NetBackup™ Deployment Guide for Kubernetes Clusters

Template creation

1. Modify the template.json file saved earlier by removing the following sections:

   Under resources section for cluster > properties:

   • windowsProfile": {
                         "adminUsername": "<Default username>",
                         "enableCSIProxy": true
                     },

   • identityProfile": {
                         "kubeletidentity": {
                             "resourceId": "[parameters('userAssignedIdentities_<clustername>_<master node pool name>_externalid')]",
                             "clientId": "<CLIENT ID>",
                             "objectId": "<OBJECT ID>"
                         }
                     },

   Delete the resource of type Microsoft.ContainerService/managedClusters/privateEndpointConnections:

   • {
     "type": "Microsoft.ContainerService/managedClusters/privateEndpointConnections",
     
          "apiVersion": "2023-08-02-preview",
                  .
     
        .
        .
     }

2. If cluster recovering is in different availability zone, then set appropriate zone for the cluster and nodepools in template.json file.

   "availabilityZones": [
   "<zone number>"
   
   ],

3. Save the template.json file to be used later for restore.

AKS cluster recovery

1. Delete the cluster that needs to be recovered (so that same name, IPs, and so on can be used).
2. Re-create cluster using templates saved earlier as follows:

   • Ensure that you are logged in through Azure CLI with subscription set to where the cluster is present:

     az deployment group create --resource-group <resource_group> --name <deployment_name> --template-file template.json

     Here,

     resource_group: Resource group where cluster is present.

     deployment_name: Deployment name is the name with which you may look for the deployment under the deployments section of the resource group in portal.

   • Once deployment is complete, a successful completion without any errors, with a deployment summary JSON.

   • Connect to cluster and perform the remaining recovery options through CLI:

     • Connect to cluster:

       az login

       az account set --subscription <subscriptionID>

       az aks get-credentials --resource-group <resource_group> --name <cluster-name>

       kubelogin convert-kubeconfig -l azurecli

       Here,

       subscriptionID: Subscription ID where cluster is present.

       resource_group: Resource group where cluster is present.

       cluster-name: Name of the cluster.

     • Attach ACR:

       az aks update -n <cluster-name> -g <resource_group> --attach-acr <ContainerRegistry>

       Here,

       ContainerRegistry: Name of Azure container registry where images are pushed.

       resource_group: Resource group where cluster is present.

       cluster-name: Name of the cluster.

     • Authorize cluster to access Virtual Networks:

       If authorization is done through cluster service principal, then perform the following steps:

       • Get Service Principal ID:

         az resource list -n <cluster_name> --query [*].identity.principalId --out tsv

       • Role assignment:

         az role assignment create --assignee <clusterServicePrincipal> --role '<nbux-deployment-role>' --scope /subscriptions/<subscriptionID>/resourceGroups/<resource_group>/providers/Microsoft.Network/virtualNetworks/<Vnet_podips>/subnets/<Subnet_podips> 

         az role assignment create --assignee <clusterServicePrincipal> --role '<nbux-deployment-role>' --scope /subscriptions/<subscriptionID>/resourceGroups/<resource_group>/providers/Microsoft.Network/virtualNetworks/<Vnet_LoadBalancer>/subnets/<Subnet_LoadBalancer_ips>

         Here,

         clusterServicePrincipal: Service Principal ID of cluster.

         nbux-deployment-role: Custom Role that has necessary permissions for NetBackup deployment.

         subscriptionID: Subscription ID where virtual network is present.

         resource_group: Resource group where virtual network is present.

       • If User Managed Identity or System Managed Identity is attached to scale sets then re-attach the same identity to scale sets.

       • Refresh the credentials of cluster as follows:

         az aks get-credentials --resource-group <resource_group> --name <cluster_name>

         Here,

         resource_group: Resource group where cluster is present.

         cluster-name: Name of the cluster.

EKS cluster recovery

1. Cluster recovery:

   To create a new cluster, user can refer to the following fields from output of the aws eks describe-cluster --name <Cluster name> command:

   Name, Kubernetes version 3, Cluster service role, tags, VPC, Subnet, Security Group and Cluster endpoint access

2. Nodegroup recovery:

   To create a node group for a new cluster, user can refer to the following fields from output of the aws eks describe-nodegroup --nodegroup-name "<nodegroup-name>" --cluster-name <cluster-name> command:

   Nodegroup name, Cluster name, Scaling config, Instance type, Node role, Disk size, Labels, Taints , Tags and Subnet

3. File system:

   To create new file system storage, user can refer to the following fields from the output of the aws efs describe-file-systems --file-system-id <EFS ID> and aws efs describe-mount-targets --file-system-id <EFS ID> commands:

   Name, Virtual Private Cloud (VPC), Performance mode, Throughput mode , Provisioned Throughput (applicable only if Throughput mode is provisioned), Network access, Virtual Private Cloud (VPC) (Mount targets and AZ, SubnetID, IPAddr, SecurityGroup)

4. Add-ons

   Once cluster is up and running, user must install add-ons listed by using the following command:

   aws eks list-addons --cluster-name <cluster-name>

   In addition to listed add-on, user must install AWS load balancer controller add-on and Amazon EFS CSI driver.