NetBackup™ Deployment Guide for Amazon Elastic Kubernetes Services (EKS) Cluster

EKS-specific requirements

1. Create a Kubernetes cluster with the following guidelines:

   • Use Kubernetes version 1.21 onwards.

   • AWS default CNI is used during cluster creation.

   • Create a nodegroup with only one availability zone and instance type should be of atleast m5.4xlarge configuration.

     Note:

     Using separate nodegroups is required for the NetBackup Operator, NetBackup and MSDP deployments.

     The nodepool uses AWS manual or autoscaling group feature which allows your nodepool to scale by provisioning and de-provisioning the nodes as required automatically.

     Note:

     All the nodes in node group must be running on the Linux operating system.

   • Minimum required policies in IAM role:

     • AmazonEKSClusterPolicy

     • AmazonEKSWorkerNodePolicy

     • AmazonEC2ContainerRegistryReadOnly

     • AmazonEKS_CNI_Policy

     • AmazonEKSServicePolicy

2. Use an existing AWS Elastic Container Registry or create a new one and ensure that the EKS has full access to pull images from the elastic container registry.
3. Deploy aws load balancer controller add-on in the cluster.

   For more information on installing the add-on, see Installing the AWS Load Balancer Controller add-on.

4. Install cert-manager by using the following command:

   $ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.8.0/cert-manager.yaml

   For more information, see Documentation for cert-manager installation.

5. The FQDN that will be provided in primary server CR and media server CR specifications in networkLoadBalancer section must be DNS resolvable to the provided IP address.
6. Create a storage class with EBS storage type and retain reclaim policy. Provide the name of the created EBS storage type in the storageclass name field during the deployment of primary server/ media server CR.

   For more information on creating the storage class with EBS provisioner, see Kubernetes documentation.

7. If NetBackup client is outside VPC or if you want to access the WEB UI from outside VPC then NetBackup client CIDR must be added with all NetBackup ports in security group inbound rule of cluster. For more information on NetBackup ports, See About the Load Balancer service..

   • To obtain the cluster security group, run the following command:

     aws eks describe-cluster --name <my-cluster> --query cluster.resourcesVpcConfig.clusterSecurityGroupId

   • The following link helps to add inbound rule to the security group:

     Add rules to a security group

Host-specific requirements

1. Install AWS CLI.

   For more information on installing the AWS CLI, see Installing or updating the latest version of the AWS CLI.

2. Install Kubectl CLI.

   For more information on installing the Kubectl CLI, see Installing kubectl.

3. Configure docker to enable the push of the container images to the container registry.
4. Create the OIDC provider for the AWS EKS cluster.

   For more information on creating the OIDC provider, see Create an IAM OIDC provider for your cluster.

5. Create an IAM service account for the AWS EKS cluster.

   For more information on creating an IAM service account, see Amazon EFS CSI driver.

6. If an IAM role needs an access to the EKS cluster, run the following command from the system that already has access to the EKS cluster:

   kubectl edit -n kube-system configmap/aws-auth

   For more information on creating an IAM role, see Enabling IAM user and role access to your cluster.

7. Login to the AWS environment to access the Kubernetes cluster by running the following command on AWS CLI:

   aws eks --region <region_name> update-kubeconfig --name <cluster_name>

8. Free space of approximately 8.5GB on the location where you copy and extract the product installation TAR package file. If using docker locally, there should be approximately 8GB available on the /var/lib/docker location so that the images can be loaded to the docker cache, before being pushed to the container registry.