NetBackup™ for Kubernetes Administrator's Guide

To create ECA signed certificate

1. Use the Certificate Revocation List distribution point to fetch Certificate Revocation List.
2. Keep ECA signed certificate chain, private key, and passphrase (if required) ready in your home directory.
3. To identify different formats (like, DER, PEM and so on) that are supported for each of the files mentioned in step 2. For more information, refer to the Configuration options for external CA-signed certificates section in the NetBackup™ Security and Encryption Guide.
4. Create a secret using the files mentioned in step 3.

   • To create a secret if private key is unencrypted, run the command: kubectl create secret generic <Name of secret>

     --from-file=cert_chain=<File path to ECA signed certificate chain> --from-file=key=<File path to private key>

     --from-file=cacert=<File path to External CA certificate> -n <Namespace where kops is deployed>

   • To create a secret if private key is encrypted, run the command: kubectl create secret generic <Name of secret>

     --from-file=cert_chain=<File path to ECA signed certificate chain> --from-file=key=<File path to private key>

     --from-file=cacert=<File path to External CA certificate> --from-file=passphrase=<File path to passphrase

     of encrypted private key> -n <Namespace where kops is deployed>

   Directory structure looks like this:

   ├── cert_chain.pem
   ├── private
   |  |___key.pem
   |  |___passphrase.txt
   |___trusted
        |__cacerts.pem
   

   cert_chain.pem is ECA signed certificate chain

   private/key.pem is private key

   private/passphrase.txt is passpharse for private key

   trusted/cacerts.pem is External CA certificate

   • To create a secret of name eca-secret when private key is unencrypted, run the command:

     kubectl create secret generic eca-secret--from-file=cert_chain=cert_chain.pem

     --from-file=key=private/key.pem

     --from-file=cacert=trusted/cacerts.pem -n kops-ns

   • To create a secret of name eca-secret when private key is encrypted, run the command:

     kubectl create secret generic eca-secret

     --from-file=cert_chain=cert_chain.pem

     --from-file=key=private/key.pem

     --from-file=cacert=trusted/cacerts.pem

     --from- file=passphrase=private/passphrase.txt

     -n kops-ns

5. Once the secret is created, then create a backupservercert object custom resource.

   eca-create-backupservercert.yaml file looks like this:

   apiVersion: netbackup.veritas.com/v1
   kind: BackupServerCert
   metadata:
     name: backupservercert-eca-create
     namespace: kops-ns
   spec:
     clusterName: cluster.sample.com:port
     backupServer: backupserver.sample.domain.com
     certificateOperation: Create
     certificateType: ECA
     ecaAttributes:
       ecaCreateOptions:
         ecaSecretName: eca-secret
         copyCertsFromSecret: true
         isKeyEncrypted: false

   • Copy the eca-create-backupservercert.yaml file text.

   • Open the text editor and paste the yaml file text.

   • Then, save the text with the yaml file extension to the home directory from where the Kubernetes clusters are accessible.

6. To copy certificate and keys to the Kubernetes operator, do any of the following:

   • Set copyCertsFromSecret as true

   • Set copyCertsFromSecret as false to avoid copying certificates and keys existing on the Kubernetes Operator.

   Note:

   ECA is common across all primary server thus Kubernetes operator require one set of certificates and keys that can be enrolled with all primary servers as required. No need to copy certificates and keys every time unless there's issue with the previous copied certificates and keys.

   Note:

   If ecaHealthCheck fails due to any reason related to certificates and keys (corrupted or expired or changed ECA) then you identify the reason for failure and perform a copy of a valid certificate using a flag.

7. If private key is encrypted, set isKeyEncrypted flag as true or else false for unencrypted key. Ensure passphrase is provided in secret if private key is encrypted.
8. Set ecaSecretName with the secret name, created backupservercert yaml in step 5.
9. To create the eca-create-backupservercert.yaml file, run the command: kubectl create -f eca-create-backupservercert.yaml
10. Once the backupservercert custom resource is created, check the custom resource status.
11. To view the external certificate details on the NetBackup web UI, refer to the View external certificate information for the NetBackup hosts in the domain section in the NetBackup™ Web UI Administrator's Guide.

To remove ECA signed certificate

1. Create a backupservercert with operation as remove and certificate type as ECA.

   eca-remove-backupservercert.yaml file looks like this:

   apiVersion: netbackup.veritas.com/v1
   kind: BackupServerCert
   metadata:
     name: backupservercert-eca-remove
     namespace: kops-ns
   spec:
     clusterName: cluster.sample.com:port
     backupServer: backupserver.sample.domain.com
     certificateOperation: Remove
     certificateType: ECA

   • Copy the eca-remove-backupservercert.yaml file text.

   • Open the text editor and paste the yaml file text.

   • Then, save the text with the yaml file extension to the home directory from where the Kubernetes clusters are accessible.

2. To create the eca-remove-backupservercert.yaml file, run the command: kubectl create -f eca-remove-backupservercert.yaml
3. Once the object is created, then you need to check the custom resource status. If failed, then you can take necessary actions.

To update the ECA signed certificate

1. Create a backupservercert object with operation type update.

   eca-update-backupservercert.yaml file looks like this:

   apiVersion: netbackup.veritas.com/v1
   kind: BackupServerCert
   metadata:
     name: backupservercert-eca-update
     namespace: kops-ns
   spec:
     clusterName: cluster.sample.com:port
     backupServer: backupserver.sample.domain.com
     certificateOperation: Update
     certificateType: ECA
     ecaAttributes:
       ecaUpdateOptions:
         ecaCrlCheck: DISABLE | LEAF | CHAIN 
         ecaCrlRefreshHours: [0,4380]

   • Copy the eca-update-backupservercert.yaml file text.

   • Open the text editor and paste the yaml file text.

   • Then, save the text with the yaml file extension to the home directory from where the Kubernetes clusters are accessible.

2. To create the eca-update-backupservercert.yaml file, run the command: kubectl create -f eca-update-backupservercert.yaml
3. The ECA_CRL_CHECK option lets you specify the revocation check level for external certificates of the host. It also lets you disable the revocation check for the external certificates. Based on the check, the revocation status of the certificate is validated against the Certificate Revocation List (CRL) during host communication. For more information, refer to the ECA_CRL_CHECK for NetBackup servers and clients section in the NetBackup™ Security and Encryption Guide.
4. The ECA_CRL_REFRESH_HOURS option specifies the time interval in hours to download the CRLs from the URLs that are specified in the peer host certificate's Certificate Revocation List distribution points (CDP). For more information, refer to the ECA_CRL_REFRESH_HOURS for NetBackup servers and clients section in the NetBackup™ Security and Encryption Guide