Automated configuration of NetBackup protection for Kubernetes
Ensure that the users have the following credentials for the API key during deployment. In case of automated deployment, you need to create an API key and must have the following access permissions.
On the Kubernetes cluster, create a new secret, nb-config-deploy-secret.yaml, with the following content.
apiVersion: v1 kind: Secret metadata: name: <kops-namespace>-nb-config-deploy-secret namespace: <kops-namespace> type: Opaque stringData: apikey: <Enter the value of API key from the earlier step>
Apply the secret. Run the command kubectl apply -f nb-config-deploy-secret.yaml.
Credentials for API Key
- Open NetBackup web UI.
- On the left, click Security and then select RBAC. Click Add
- Select Custom role and then click Next.
- On the Add role page, specify the Role name and Role description. Click Assign in the Permissions.
- Ensure the following access permissions are granted:
NetBackup management panel > NetBackup hosts
View
Update
Update host mapping
View host mapping
Security panel > Certificate management > NetBackup security tokens
Credentials tab
View
Create
Update
Delete
Assign credentials
Assets tab > Kubernetes assets > Kubernetes Cluster and Namespaces
Create
Update
Delete
View
Before configuring the NetBackup on the Kubernetes workload, you must run a NetBackup server with access to ports 443, 1556, and 13724.
NetBackup Kubernetes operator and data mover images must be uploaded to container registry accessible from the Kubernetes cluster.
You need to create a secret to be consumed for automated deployment.
To create an API key
- Open the NetBackup web UI.
- On the left, click Security > Access keys.
- Click the API keys tab.
- Click Add.
Preinstallation
- Edit the following fields in
netbackupkops-helm-chart/values.yaml.containers.manager.image: Container registry URL for pulling the NetBackup Kubernetes controller image.
imagePullSecrets name: name of the image pull secret if the container registry requires authentication to pull images.
nbprimaryserver: Configured name of NetBackup primary server.
nbsha256fingerprint: Fetch sha256 fingerprint from the NetBackup web UI. On the left click Security > Certificates. Click Certificate Authority.
k8sCluster: FQDN for Kubernetes cluster API server.
k8sPort: Port on which the Kubernetes API server is listed.
datamoverProperties (optional): Include any configuration settings that need to be specified in the datamover pod's
bp.conffile.Note:
For more information, See Troubleshooting NetBackup servers with short names.
The information is available on the UI console of the Kubernetes cluster.
- If it is not present, run the following command to get Kubernetes cluster and Kubernetes port:
# kubectl cluster-info Kubernetes control plane runs at https://<Kubernetes FQDN>:6443
datamoverimage: Container registry URL to pull data mover image.
Storage parameters are required for snapshot and backup from snapshot operations. At least one of the Block or Filesystem storage parameters are mandatory.
- To get the storage classes, run the following command:
# kubectl get storageclasses
storageclassblock: Storage class that is used for provisioning block volumes.
storageclassfilesystem: Storage class that is used for provisioning file system volumes.
- To get the volume snapshot class, run the following command:
# kubectl get volumesnapshotclasses
volumesnapshotclassblock: Volume snapshot class for creating block volume snapshots.
volumesnapshotclassfilesystem: Volume snapshot class for creating file system volume snapshots.
- Mapping between the storageclass and the snapshot class is managed through the storageMap. If a new storage option is added to the cluster, it can also be updated in the configmap for backup-operator-configuration after installation.
storageMap is a dictionary of key, value fields where key is storage class and its value is a tuple consisting of (snapshotClass, storageClassForBackupDataMovement, storageClassForRestoreFromBackup) This field is mandatory to specify mapping between storage class and snapshot class.
snapshotclass must be created with same provisioner as storage class and it must be capable of snapshotting the storage class. All storage classes should have their entry for snapshotclass.
storageClassForBackupDataMovement is used for creating temporary PVC for datamover. It must be compatible with original storage class PVC created using snapshot of original storage class must be readable when created using this storage class. Datamover reads data from this PVC and sends it to NetBackup media server. storageClassForRestoreFromBackup is used to restore from media server backup. It must be compatible with original storage class and come from same provisioner.
One snapshot class can be used for snapshotting multiple compatible storage classes.
Template
storageMap: <key - storage class name>: snapshotClass: [mandatory field to specify volumesnapshotclass for creating snapshot of given key storage class] storageClassForBackupDataMovement: <optional, storage class used to transfer pvc backup data from k8s cluster to NetBacup media server> storageClassForRestoreFromBackup: <optional, storage class used to restore pvc from NetBackup media server to k8s cluster> Note: storageClassForBackupDataMovement and storageClassForRestoreFromBackup are optional and must be compatible with key storage class if they are configured different from key storage class. If no value is specified for these fields original storage class would be used. These values can be changed later in backup-operator-configuration configmap Example for openshift storage classes. cephfs storage class should have corresponding snapclass as cephfs as follows storageMap: ocs-storagecluster-cephfs: storageClassForBackupDataMovement: ocs-storagecluster-cephfs storageClassForRestoreFromBackup: ocs-storagecluster-cephfs snapshotClass: ocs-storagecluster-cephfsplugin-snapclass ocs-storagecluster-ceph-rbd: snapshotClass: ocs-storagecluster-rbdplugin-snapclass
To install helm, run the following command:
# helm install veritas-netbackupkops <path to netbackupkops-helm-chart> -n <kops namespace>
To get the config-deploy pod from the Kubernetes operator namespace, run the following command:
# kubectl get pod -n <kops namespace> | grep "config-deploy"
To check the logs from the pod <namespace>-netbackup-config-deploy, run the following command:
# kubectl logs <pod-name> -n <kops namespace>
It sets the log level of the configuration pod. Values can be set to DEBUG, INFO, or ERROR. Default value is set to INFO.
Note:
For more details, refer to the NetBackup Kubernetes Quick Start Guide.