NetBackup™ Snapshot Manager for Cloud Install and Upgrade Guide
- Introduction
- Section I. NetBackup Snapshot Manager for Cloud installation and configuration
- Preparing for NetBackup Snapshot Manager for Cloud installation
- Meeting system requirements
- NetBackup Snapshot Manager host sizing recommendations
- NetBackup Snapshot Manager extension sizing recommendations
- Creating an instance or preparing the host to install NetBackup Snapshot Manager
- Installing container platform (Docker, Podman)
- Creating and mounting a volume to store NetBackup Snapshot Manager data
- Verifying that specific ports are open on the instance or physical host
- Preparing NetBackup Snapshot Manager for backup from snapshot jobs
- OCI - iptables rules for backup from snapshot jobs
- Deploying NetBackup Snapshot Manager for Cloud using container images
- Before you begin installing NetBackup Snapshot Manager
- Installing NetBackup Snapshot Manager in the Docker/Podman environment
- Installing NetBackup Snapshot Manager on CIS Level 2 v2 configured host
- Securing the connection to NetBackup Snapshot Manager
- Verifying that NetBackup Snapshot Manager is installed successfully
- Restarting NetBackup Snapshot Manager
- Deploying NetBackup Snapshot Manager for Cloud extensions
- Before you begin installing NetBackup Snapshot Manager extensions
- Downloading the NetBackup Snapshot Manager extension
- Installing the NetBackup Snapshot Manager extension on a VM
- Installing the NetBackup Snapshot Manager extension on a managed Kubernetes cluster (AKS) in Azure
- Installing the NetBackup Snapshot Manager extension on a managed Kubernetes cluster (EKS) in AWS
- Installing the NetBackup Snapshot Manager extension on a managed Kubernetes cluster (GKE) in GCP
- Install extension using the Kustomize and CR YAMLs
- Managing the extensions
- NetBackup Snapshot Manager for cloud providers
- Why to configure the NetBackup Snapshot Manager cloud providers?
- AWS plug-in configuration notes
- Prerequisites for configuring the AWS plug-in
- Before you create a cross account configuration
- Prerequisites for application consistent snapshots using AWS Systems Service Manager
- Prerequisites for configuring AWS plug-in using VPC endpoint
- AWS permissions required by NetBackup Snapshot Manager
- Configuring AWS permissions for NetBackup Snapshot Manager
- Google Cloud Platform plug-in configuration notes
- Prerequisites for configuring the GCP plug-in using Credential and Service Account option
- Google Cloud Platform permissions required by NetBackup Snapshot Manager
- Preparing the GCP service account for plug-in configuration
- Configuring a GCP service account for NetBackup Snapshot Manager
- GCP cross-project configuration
- GCP shared VPC configuration
- Microsoft Azure plug-in configuration notes
- Microsoft Azure Stack Hub plug-in configuration notes
- OCI plug-in configuration notes
- Cloud Service Provider endpoints for DBPaaS
- Configuration for protecting assets on cloud hosts/VM
- Deciding which feature (on-host agent or agentless) of NetBackup Snapshot Manager is to be used for protecting the assets
- Protecting assets with NetBackup Snapshot Manager's on-host agent feature
- Installing and configuring NetBackup Snapshot Manager agent
- Configuring the NetBackup Snapshot Manager application plug-in
- Configuring an application plug-in
- Microsoft SQL plug-in
- Oracle plug-in
- Protecting assets with NetBackup Snapshot Manager's agentless feature
- Snapshot Manager for cloud catalog backup and recovery
- NetBackup Snapshot Manager for cloud assets protection
- Volume encryption in NetBackup Snapshot Manager for cloud
- NetBackup Snapshot Manager for Cloud security
- Preparing for NetBackup Snapshot Manager for Cloud installation
- Section II. NetBackup Snapshot Manager for Cloud maintenance
- NetBackup Snapshot Manager for Cloud logging
- Upgrading NetBackup Snapshot Manager for Cloud
- About NetBackup Snapshot Manager for Cloud upgrades
- Supported upgrade path
- Upgrade scenarios
- Preparing to upgrade NetBackup Snapshot Manager
- Upgrading NetBackup Snapshot Manager
- Upgrading NetBackup Snapshot Manager using patch or hotfix
- Applying operating system patches on NetBackup Snapshot Manager host
- Migrating and upgrading NetBackup Snapshot Manager
- GCP configuration for migration from zone to region
- Post-upgrade tasks
- Post-migration tasks
- Uninstalling NetBackup Snapshot Manager for Cloud
- Preparing to uninstall NetBackup Snapshot Manager
- Backing up NetBackup Snapshot Manager
- Unconfiguring NetBackup Snapshot Manager plug-ins
- Unconfiguring NetBackup Snapshot Manager agents
- Removing the NetBackup Snapshot Manager agents
- Removing NetBackup Snapshot Manager from a standalone Docker host environment
- Removing NetBackup Snapshot Manager extensions - VM-based or managed Kubernetes cluster-based
- Restoring NetBackup Snapshot Manager
- Troubleshooting NetBackup Snapshot Manager for Cloud
- Troubleshooting NetBackup Snapshot Manager
- SQL snapshot or restore and granular restore operations fail if the Windows instance loses connectivity with the NetBackup Snapshot Manager host
- Disk-level snapshot restore fails if the original disk is detached from the instance
- Discovery is not working even after assigning system managed identity to the control node pool
- Performance issue with GCP backup from snapshot
- Post migration on host agents fail with an error message
- File restore job fails with an error message
- Acknowledgment not received for datamover
- Google Cloud Platform does display the Snapshot ID of the disk
- Application state of the connected/configured cloud VM(s) displays an error after upgrading to NetBackup Snapshot Manager version 11.x
- Backup and restore jobs fail with timeout error
- GCP restore with encryption key failed with an error message
- Amazon Redshift clusters and databases not available after discovery
- Shared VPC subnet not visible
- Container manager may not spawn the ephemeral registration container timely
- GCP restore from VM fails to obtain firewall rules
- Parameterised VM restore fails to retrieve encryption keys
- Restore from snapshot of a VM with security type Trusted Launch fails
- Snapshot Manager failed to retrieve the specified cloud domain(s), against the specified plugin instance
- Issues with SELinux configuration
- Performance issues with OCI backup from snapshot and restore from backup copy
- Connection to Amazon Linux 2023 or Alma Linux machines fail
- Single file restore from snapshot copy fails with an error
- MS SQL application backup, restore, or SFR job on Windows cloud VM fails with an error
- Status 49 error appears
- Restore from backup fails with an error
- (For AWS) If the specified AMI is not subscribed in the given region an error message appears
- Restore of Azure Disk Encrypted VM fails with an error
Securing the connection to NetBackup Snapshot Manager
Supported scenarios:
Primary server and Snapshot Manager must be with ECA or NBCA.
For NBCA and ECA mixed mode continue with ECA mode for NetBackup Snapshot Manager installation.
Unsupported scenario: Primary with NBCA and NetBackup Snapshot Manager with ECA and vice versa.
In the NetBackup Snapshot Manager, you can upload CRLs of the external CA at /cloudpoint/eca/crl file. The uploaded CRL does not work, if the crl directory is not present or is empty.
For data mover container, add /cloudpoint/eca/crl path against the ECA_CRL_PATH parameter in the /cloudpoint/openv/netbackup/bp.conf file.
Following three parameters are tuneable, you can add the entry under eca section in the /cloudpoint/flexsnap.conf file.
Table: ECA parameters
Parameter | Default | Value | Remarks |
|---|---|---|---|
eca_crl_check | 0 (Disable) | 0 (disable) 1 (leaf) 2 (chain) | Certificate check level. Used to control the CRL/OCSP validation level for NetBackup Snapshot Manager host connecting to On-prem/cloud workloads.
|
eca_crl_refresh_ hours | 24 | Numerical value between 0 and 4830 | Time interval in hours to update the NetBackup Snapshot Manager CRLs cache from CA through the certificate CDP URL. Option is not applicable if |
eca_crl_path_sync_ hours | 1 | Numerical value between 1 and 720 | Time interval in hours to update the NetBackup Snapshot Manager CRL cache from |
For more information, refer to the following sections of the NetBackup™ Security and Encryption Guide.
About the host ID-based certificate revocation list
When an authorization token is required during certificate deployment
Note:
Cache is not validated if any of ECA tuneable are added or modified manually inside the /cloudpoint/flexsnap.conf file.
For detailed information on NetBackup CA and certificates, refer to the "NetBackup CA and NetBackup certificates" chapter of NetBackup™ Security and Encryption Guide.
The following table provides the regeneration steps to be performed for revoking the certificates in Snapshot Manager:
Use case | Commands |
|---|---|
| CA migration |
|
Post revoke certificate regeneration for NBCA | # flexsnap_configure renew --token <reissue-token> Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed. |
Post revoke certificate regeneration for ECA | # flexsnap_configure renew --ca /eca2/trusted/cacerts.pem --key /eca2/private/key.pem --chain /eca2/cert_chain.pem Enrolling external CA certificates with NetBackup... Snapshot Manager certificate is renewed. |
Post migration regenerate certificates for ECA/NBCA | # flexsnap_configure renew --hostnames new-nbsm.veritas.com --token <authentication-token> Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed. Please run 'flexsnap_configure renew --internal --hostnames <nbsm_fqdn> to renew Snapshot Manager's internal CA and certificates. |
Certificate regeneration for extension | # flexsnap_configure renew --extension --primary <nbsm_fqdn> --token <extension_token> |
Certificate rotation | # flexsnap_configure renew --force Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed. |
Internal flexsnap CA certificate in case of migration, Disaster Recovery scenarios | # flexsnap_configure renew --internal --hostnames <nbsm_fqdn> Renewed Flexsnap CA ... skip Renewed rabbitmq certificate ... done Renewed postgresql certificate ... done Renewed listener certificate ... done Renewed workflow certificate ... done Renewed scheduler certificate ... done Renewed agent certificate ... done Renewed client certificate ... done Renewed certmaster certificate ... done Renewed agent certificate ... done Renewed notification certificate ... done Renewed client certificate ... done Renewed client certificate ... done Renewed mongodb certificate ... done Renewed coordinator certificate ... done Renewed config certificate ... done Renewed idm certificate ... done Renewed agent certificate ... done Renewed client certificate ... done Renewed policy certificate ... done Snapshot Manager's CA and certificates are renewed. Restart the Snapshot Manager stack using 'flexsnap_configure restart' to take effect. |
You need to rotate the passphrase manually for BYO and Cloud scale deployments.
For BYO deployments, stop the NetBackup Snapshot Manager, and use the flexsnap_configure command with the following options:
flexsnap_configure renew --rotate-passphrase
When prompted, press y to give consent.
This operation performs the rotation of the passphrase that encrypts the private key of the host ID-based certificates.
For Cloud scale deployments, use the flexsnap_configure, with these options:
kubctl exec -it <certauth pod> -n <namespace> flexsnap-config renew --rotate-passphrase
Restart the NetBackup Snapshot Manager.
Note:
Private keys generated for ECA can be or cannot be encrypted. It depends on user to provide encrypted private key at the time of installation.