NetBackup™ Deployment Guide for Kubernetes Clusters

(AKS-specific)

• The networkLoadBalancer section can be used to provide static IP address and DNS name allocation to the loadbalancer services. For more information to create and use static loadbalancer, see Microsoft documentation.

  Static IP addresses and FQDN if used must be created before being used. Refer the below section:

  • Pre-allocation of static IP address and FQDN from resource group

    In this case, it is required to provide the network resource group in annotations. This resource group is the resource group of load balancer public IPs that are in the same resource group as the cluster infrastructure (node resource group). This static FQDN and IP address must be valid in case of pod failure or upgrades scenarios as well.

    In case user wants to use public load balancer, add type: Public in networkLoadBalancer section in primary and media server section in environment CR.

    • Example: In primary CR,

      networkLoadBalancer:
        type: Public
        annotations:
        - service.beta.kubernetes.io/azure-load-balancer-
      resource-group:<name of network resource-group>
        ipList:
        - fqdn: primary.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.123

      Media server section in environment CR -

      networkLoadBalancer:
        annotations:
        - service.beta.kubernetes.io/azure-load-balancer-
      resource-group: ""<name of network resource-group>""
        ipList:
        - fqdn: media-1.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.123
        - fqdn: media-2.eastus.cloudapp.azure.com
          ipAddr: 40.123.45.124

(EKS-specific)

• NetBackup supports the network load balancer with AWS Load Balancer scheme as internet-facing.

• FQDN must be created before being used. Refer below sections for different allowed annotations to be used in CR spec.

• User must add the following annotations:

  service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name>

  In addition to the above annotations, if required user can add more annotations supported by AWS. For more information, see AWS Load Balancer Controller Annotations.

  Example: CR spec in primary server,

  networkLoadBalancer: 
  type: Private
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name> 
    ipList: 
    "10.244.33.27: abc.vxindia.veritas.com"

  CR spec in media server,

  networkLoadBalancer: 
  type: Private
  annotations:
     service.beta.kubernetes.io/aws-load-balancer-subnets: <subnet1 name> 
     ipList: 
    "10.244.33.28: pqr.vxindia.veritas.com" 
    "10.244.33.29: xyz.vxindia.veritas.com"

  The IP address, the subnet provided in ipList and annotations in networkLoadBalancer section in CR spec must belong to same availability zone that of the node group.

  Note:

  The subnet provided here should be same as the one given in node pool used for primary server and media server.

• 1556

  Used as bidirectional port. Primary server to/from media servers and primary server to/from client require this TCP port for communication.

• 443

  Used to inbound to vnet proxy tunnel on the primary server. Also, this is used Nutanix workload, communication from primary server to the deduplication media server.

• 13781

  The MQBroker is listening on TCP port 13781. NetBackup client hosts - typically located behind a NAT gateway - be able to connect to the message queue broker (MQBroker) on the primary server.

• 13724

  This port is required as a fall-back option when a legacy service cannot be reached through PBX and is required when using the Resilient Network feature.

• Port 22

  Used by NetBackup IT Analytics data collector for data collection.

• 1556

  Used as bidirectional port. Primary server to/from media servers and primary server to/from client require this TCP port for communication.

• 13724

  Used as a fall-back option when a legacy service cannot be reached through PBX and when using the Resilient Network feature.

• 443

  The Snapshot Manager user interface uses this port as the default HTTPS port.

• 5671

  The Snapshot Manager RabbitMQ server uses this port for internal service communications. This port must be open to support multiple agents, extensions, backup from snapshot, and restore from backup jobs.

• (EKS-specific) 2049

  It is used for Amazon EFS access.

  For more information, see Source ports for working with EFS.

  Note:

  Add the NFS rule that allows traffic on port 2049 directly to the cluster security group. The security group attached to EFS must also allow traffic from port 2049.