PowerProtect | How To Protect a Tanzu Kubernetes guest cluster with PPDM 19.7.

How To Protect a Tanzu Kubernetes guest cluster with PPDM 19.7?

Before adding a Tanzu Kubernetes guest cluster in PowerProtect Data Manager for namespace and PVC protection, Complete the Prerequisites to Tanzu Kubernetes guest cluster protection on page 55 in PowerProtect 19.7  Administration and User Guide.

https://dl.dell.com/content/docu102385_powerprotect-data-manager-19-7-administration-and-user-guide.pdf?language=en_US
 

Enable an asset source for both the vCenter Server and the Kubernetes cluster in PPDM  UI

Steps:

1. From the PowerProtect Data Manager UI, select Infrastructure > Asset Sources, and then click + to reveal the New Asset Source tab.




2. In the pane for the asset source that you want to add, click Enable Source for both the vCenter Server and the Kubernetes cluster




The Asset Sources window updates to display a tab for the new asset sources.
 

Add a VMware vCenter Server (Hosting TKG Clusters) as an asset source in the PowerProtect Data Manager UI.

Perform the steps to add a vCenter Server as an asset source on page 47 in PowerProtect 19.7  Administration and User Guide.

https://dl.dell.com/content/docu102385_powerprotect-data-manager-19-7-administration-and-user-guide.pdf?language=en_US

 

Add a Kubernetes cluster as an asset source in the PowerProtect Data Manager UI.

Perform the following steps to add a Kubernetes cluster as an asset source in the PowerProtect Data Manager UI. When added, PowerProtect Data Manager automatically deploys resources on the cluster that enable the backup and recovery of namespaces.

Steps:

1. From the left navigation pane, select Infrastructure > Asset Sources.
2. In the Asset Sources window, select the Kubernetes cluster tab.
3. Click Add.
4. In the Add Kubernetes cluster dialog box, specify the source attributes:
   

a. Tanzu Cluster  -> When adding a Kubernetes Tanzu guest cluster for protection of vSphere CSI-based persistent volumes, Move the slider to the right.
 

b. Select vCenter -> Select the vCenter Server that contains the guest cluster from the list.
c. Name  ->  Specify the Cluster name.
d. Address -> The fully qualified domain name (FQDN) or the IP address of the Kubernetes API server.
e. Port -> specify the port to use for communication when not using the default port, 443.
 

NOTE: The service account must have the following privileges:
 

• Get/Create/Update/List CustomResourceDefinitions
• Get/Create/Update ClusterRoleBinding for 'cluster-admin' role
• Create/Update 'powerprotect' namespace
• Get/List/Create/Update/Delete all kinds of resources inside 'powerprotect' namespace
• Get/List/Watch all namespaces in the cluster as well as PV, PVC and pods in all these namespaces

 

Add a VM Direct Engine  in PPDM UI that is dedicated to Kubernetes workloads.

Since cProxy pods running in the Kubernetes Tanzu guest cluster will not have access to FCDs directly, a vProxy will be deployed in vCenter to protect the guest cluster. This protection requires an external VM Direct engine dedicated to Kubernetes workloads. 

There should be a minimum of one VM Direct engine per Supervisor cluster.

Perform the steps to Add a VM Direct Engine  in PPDM UI that is dedicated to Kubernetes workloads on page 52 in PowerProtect 19.7  Administration and User Guide.

https://dl.dell.com/content/docu102385_powerprotect-data-manager-19-7-administration-and-user-guide.pdf?language=en_US

Make Sure to specify in Supported Protection Type  that VM Direct engine is intended for  Kubernetes Tanzu guest cluster asset protection.

 

Create Kubernetes Protection Policies To Backup Namespaces and PVCs.

Steps:

1. From the left navigation pane, select Protection > Protection Policies.
2. In the Protection Policies window, click Add. The Add Policy wizard appears.
3. On the Type page, specify the following fields, and then click Next:
 

• Name -> Type a descriptive name for the protection policy.
• Description ->Type a description for the policy.
• Type -> For the policy type, select Kubernetes.

4. On the Purpose page, select from the following options to indicate the purpose of the new protection policy group, and then click Next:
 

• Crash Consistent -> Select this type for point-in-time backup of namespaces.
• Exclusion -> Select this type if there are assets within the protection policy that you plan to exclude from data protection operations.

5. In the Assets page, select one or more unprotected namespaces that you want to back up as part of this protection policy.

If the namespace that you want to protect is not listed, perform one of the following:

a. Click Find More Assets to perform an updated discovery of the Kubernetes cluster.
b. Use the Search box to search by asset name.

6. (Optional) For the selected namespaces, click the link in the PVCs Excluded column, if available, to clear any PVCs that you want to exclude from the backup. By default, all PVCs are selected for inclusion.

7. Click Next. The Schedule page appears.
8. On the Schedule page, click + Backup to create a schedule.
9. On the Add Primary Backup page, specify the backup schedule fields, and then click OK:
 

• Recurrence -> Specify how often backups occur.
• Create Every -> Specify how often to create a synthetic full backup.

 

• Keep For -> Specify the retention period for the backup.
• Start Time -> Specify the time of day to start initiating backups.
• End Time -> Specify the time of day to stop initiating backups.

10. Click Next. The Summary page appears.
11. Review the protection policy group configuration details, and then click Finish.
12. Click OK to exit the window, or click Go to Jobs to open the Jobs window.

From the Jobs window, you can monitor the progress of the new Kubernetes cluster protection policy backup and
associated tasks. You can also cancel any in-progress or queued job or task.


When the new protection policy is created and assets are added to the protection policy, PowerProtect Data Manager performs backups according to the Backup Schedule.
 

Manual Backups of Protected Assets.

Once assets have been added to a protection policy, you can perform manual backups by using the Protect Now functionality in the PowerProtect Data Manager UI.

You can use a single manual backup from the Protection > Protection Policies window to back up multiple assets that are protected in the designated protection policy. 

To perform this manual backup:
 

1. From the PowerProtect Data Manager UI, select Protection > Protection Policies
2. Select the protection policy that contains the assets that you want to back up, and click Protect Now.
3. On the Assets Selection page, select whether you want to back up all assets Or choose individual assets that are defined in the protection policy, and then click Next.
4. On the Configuration page, select Back up now, and then select from the available backup types.
5. You can Edit the retention period if you want to change the default settings, and then click Next.
6. On the Summary page, Review the settings and then click Protect Now. 

You can also perform a manual backup from the Infrastructure > Assets window, but only for one asset at a time.

To perform this manual backup:

1. From the PowerProtect Data Manager UI, select Infrastructure > Assets.
2. Select the Kubernetes tab for the asset type you want to back up. A list of assets appears.
3. Select an asset from the table that has an associated protection policy.
4. Click Protect Now. 

If the backup fails with the error Failed to create Proxy Pods. Creating Pod exceeds safeguard limit of
10 minutes, verify that the CSI driver is functioning properly, such that the driver can create snapshots and a PVC from the VolumeSnapshot datasource. Also, ensure that you clean up any orphan VolumeSnapshot resources that still exist in the namespace.

Please refer this video: