NetBackup™ Deployment Guide for Kubernetes Clusters

AKS-specific

1. Launch an Azure CLI pod into the AKS cluster using the following command:

   $ kubectl run az-cli --image=mcr.microsoft.com/azure-cli --command sleep infinity

   Note:

   Access to Azure Key Vault is restricted to specific subnets. Passwords stored in Azure Key Vault can be easily updated from a pod running in AKS.

2. Exec into the Azure CLI pod as follows:

   $ kubectl exec -it az-cli -- /bin/ash

3. From Azure CLI pod, log into Azure account:

   $ az login --scope https://graph.microsoft.com//.default

4. (Optional) Create a key vault policy to allow the current user to retrieve the database credential.

   Obtain the name of your resource group, key vault and ID of the current user by using the following respective commands:

   • Resource group name:

     $ RESOURCE_GROUP=<resource_group_name>

   • Key vault name:

     $ KEY_VAULT_NAME=$(az keyvault list --resource-group $RESOURCE_GROUP --resource-type vault | jq -r '.[].name')

   • Current user ID name:

     $ USER_ID=$(az account show | jq -r '.user.name')

   Create a key vault access policy as follows:

   $ az keyvault set-policy -n $KEY_VAULT_NAME --upn $USER_ID --resource-group $RESOURCE_GROUP --secret-permissions all

5. Store the updated certificate in key vault as follows:

   $ DB_CERT_URL='https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem'

   $ DB_CERT_VALUE=$(curl -L "${DB_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')

   $ az keyvault secret set --vault-name $KEY_VAULT_NAME --name dbcertpem --value "$DB_CERT_VALUE"

6. (Optional) Delete the key vault access policy created in step 4 above:

   $ az keyvault delete-policy -n $KEYVAULT --upn $USER_ID

7. Exit from the azure CLI pod:

   $ exit

8. Delete the az CLI pod:

   $ kubectl delete pod az-cli

9. (Applicable only for an existing cloudscale deployment) Restart the primary pod:

   $ kubectl rollout restart "statefulset/${PRIMARY}" --namespace "${NAMESPACE}"

   In the above command,

   • NAMESPACE is the namespace containing your NetBackup deployment

   • PRIMARY is the name of primary pod's stateful set

   Use the following command to obtain NAMESPACE and PRIMARY:

   $ kubectl get --namespace "${NAMESPACE}" primaryserver -o jsonpath='{.items[0].status.attributes.resourceName}'

EKS-specific

1. Obtain the validity of AWS certificate as follows:

   $ wget https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem

   $ openssl x509 -text -in ./us-east-1-bundle.pem

   For example the certificate details are displayed as follows:

   Certificate:
     Data:
       Version: 3 (0x2)
       Serial Number:
         c7:34:67:36:92:50:ae:75
     Signature Algorithm: sha256WithRSAEncryption
       Issuer: C=US, L=Seattle, ST=Washington, O=Amazon Web Services, Inc., OU=Amazon RDS, CN=Amazon RDS Root 2019 CA
       Validity
         Not Before: Aug 22 17:08:50 2019 GMT
         Not After : Aug 22 17:08:50 2024 GMT
       Subject: C=US, L=Seattle, ST=Washington, O=Amazon Web Services, Inc., OU=Amazon RDS, CN=Amazon RDS Root 2019 CA...

2. Use lambda function to update the certificate.

   LAMBDA_ARN is the ARN of the password changing lambda function. This can be obtained from the lambda function page on AWS console.

   REGION=$(aws configure get region || true)
   DB_CERT_URL=https://truststore.pki.rds.amazonaws.com/${REGION}/${REGION}-bundle.pem
   DB_PROXY_CERT_URL=https://www.amazontrust.com/repository/AmazonRootCA1.pem
    
   DB_CERT_VALUE=$(curl -L "${DB_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')
   DB_PROXY_CERT_VALUE=$(curl -L "${DB_PROXY_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')
   DB_CUM_CERT_VALUE="$DB_CERT_VALUE$DB_PROXY_CERT_VALUE"
    
   tmp_file=$(mktemp /tmp/dbcert.XXXXXX.json)
    
   aws lambda invoke \
       --function-name "$LAMBDA_ARN" \
       --cli-binary-format raw-in-base64-out \
       --payload "{\"dbcertpem\": \"${DB_CUM_CERT_VALUE}\"}" \
       $tmp_file > /dev/null 2>&1

3. Restart the primary pod:

   $ kubectl rollout restart "statefulset/${PRIMARY}" --namespace "${NAMESPACE}"

   In the above command,

   • NAMESPACE is the namespace containing your NetBackup deployment

   • PRIMARY is the name of primary pod's stateful set

   Use the following command to obtain NAMESPACE and PRIMARY:

   $ kubectl get --namespace "${NAMESPACE}" primaryserver -o jsonpath='{.items[0].status.attributes.resourceName}'