- Notes, cautions, and warnings
- Preface
- PowerProtect Data Manager for Kubernetes Overview
- About asset sources, assets, and storage
- Prerequisites
- Supported Internet Protocol versions
- Port usage
- Role-based security
- Data-in-flight encryption
- Roadmap for Kubernetes cluster protection
- Roadmap for Tanzu Kubernetes guest cluster protection
- Updating PowerProtect Data Manager from version 19.9 or earlier to the latest version in a Kubernetes environment
- Enabling the Kubernetes Cluster
- Adding a Kubernetes cluster asset source
- Prerequisites to Tanzu Kubernetes guest cluster protection
- Prerequisites to Kubernetes cluster discovery
- Enable an asset source
- Delete an asset source
- Add a VMware vCenter Server
- Add a Kubernetes cluster
- Controller Configurations
- Add a VM Direct Engine
- Protection engine limitations
- Managing Storage, Assets, and Protection for Kubernetes Clusters
- Add protection storage
- Replication triggers
- Add a protection policy for Kubernetes namespace protection
- Add a Cloud Tier objective to a protection policy
- Add a service-level agreement
- Extended retention
- Edit the retention period for backup copies
- Delete backup copies
- Using the PowerFlex volumegroup snapshot extension
- Protecting PVCs in PowerScale access zones
- Restoring Kubernetes Namespaces and PVCs
- Kubernetes Cluster Best Practices and Troubleshooting
- Configuration changes required for use of optimized data path and first class disks
- Recommendations and considerations when using a Kubernetes cluster
- Support Network File System (NFS) root squashing
- Update the Velero or OADP version used by PowerProtect Data Manager
- VM Direct protection engine overview
- Troubleshooting network setup issues
- Troubleshooting Kubernetes cluster issues
- Specify volumesnapshotclass for v1 CSI snapshots
- Enabling protection when the vSphere CSI driver is installed as a process
- Customizing PowerProtect Data Manager pod configuration
- Backups fail or hang on OpenShift after a new PowerProtect Data Manager installation or update from a 19.9 or earlier release
- Data protection operations for high availability Kubernetes cluster might fail when API server not configured to send ROOT certificate
- Kubernetes cluster on Amazon Elastic Kubernetes Service certificate considerations
- Removing PowerProtect Data Manager components from a Kubernetes cluster
- Increase the number of worker threads in Supervisor cluster backup-driver if Velero timeout occurs
- Velero pod backup and restore might fail if namespace being protected contains a large number of resources
- Pull images from Docker Hub as authenticated user if Docker pull limits reached
- Application-Consistent Database Backups in Kubernetes
- About application-consistent database backups in Kubernetes
- Obtain and deploy the CLI package
- About application templates
- Deploy application templates
- Perform application-consistent backups
- Verify application-consistent backups
- Disaster recovery considerations
- Granular-level restore considerations
- Log truncation considerations
PowerProtect Data Manager 19.11 Kubernetes User Guide
Data protection operations for high availability Kubernetes cluster might fail when API server not configured to send ROOT certificate
If the Kubernetes cluster is set up in high availability mode and the Kubernetes API server is not configured to send the ROOT certificate as part of the TLS communication setup, backup and restore operations might fail with the following error:
javax.net.ssl.SSLHandshakeExcept ion: sun.security.validator.Validator Exception: PKIX path building failed: sun.security.provider.certpath.S unCertPathBuilderException: unable to find valid certification path to requested target
To resolve the error, perform the following steps:
- Copy the root certificate of the Kubernetes cluster to the PowerProtect Data Manager server.
- As an administrator on the
PowerProtect Data Manager server, import the certificate to the
PowerProtect Data Manager trust store by running the following command:
ppdmtool -importcert -alias certificate alias -file file with certificate -type BASE64|PEM
Where:
i or importcert imports the certificate.
a or alias certificate alias is used to specify the alias of the certificate, and certificate alias is in the form hostname:port:root.
f or file file with certificate is used to specify the full path of the file with the certificate.
t or type BASE64|PEM is used to specify the certificate type. The default type is PEM.
NOTE Since the root certificate is in PEM format, this command should not require the type input.
Sample command to import certificate to PowerProtect Data Manager trust store
ppdmtool -importcert -alias apiserver.xyz.com -file root-certificate
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\