NetBackup™ Deployment Guide for Kubernetes Clusters

To deploy NetBackup primary, media, and MSDP Scaleout components:

1. Create a Kubernetes namespace where your new NetBackup environment will run. Run the command:

   kubectl create namespace nb-example

   Where, nb-example is the name of the namespace. The Primary, Media, and MSDP Scaleout application namespace must be different from the one used by the operators. It is recommended to use two namespaces. One for the operators, and a second one for the applications.

2. Create a secret to hold the primary server credentials. Those credentials are configured in the NetBackup primary server, and other resources in the NetBackup environment use them to communicate with and configure the primary server. The secret must include fields for `username` and `password`. If you are creating the secret by YAML, the type should be opaque or basic-auth. For example:

   apiVersion: v1
          kind: Secret
          metadata:
            name: primary-credentials
            namespace: nb-example
          type: kubernetes.io/basic-auth
          stringData:
            username: nbuser
            password: p@ssw0rd

   You can also use this command to create a secret.

   $ kubectl create secret generic primary-credentials --namespace nb-example --from-literal=username='nbuser' --from-literal=password='p@ssw0rd'

3. Create a KMS DB secret to hold Host Master Key ID (`HMKID`), Host Master Key passphrase (`HMKpassphrase`), Key Protection Key ID (`KPKID`), and Key Protection Key passphrase (`KPKpassphrase`) for NetBackup Key Management Service. If creating the secret by YAML, the type should be _opaque_. For example:

    apiVersion: v1
          kind: Secret
          metadata:
            name: example-key-secret
            namespace: nb-example
          type: Opaque
          stringData:
            HMKID: HMKID
            HMKpassphrase: HMKpassphrase
            KPKID: KPKID
            KPKpassphrase: KPKpassphrase

   You can also create a secret using kubectl from the command line:

   $ kubectl create secret generic example-key-secret --namespace nb-namespace --from-literal=HMKID="HMKID" --from-literal=HMKpassphrase="HMKpassphrase" --from-literal=KPKID="KPKID" --from-literal=KPKpassphrase="KPKpassphrase"

   For more details on NetBackup deduplication engine credential rules, see: https://www.veritas.com/support/en_US/article.100048511

4. Create a secret to hold the MSDP Scaleout credentials for the storage server. The secret must include fields for `username` and `password` and must be located in the same namespace as the Environment resource. If creating the secret by YAML, the type should be _opaque_ or _basic-auth_. For example:

   apiVersion: v1
          kind: Secret
          metadata:
            name: msdp-secret1
            namespace: nb-example
          type: kubernetes.io/basic-auth
          stringData:
            username: nbuser
            password: p@ssw0rd

   You can also create a secret using kubectl from the command line:

   $ kubectl create secret generic msdp-secret1 --namespace nb-example --from-literal=username='nbuser' --from-literal=password='p@ssw0rd'

   Note:

   You can use the same secret for the primary server credentials (from step 2) and the MSDP Scaleout credentials, so the following step is optional. However, to use the primary server secret in an MSDP Scaleout, you must set the `credential.autoDelete` property to false. The sample file includes an example of setting the property. The default value is true, in which case the secret may be deleted before all parts of the environment have finished using it.

5. (Optional) Create a secret to hold the KMS key details. Specify KMS Key only if the KMS Key Group does not already exist and you need to create.

   Note:

   When reusing storage from previous deployment, the KMS Key Group and KMS Key may already exist. In this case, provide KMS Key Group only.

   If creating the secret by YAML, the type should be _opaque_. For example:

   apiVersion: v1
          kind: Secret
          metadata:
            name: example-key-secret
            namespace: nb-example
          type: Opaque
          stringData:
            username: nbuser
            passphrase: 'test passphrase'

   You can also create a secret using kubectl from the command line:

   $ kubectl create secret generic example-key-secret --namespace nb-example --from-literal=username="nbuser" --from-literal=passphrase="test passphrase"

   You may need this key for future data recovery. After you have successfully deployed and saved the key details. It is recommended that you delete this secret and the corresponding key info secret.

6. (Optional for AKS-specific) Create a secret to hold the MSDP S3 root credentials if you need MSDP S3 service. The secret must include accessKey and secretKey, and must be located in the same namespace as the Environment resource.

   • accessKey must match the regex pattern ^[\w]+$ and has the length in the range [16, 128].

   • secretKey must match the regex pattern ^[\w+\/]+$ and has the length in the range [32, 128].

   It is recommended that you generate random S3 root credentials. Run the following command:

   $ kubectl msdp generate-s3-secret --namespace nb-example --s3secret s3-secret1

   Save the generated S3 root credentials at a secure place for later use.

7. Configure the samples/environment.yaml file according to your requirements. This file defines a primary server, media servers, and scale out MSDP Scaleout storage servers.See Configuring the environment.yaml file. for details.
8. Apply the environment yaml file, using the same application namespace created in step 1.

   $ kubectl apply --namespace nb-example --filename environment.yaml

   Use this command to verify the new environment resource in your cluster:

   $ kubectl get --namespace nb-example environments

   The output should look like:

   NAME                 AGE
   environment-sample   2m

   After a few minutes, NetBackup finishes starting up on the primary server, and then the media servers and MSDP Scaleout storage servers you configured in the environment resource start appearing. Run:

   $ kubectl get --namespace nb-example all,environments,primaryservers,mediaservers,msdpscaleouts

   The output should show:

   • All pod status as Ready and Running

     NAME                        READY   STATUS    
     pod/dedupe1-uss-controller- 1/1     Running  
     pod/dedupe1-uss-mds-1       1/1     Running   

   • For msdpscaleout SIZE = READY, for example: 4=4.

     NAME                                     SIZE   READY
     msdpscaleout.msdp.veritas.com/dedupe1     4      4

   • environment.netbackup should show STATUS as Success

     NAME                                                   STATUS
     environment.netbackup.veritas.com/environment-sample   Success

9. To start using your newly deployed environment sign-in to NetBackup web UI. Open a web browser and navigate to https://<primaryserver>/webui/login URL.

   The primary server is the host name or IP address of the NetBackup primary server.

   You can retrieve the primary server's hostname by using the command:

   $ kubectl describe primaryserver.netbackup.veritas.com/<primary server CR name>--namespace <namespace_name>