Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters
  3. Introduction
  4. About Cloud Scale deployment
  5. Decoupling of NetBackup Policy and Job Management from primary server
Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters

Decoupling of NetBackup Policy and Job Management from primary server

In Cloud Scale Technology, policy execution and job management (NBPEM and NBJM) is implemented as StatefulSet which can be deployed through the operators. Policy and job management capabilities are decoupled from the primary server and run as separate service in Kubernetes cluster.

See Deploying the operators.

NBPEM/NBJM is dependent on primary, web services and mqbroker pods. NBPEM/NBJM cluster comprises of one or more policyjobmgr pods and one or more policyjob pods. StatefulSet policyjobmgr represents the leaders whereas StatefulSet policyjob is associated with the followers. You can consider adding a secondary leader to guarantee continuous job execution if the primary leader is unavailable.

Figure: Policy and Job Management architecture

Policy and Job Management architecture

Note:

In the above figure, NB Web services is a decoupled component. For more information refer to Decoupling of NetBackup web services from primary server.

A NBPEM/NBJM pod consists of the following containers:

  • The main container for core policy and job management

  • PBX sidecar

  • Vnetd sidecar

  • Fluentbit sidecar

  • Housekeeping sidecar

nbpemreq

The nbpemreq (NetBackup Policy Execution Manager Requisition) command shows the distribution of policy/clients across the follower pods.

For Cloud Scale, it is recommended to run the nbpemreq command on the primary pod or on the policyjob leader.

It is recommended to use -M option with the pod name to direct the request to the specific pod. When -M option is not specified, the default target is one of the leaders.

For more information on nbpemreq command, refer to the NetBackup™ Commands Reference Guide.

Limitations and recommendations
  • Multiplexing (MPX): MPX is not supported in NBPEM/NBJM scale-out environment.

    Supporting MPX in any format could lead to unpredictable/unexpected/undesired behaviors. Hence it is recommended to disable the MPX support.

  • Session end and catalog backup: For scale-out deployments (Kubernetes cluster), session end catalog backup schedules are not supported.

    For non scale-out deployments, session end catalog backup schedules and persistence would be moved to a Json formatted file.

  • Secondary leader: The secondary leader's role is limited to forwarding media server calls to the follower pods. All communication from the media server is load balanced between primary and secondary leaders, ensuring uninterrupted job execution in case the primary leader is unavailable.

  • Scale-out/Scale-in:

    • Auto-scaling is not supported. However, manual scaling of follower and leader is allowed.

    • By default, Cloud Scale starts with a single follower pod; you can scale this out up to a maximum of 12 pods.

      By default, Cloud Scale starts with a single leader pod; you can scale this out up to a maximum of 6 pods.

      Warning:

      The users are advised to scale out the leader and follower services only if necessary, as this would consume more resources.

    • Run the following command to control the follower replica count:

      helm upgrade cloudscale cloudscale-11.2-xxx.tgz -n <namespace> --reuse-values --set environment.primary.replicas.policyjob=<count>

    • Run the following command to control the leader replica count:

      helm upgrade cloudscale cloudscale-11.2-xxx.tgz -n <namespace> --reuse-values --set environment.primary.replicas.policyjobmgr=<count>

Feedback

Was this page helpful?
Previous

Decoupling of NetBackup web services from primary server

Next

Decoupling of NetBackup Database Manager from primary server

Feedback

Was this page helpful?