Deployment policy management
Use the procedures that are shown to create, modify, and delete your deployment policies.
Creating a deployment policy
Note:
You must add packages to the VxUpdate repository before you can create a working deployment policy. You can create deployment policies without packages in the repository, but those policies fail to run successfully. More information about the management of the VxUpdate repository is available.
- In the NetBackup Administration Console, in the left pane, select Deployment Management > Deployment Policies.
- From the Actions menu, select New Deployment Policy.
- Enter a unique name for the new policy in the Add a New Deployment Policy dialog box.
- Click OK.
- Specify the information that is shown on the Attributes tab in the Change Deployment Policy window:
Package: Select the package that you want deployed from the drop-down menu.
Note:
Specifying a package that supports external certificate authority certificates presents you with an additional tab titled Security. That tab is covered later in this procedure.
Media server: Specify the media server from drop-down. The media server that is specified is used to connect and transfer files to the NetBackup hosts that are included in the policy. The media server also caches the files from the NetBackup repository. The media server must be version NetBackup 8.1.2 or later. Since the repository resides on the primary server, the primary server is the default value for the media server field.
When you upgrade media servers, the Media server drop-down is automatically set to the primary server and cannot be changed.
Java GUI and JRE: Specify if you want the Java GUI and the JRE upgraded on the target systems. The three options include:
INCLUDE: Install or upgrade the Java GUI and JRE components on the specified computers.
EXCLUDE: Exclude the Java GUI and JRE components from the specified computer. Any preexisting NetBackup Java GUI and JRE packages are removed.
MATCH: Preserve the current state of the Java GUI and JRE components. The components are upgraded if they are present on the pre-upgraded system. The components are not installed if they are not present on the pre-upgraded system.
(Conditional): Select the Limit simultaneous jobs option and specify a value for jobs to limit the total number of concurrent jobs that can run at a time. The minimum value is 1 and the maximum value is 999.
If the check box is selected, the default value is 3. If you do not select the check box, no limit is enforced for the simultaneous upgrade jobs.
You can set unlimited simultaneous upgrade jobs through command line interface by setting the value as 0.
Select hosts: Select hosts from the Available hosts list and select Add to add hosts to the deployment policy. The list is generated from hosts in the host database and backup policies. Once you select Add, the hosts are shown under Selected hosts.
Deployment policies can contain either media servers or clients but not both. When you select the package you want installed, the list of available hosts is filtered to media servers or clients.
Note:
To upgrade a 7.7.x or 8.0 media server, the media server must be in a backup policy. The policy does not need to be active and you do not need to run the policy. Once the media server is upgraded to post NetBackup 8.1 version, you can remove the policy. The policy only needs to have the media server in the client list. You do not need to specify a file list, schedule, or any other policy attributes.
If the media server is not in a policy, the operating system for the media server is listed as Unknown. A tool tip suggests this issue is a missing package. Package for the selected host's operating system is missing. Add the required missing packages to the repository using the nbrepo command line. While it may be true the package is not in the repository, you should also add the media server to a backup policy. If the tool tip persists after the media server is added to a policy, you probably need to add the required package.
- Select the Schedules tab in the Change Deployment Policy window.
You can see a summary of all schedules within that policy.
- Select New.
- Specify the information that is shown in the Add Deployment Schedule window.
Name: Enter a name for the new schedule.
Type: Specify the type of schedule you want created.
Schedule types:
Precheck
Performs the various precheck operations, including confirming there is sufficient space on the client for the update. The precheck schedule type does not exist for EEB packages.
Stage
Moves the update package to the client, but does not install it. Also performs the precheck operation.
Install
Installs the specified package. Also performs the precheck and the stage package operations. If you already performed the stage package operation, the install schedule does not move the package again.
Note:
Please be aware that adding multiple different schedule types to the same deployment schedule window has unpredictable results. VxUpdate has no defined behavior to determine which schedule type runs first. If a single deployment schedule window has precheck, stage, and install jobs, there is no way to specify the order in which they run. The precheck or the stage schedules can fail, but the install completes successfully. If you plan to use precheck, stage, and install schedules, it is recommended that you create separate schedules and separate windows for each.
Starts: Specify the date and time you want the policy to start in the text field or with the date and the time spinner. You can also click the calendar icon and specify a date and time in the resulting window. You can select a schedule by clicking and dragging over the three-month calendar that is provided at the bottom of the window.
Ends: Specify the date and time you want the policy to end as you specified the start time.
Duration: Optionally, you can specify a duration in days, hours, minutes, and seconds instead of an end time for the policy. The minimum value is 5 minutes and the maximum is 99 days.
Select Add/OK and the schedule is created. Select OK to save and create your policy.
- A Security tab appears when you select a deployment package that contains support for external certificate authorities.
By default, the Use existing certificates when possible option is selected. This option instructs NetBackup to use the existing NetBackup CA or external CA certificates, if available.
Note:
If you specify this option and certificates are not available, your upgrade fails.
Deselecting the Use existing certificates when possible option lets you specify the location for external certificate authority information for both UNIX and Linux computers and Windows computers.
Deselecting this option does not allow the user to change the security configuration settings during the upgrade.
- Windows clients have Use Windows certificate store selected by default.
You must enter the certificate location as Certificate Store Name\Issuer Distinguished Name\Subject Distinguished Name.
Note:
You can use the $hostname variable for any of the names in the certificate store specification. The $hostname variable evaluates at run time to the name of the local host. This option provides flexibility when you push NetBackup software to a large number of clients.
Alternatively, you can specify a comma-separated list of Windows certificate locations. For example, you can specify: MyCertStore\IssuerName1\SubjectName, MyCertStore\IssuerName2\SubjectName2, MyCertStore4\IssuerName1\SubjectName5
Then select the Certificate Revocation List (CRL) option from the radio buttons shown:
Do not use a CRL. No additional information is required.
Use the CRL defined in the certificate. No additional information is required.
Use the CRL at the following path: You are prompted to provide a path to the CRL.
- For both media servers and clients that select the From certificate file path (for file-based certificates) option, specify the information as shown:
Certificate file: This field requires you to provide the path to the certificate file and the certificate file name.
Trust store location: This field requires you to provide the path to the trust store and the trust store file name.
Private key path: This field requires you to provide the path to the private key file and the private key file name.
Passphrase file: This field requires you to provide the path of the passphrase file and the passphrase file name. This field is optional.
Then specify the correct CRL option for your environment:
Do not use a CRL. No additional information is required.
Use the CRL defined in the certificate. No additional information is required.
Use the CRL at the following path: You are prompted to provide a path to the CRL.
To change a deployment policy
- Right click on the deployment policy and select Change.
- Navigate through the deployment policy tabs and make any necessary changes to the policy.
- Select OK and the policy is updated.
Deleting a deployment policy
- Right click on the deployment policy and select Delete.
- Select OK.
- Confirm the deletion of the policy.