NetBackup™ Deployment Guide for Kubernetes Clusters

Manually disabling the non-SSL access to remote PostgreSQL on Azure

1. Launch an Azure CLI pod into the AKS cluster using the following command:

   $ kubectl run az-cli --image=mcr.microsoft.com/azure-cli --command sleep infinity

2. Exec into the Azure CLI pod as follows:

   $ kubectl exec -it az-cli -- /bin/ash

3. From Azure CLI pod, log into Azure account:

   $ az login --scope https://graph.microsoft.com//.default

4. (Optional) Create a key vault policy to allow the current user to retrieve the database credential.

   Obtain the name of your resource group, key vault and ID of the current user by using the following respective commands:

   • Resource group name:

     $ RESOURCE_GROUP=<resource_group_name>

   • Key vault name:

     $ az keyvault list --resource-group $RESOURCE_GROUP --resource-type vault | jq -r '.[].name'

   • Current user ID name:

     $ az account show | jq -r '.user.name'

   Create a key vault access policy as follows:

   $ az keyvault set-policy -n $KEY_VAULT_NAME --upn $USER_ID --resource-group $RESOURCE_GROUP --secret-permissions get

5. Obtain the login name for the key vault (DBADMINUSER):

   $ DBADMINUSER=$(az keyvault secret show --vault-name $KEY_VAULT_NAME --name dbadminlogin | jq -r .value)

6. Obtain the password for the key vault (DBADMINPASSWORD):

   $ az keyvault secret show --resource-group $RESOURCE_GROUP --vault-name $USER_ID --name dbadminpassword

7. Re-encrypt the password.

   Re-encrypting the password requires the database server name. Obtain the database server name using the following command:

   $ az postgres flexible-server list --resource-group $RESOURCE_GROUP | jq -r '.[].name'

   Use the following command to re-encrypt the password:

   $ az postgres flexible-server execute -p '$DBADMINPASSWORD' -u $DBADMINUSER -n $DBSERVER -d postgres -q "ALTER USER\"nbdbadmin\" WITH PASSWORD '$DBADMINPASSWORD';"

8. Use the following command to disable non-SSL access:

   $ az postgres flexible-server parameter set --resource-group $RESOURCE_GROUP --server-name DBSERVER --name require_secure_transport --value on

9. Use the following command to verify if non-SSL access is disabled:

   $ az postgres flexible-server parameter show --resource-group $RESOURCE_GROUP --server-name $DBSERVER --name require_secure_transport | jq -r 'value'

10. Delete the key vault access policy created in step 4 above:

    $ az keyvault delete-policy -n $KEYVAULT --upn $USER_ID

11. Exit from the azure CLI pod:

    $ exit

12. Delete the az CLI pod:

    $ kubectl delete pod az-cli