NetBackup™ for Kubernetes Administrator's Guide

To add Rancher managed RKE cluster manually in NetBackup

1. External CA Cert: The External CA certificate is required for NetBackup to communicate successfully with the cluster, if there is a different CA (Certifying Authority) used to configure the certificates for external access.

   • Navigate to the Rancher Management Server UI > Open the left side panel Global Settings > Under cacerts, click the showcacerts button.

     Extract this complete CA certificate value in a temporary file

   • For example, <cacert-value-file>

2. Service account CA Cert:

   Note:

   You must do the following the step as there is a different CA (Certifying Authority) configured for external access of the Kubernetes API server compared to the service account CA cert which is available within the cluster. Hence, these two CA certificates must be combined.

   To get the service account CA certificate, run the following commands on the Linux cluster host.

   • Get the service account secret name available on the Kubernetes operator's namespace using the following command:

     kubectl describe serviceaccount <kopsnamespace>-backup-server -n <kopsnamespace> | grep Tokens | cut -d ":" -f 2

   • Get the CA certificate in the base 64 decoded form from this service account secret using this command:

     kubectl get secret <output-from-previous-command> -n <kopsnamespace> -o jsonpath='{. data.ca\.crt}' | base64 -d

     Entire output of this command must be appended to the temporary file which we created in step 1.

3. Append the output that was generated after Step 2 at the end of the <cacert-value-file> file. The necessary external and internal CA cert values have are extracted and available in the file <cacert-value-file>. The CA cert values are base 64 decoded form which you have to encode again while creating credentials on NetBackup.
4. Token: Rancher Management Server UI > Open the left side panel > Under the EXPLORE CLUSTER section > Navigate to the cluster you want to protect > Kubeconfig icon on the top right corner.

   • Extract the token: value without the double quotes " " from the downloaded Kubeconfig file (using the Download KubeConfig) into a temporary file <token-value-file>.

   • Both these fields token and cacert are required in the base64 encoded form to add in the NetBackup credentials for Kubernetes.

   • To get the base64 encoded version of both these extracted values using the following base64 command:

     #Use a Linux VM to encode the values for this step #Note: the flag -w0 has the zero digit and not a 0 Symbol.

     #For CA cert:

     Cat <cacert-value-file>| base64 -w0

     Paste this output in the CA certificate field in the NetBackup credentials creation page.

     #For Token:

     Paste this output in the Token field in the NetBackup web UI's credentials creation page.

   • Use these values in the NetBackup web UI > Credential management > Named Credentials > Add to add the valid Rancher credentials in NetBackup.

   • Once the credentials are created, add the Kubernetes cluster in NetBackup using the name shown in the following cluster-info output.

To get cluster information output run the following commands

1. The cluster info output must be in the following example format:[root@master-0~] # kubectl cluster-info
2. Kubernetes control plane runs at https://<rancher-hostname>/k8s/clusters/c-m-zjrfft56
3. CoreDNS runs at https://<rancher-hostname>/k8s/clusters/c-m-zjrfft56/api/v1/

   namespaces/kube-system/services/rke2-coredns-rke2-coredns:udp-53/proxy

4. Extract the entire API server endpoint (https:// included) from the output mentioned which should be in the following pattern: https://<rancher-hostname>/k8s/clusters/c-m-zjrfft56
5. Add the entire rancher cluster name into NetBackup web UI > Workloads > Kubernetes > Kubernetes clusters >Add .
6. On the Add Kubernetes cluster page, select a option associated with URL or Endpoints to allow cluster addition based on the endpoints which contain (https://).

   Note:

   You cannot edit the cluster names added using the endpoint-based approach. You can only delete and re-add such cluster names.

7. Enter the cluster info output which is extracted above into the input field on the NetBackup web UI (Endpoint or URL).
8. Proceed ahead and select or create the credentials which were prepared in steps 1 to 4.
9. Once the credentials are validated and a cluster is added successfully. It will trigger an automated validation and discovery.
10. After a successful automated discovery, user attempts a manual credential validation and discovery to ensure that everything is working fine.
11. Add a Rancher managed cluster in NetBackup.
12. Create the backup server certificate secret and the data mover configmap to setup Backup from Snapshot (BFS) function.

    Then, proceed with the rest of the configuration steps as per the recommended setup guide.