod-dependency-init

    For example, the pod-dependency-init container patch image: netbackup/operator:<version>-patch

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If ServiceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/<init container keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/pod-dependency-init", "value": "11.0-patch"}]'

      Or

    • If ServiceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/<init container keyword>", "value": "<version>-patch"}]'

      For example. kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/pod-dependency-init", "value": "11.0-patch"}]'

Patching Sidecar containers for all pods of primary server
  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Patching Sidecar containers for all pods of primary server:

    Use this when you want to patch a specific Sidecar container for all the profiles (wherever applicable) of the primary server.

    Sidecar containers keyword:

    • fluentbit

    • pbx

    • secure-comms

    • nbhousekeeping

    If a specific container is patched with some image (for example, nbatd.pbx: <version>-patch) and you want to patch that container universally (for example, pbx: <version>-patch1), then you have to first delete the previous entry for that container from the environment.

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If ServiceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/<Sidecar containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag/fluentbit", "value": "11.0-patch"}]'

      Or

    • If ServiceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/<Sidecar containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/primary/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/primary/serviceImageTag/fluentbit", "value": "11.0-patch"}]'

Feedback

Was this page helpful?
Previous

Overview

Next

Patching of media containers

Feedback

Was this page helpful?