NetBackup™ Deployment Guide for Kubernetes Clusters

(AKS-specific)

• In CR yaml, networkLoadBalancer is an optional field. If not defined in CR yaml, by default value of type is Private and services are added with annotations service.beta.kubernetes.io/azure-load-balancer-internal: "true". In this case, by default internal load balancer is selected for deployment.

• If networkLoadBalancer section is not defined, by default internal load balancer with dynamic IP address allocation are done. In this case, DNS names for the services can be obtained from HostName in CR status using the kubectl describe <CR name> -n <namespace> command.

  • Whenever, HostName in CR status is not in FQDN format, you must add entry of hostname and its corresponding IP address in /etc/host to access the primary server and its corresponding IP address in hosts file of computer accessing the primary server. Hosts file is present at the following location:

    • For Linux: /etc/hosts

    • For Windows: c:\Windows\System32\Drivers\etc\hosts

  • In case of media server, FQDN per media server replica is generated using resourceName mentioned in media server CR and listed under status attributes media server-name of the media server CR.

• The networkLoadBalancer section can be used to provide static IP address and DNS name allocation to the loadbalancer services. For more information to create and use static loadbalancer, see Microsoft documentation.

  Static IP addresses and FQDN if used must be created before being used. Refer the below section:

  • Pre-allocation of static IP address and FQDN from resource group

    In this case, it is required to provide the network resource group in annotations. This resource group is the resource group of load balancer public IPs that are in the same resource group as the cluster infrastructure (node resource group). This static FQDN and IP address must be valid in case of pod failure or upgrades scenarios as well.

    In case user wants to use public load balancer, add type: Public in networkLoadBalancer section in primary and media server section in environment CR.

    • Example: In primary CR,

      networkLoadBalancer:
        type: Public
        annotations:
        - service.beta.kubernetes.io/azure-load-balancer-
      resource-group:<name of network resource-group>
        ipList:
        - fqdn: primary.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.123

      Media server section in environment CR -

      networkLoadBalancer:
        annotations:
        - service.beta.kubernetes.io/azure-load-balancer-
      resource-group: ""<name of network resource-group>""
        ipList:
        - fqdn: media-1.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.123
        - fqdn: media-2.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.124

(EKS-specific)

• NetBackup supports the network load balancer with AWS Load Balancer scheme as internet-facing.

• FQDN must be created before being used. Refer below sections for different allowed annotations to be used in CR spec.

• User must add the following annotations:

  service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name>

  In addition to the above annotations, if required user can add more annotations supported by AWS. For more information, see AWS Load Balancer Controller Annotations.

  Example: CR spec in primary server,

  networkLoadBalancer: 
  type: Private
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name> 
    ipList: 
    "10.244.33.27: abc.vxindia.veritas.com"

  CR spec in media server,

  networkLoadBalancer: 
  type: Private
  annotations:
     service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name> 
     ipList: 
    "10.244.33.28: pqr.vxindia.veritas.com" 
    "10.244.33.29: xyz.vxindia.veritas.com"

  The IP address, the subnet provided in ipList and annotations in networkLoadBalancer section in CR spec must belong to same availability zone that of the node group.

  Note:

  The subnet provided here should be same as the one given in node pool used for primary server and media server.

• 1556

  Used as bidirectional port. Primary server to/from media servers and primary server to/from client require this TCP port for communication.

• 8443

  Used to inbound to java nbwmc on the primary server.

• 443

  Used to inbound to vnet proxy tunnel on the primary server. Also, this is used Nutanix workload, communication from primary server to the deduplication media server.

• 13781

  The MQBroker is listening on TCP port 13781. NetBackup client hosts - typically located behind a NAT gateway - be able to connect to the message queue broker (MQBroker) on the primary server.

• 13782

  Used by primary server for bpcd process.

• Port 22

  Used by NetBackup IT Analytics data collector for data collection.

• 1556

  Used as bidirectional port. Primary server to/from media servers and primary server to/from client require this TCP port for communication.

• 13782

  Used by media server for bpcd process.

• 443

  The Snapshot Manager user interface uses this port as the default HTTPS port.

• 5671

  The Snapshot Manager RabbitMQ server uses this port for internal service communications. This port must be open to support multiple agents, extensions, backup from snapshot, and restore from backup jobs.

• (EKS-specific) 2049

  It is used for Amazon EFS access.

  For more information, see Source ports for working with EFS.

  Note:

  Add the NFS rule that allows traffic on port 2049 directly to the cluster security group. The security group attached to EFS must also allow traffic from port 2049.