Automated configuration of NetBackup protection for Kubernetes

Pre-requisites

Ensure that the users have the following credentials for the API key during deployment. In case of automated deployment, you need to create an API key and must have the following access permissions.

On the Kubernetes cluster, create a new secret, nb-config-deploy-secret.yaml, with the following content.

apiVersion: v1
kind: Secret
metadata:
  name: <kops-namespace>-nb-config-deploy-secret
  namespace: <kops-namespace>
type: Opaque
stringData:
  apikey: <Enter the value of API key from the earlier step>

Apply the secret. Run the command kubectl apply -f nb-config-deploy-secret.yaml.

Credentials for API Key

Open NetBackup web UI.
On the left, click Security and then select RBAC. Click Add
Select Custom role and then click Next.
On the Add role page, specify the Role name and Role description. Click Assign in the Permissions.
Ensure the following access permissions are granted:
- NetBackup management panel > NetBackup hosts
  - View
  - Update
  - Update host mapping
  - View host mapping
- Security panel > Certificate management > NetBackup security tokens
- Credentials tab
  - View
  - Create
  - Update
  - Delete
  - Assign credentials
- Assets tab > Kubernetes assets > Kubernetes Cluster and Namespaces
  - Create
  - Update
  - Delete
  - View

Before configuring the NetBackup on the Kubernetes workload, you must run a NetBackup server with access to ports 443, 1556, and 13724.

NetBackup Kubernetes operator and data mover images must be uploaded to container registry accessible from the Kubernetes cluster.

You need to create a secret to be consumed for automated deployment.

To create an API key

Open the NetBackup web UI.
On the left, click Security > Access keys.
Click the API keys tab.
Click Add.

Preinstallation

Edit the following fields in netbackupkops-helm-chart/values.yaml.
- containers.manager.image: Container registry URL for pulling the NetBackup Kubernetes controller image.
- imagePullSecrets name: name of the image pull secret if the container registry requires authentication to pull images.
- nbprimaryserver: Configured name of NetBackup primary server.
- nbsha256fingerprint: Fetch sha256 fingerprint from the NetBackup web UI. On the left click Security > Certificates. Click Certificate Authority.
- k8sCluster: FQDN for Kubernetes cluster API server.
- k8sPort: Port on which the Kubernetes API server is listed.
- datamoverProperties (optional): Include any configuration settings that need to be specified in the datamover pod's bp.conf file.
  Note:
  For more information, See Troubleshooting NetBackup servers with short names.
The information is available on the UI console of the Kubernetes cluster.
If it is not present, run the following command to get Kubernetes cluster and Kubernetes port:
# kubectl cluster-info Kubernetes control plane runs at https://<Kubernetes FQDN>:6443
- datamoverimage: Container registry URL to pull data mover image.
- Storage parameters are required for snapshot and backup from snapshot operations. At least one of the Block or Filesystem storage parameters are mandatory.
To get the storage classes, run the following command:
# kubectl get storageclasses
- storageclassblock: Storage class that is used for provisioning block volumes.
- storageclassfilesystem: Storage class that is used for provisioning file system volumes.
To get the volume snapshot class, run the following command:
# kubectl get volumesnapshotclasses
- volumesnapshotclassblock: Volume snapshot class for creating block volume snapshots.
- volumesnapshotclassfilesystem: Volume snapshot class for creating file system volume snapshots.
Mapping between the storageclass and the snapshot class is managed through the storageMap. If a new storage option is added to the cluster, it can also be updated in the configmap for backup-operator-configuration after installation.
- storageMap is a dictionary of key, value fields where key is storage class and its value is a tuple consisting of (snapshotClass, storageClassForBackupDataMovement, storageClassForRestoreFromBackup) This field is mandatory to specify mapping between storage class and snapshot class.
- snapshotclass must be created with same provisioner as storage class and it must be capable of snapshotting the storage class. All storage classes should have their entry for snapshotclass.
- storageClassForBackupDataMovement is used for creating temporary PVC for datamover. It must be compatible with original storage class PVC created using snapshot of original storage class must be readable when created using this storage class. Datamover reads data from this PVC and sends it to NetBackup media server. storageClassForRestoreFromBackup is used to restore from media server backup. It must be compatible with original storage class and come from same provisioner.
- One snapshot class can be used for snapshotting multiple compatible storage classes.
- Template
```
storageMap:
  <key - storage class name>:
    snapshotClass: [mandatory field to specify volumesnapshotclass for creating snapshot of given key storage class]
    storageClassForBackupDataMovement: <optional, storage class used to transfer pvc backup data from k8s cluster to 
NetBacup media server>
    storageClassForRestoreFromBackup: <optional, storage class used to restore pvc from NetBackup media server 
to k8s cluster>

Note: storageClassForBackupDataMovement and storageClassForRestoreFromBackup are optional and must be compatible 
with key storage class if they are configured different from key storage class. If no value is specified for these 
fields original 
storage class would be used. These values can be changed later in backup-operator-configuration configmap

Example for openshift storage classes. cephfs storage class should have corresponding snapclass as cephfs as follows
storageMap:
  ocs-storagecluster-cephfs:
    storageClassForBackupDataMovement: ocs-storagecluster-cephfs
    storageClassForRestoreFromBackup: ocs-storagecluster-cephfs
    snapshotClass: ocs-storagecluster-cephfsplugin-snapclass
  ocs-storagecluster-ceph-rbd:
    snapshotClass: ocs-storagecluster-rbdplugin-snapclass
```

Install

To install helm, run the following command:

# helm install veritas-netbackupkops <path to netbackupkops-helm-chart> -n <kops namespace>

Debug

To get the config-deploy pod from the Kubernetes operator namespace, run the following command:

# kubectl get pod -n <kops namespace> | grep "config-deploy"

Logs

To check the logs from the pod <namespace>-netbackup-config-deploy, run the following command:

# kubectl logs <pod-name> -n <kops namespace>

Log level

It sets the log level of the configuration pod. Values can be set to DEBUG, INFO, or ERROR. Default value is set to INFO.

Note:

For more details, refer to the NetBackup Kubernetes Quick Start Guide.

Automated configuration of NetBackup protection for Kubernetes

Feedback

Feedback