Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Deployment Guide for Kubernetes Clusters
  3. Section IV. Maintenance
  4. Patching mechanism for primary, media servers, fluentbit pods, and postgres pods
  5. Patching of media containers
NetBackup™ Deployment Guide for Kubernetes Clusters

Patching of media containers

This section describes the procedure for patching of the following media containers:

  • Patching for media server

  • Patching Init containers for media server

  • Patching Sidecar containers for media server:

Patching for media server

Profile name

Main container keyword

Init container keyword

Sidecar container keyword

Media

media.main

media.pod-dependency-init

media.fluentbit

  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Using the following command, check if ServiceImageTag is present:

    kubectl get environment -n <namespace> -o=jsonpath='{$.items[0].spec.mediaServers[0].serviceImageTag}'

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If serviceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<container keyword>", "value": "<version>-patch"}]''

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/media.main", "value": "11.0-patch"}]'

      Or

    • If serviceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<container keyword>", "value": "<version>-patch"}]''

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/media.main", "value": "11.0-patch"}]'

Patching Init containers for media server
  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Use this when you want to patch a specific Init container for all the profiles (wherever applicable) of the media server.

    Init container keyword: pod-dependency-init

    For example, the pod-dependency-init container patch image: netbackup/operator:<version>-patch

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If serviceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<Init containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/pod-dependency-init", "value": "11.0-patch"}]'

      Or

    • If serviceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<Init containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/pod-dependency-init", "value": "11.0-patch"}]'

Patching Sidecar containers for media server
  1. Get the environment name using the following command:

    kubectl get environments -n <namespace>

  2. Use this when you want to patch a specific Sidecar container for all the profiles (wherever applicable) of the media server.

    Sidecar container keyword: fluentbit

  3. Depending on the output of step 2, perform one of the following steps.

    If ServiceImageTag is present (some content is there in the output) or not present (no content is there in the output). Run the following command by changing the value field (for example, <version>-patch) to the required image tag:

    • If serviceImageTag is present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<Sidecar containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/fluentbit", "value": "11.0-patch"}]'

      Or

    • If serviceImageTag is not present:

      kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/<SideCar containers keyword>", "value": "<version>-patch"}]'

      For example, kubectl patch environment <env-name> -n <namespace> --type=json --patch '[{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag", "value": {}},{"op": "replace", "path": "/spec/mediaServers/0/serviceImageTag/fluentbit", "value": "11.0-patch"}]'

Feedback

Was this page helpful?
Previous

Patching of primary containers

Next

Patching of fluentbit collector pods

Feedback

Was this page helpful?