Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters
  3. Introduction
  4. About Cloud Scale deployment
  5. Decoupling of NetBackup web services from primary server
Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters

Decoupling of NetBackup web services from primary server

From Cloud Scale Technology version 10.5 and later, the NetBackup web services are decoupled (dissociated) from the primary server so that it can be containerized and executed independently as a standalone service pod in a Kubernetes cluster. All the other APIs and web UI behavior remains the same within the NetBackup cluster. The NetBackup web applications and the supporting infrastructure is deployed to /usr/openv/wmc/ as part of a new Docker container image called netbackup-ws-app. This image (netbackup-ws-app) is deployed in a new separate Kubernetes pod within the NetBackup cluster.

The deployment of the web services pod is orchestrated using NetBackup operator framework which manages all of the NetBackup Kubernetes deployment artifacts within a Kubernetes cloud deployment.

Figure: Decoupled NetBackup web services architecture

Decoupled NetBackup web services architecture
  • Components involved in the decoupled NetBackup web services architecture:

    • netbackup.war

    • nbwss.war

    • webui.war

    • vwcpremote.war

    • paf.war

  • nbwsinit container: The nbwsinit container is the first file to execute during the deployment. It performs the environmental setup work described in the deployment section below. When the nbwsinit container stops, the rest of the containers start simultaneously and the nbwsinit container dissociates.

  • Volume mounts: Components of volume mounts supports vnet proxy sidecar and the nbwsapp pod mounts the /mnt/sock-data persistent volume where the proxy files are used to exchange within sockets.

  • Shared volume mounts: This volume represents the NetBackup primary catalogue data log.

  • Kubernetes Secrets: Components of Kubernetes secrets is mounted and used by the nbwsinit container to establish trust with the nbatd pod in order to get the CA certificate as prerequisite to creating the web services certificates and trust stores.

  • Vnetd sidecar (Secure Communication): For Cloud Scale Technology deployment, the NetBackup web service is unable to make localhost connections. It needs to connect remotely on the primary pod and the decoupled nbatd pod. For these remote service connections, it now needs to use the secure communication infrastructure provided by the vnetd inbound and outbound proxies.

  • Housekeeping sidecar: The nbwsapp includes the nbhousekeeping sidecar container in its deployment to perform scheduled housekeeping tasks such as log file clean up, rotation and telemetry collection.

  • Fluentbit log collection sidecar: The nbwsapp pod includes the fluentbit sidecar container in its deployment to perform regular log collection from the source container(s) and combine in a separate fluentbit-collector pod.

Feedback

Was this page helpful?
Previous

About Cloud Scale deployment

Next

Decoupling of NetBackup Policy and Job Management from primary server

Feedback

Was this page helpful?