PowerProtect Data Manager 19.12 Kubernetes User Guide

Set up the velero-plugin-for-vSphere in the Supervisor cluster

The following one-time configuration is required to set up the velero-plugin-for-vSphere in the Supervisor cluster:

1. For vSphere versions 7.0 U3 and later, install the Velero vSphere Operator in the Supervisor cluster:
   1. In the vSphere Client, select a user with the vSphere Administrator role, or an account with the following vSphere privileges:
      • SupervisorServices.Manage
      • Namespaces.Manage
      • Namespaces.Configure
   2. Select Workload Management, and then click the Services tab in the right pane.
      The right pane displays the available services.
   3. Select Add a New Service.
   4. In the Supervisor cluster version 1.21 and earlier, upload the Velero vSphere Operator Supervisor 1.1.0 YAML. In the Supervisor cluster version 1.22 and later, upload the Velero vSphere Operator Supervisor 1.2.0 YAML. Operator YAML files can be obtained from the following link.
   5. After the Velero vSphere Operator Supervisor service is added, install the service on the Supervisor cluster.
      Once installed, a new namespace svc-velero-vsphere-domain-xxx gets created automatically with vSphere pods. The Velero vSphere Operator service works with the velero-plugin-for-vSphere to support backup and restore of Kubernetes workloads, including the snapshotting of persistent volumes.

      To verify the Velero vSphere Operator installation, from the vSphere Client home menu, select Inventory, and then select the vCenter cluster where Workload Management is enabled. Select Configure > vSphere Services > Overview, and confirm that the Velero vSphere Operator is installed and its status is Configured.

   6. Select Menu > Workload Management to view the namespaces running in the Supervisor cluster. For a selected namespace, click the Compute tab in the right pane to display the vSphere pods and Tanzu guest clusters.
2. For vSphere versions previous to 7.0 U3, enable the vSphere Operator in the Supervisor cluster, for example, the Velero vSphere Operator:
   1. In the left pane of the vSphere Client, select Workload Cluster, and then click the Configure tab in the right pane.
   2. In the Workload-Cluster window, scroll down and select Supervisor Services.
      The right pane displays the available services.
   3. Select the Velero vSphere Operator service, and then click Enable.
      Once enabled, the new Kubernetes namespace gets created automatically with its own vSphere pods running with Supervisor affinity, which allows the Supervisor cluster to perform backups using the FCD snapshot.
3. Add a Supervisor namespace for the Velero instance. This namespace is required for the velero-plugin-for-vSphere:
   1. In the Workload Management window of the vSphere Client, click New Namespace to create a namespace with the name velero.
   2. After creating this namespace, select the namespace in the left navigation pane and configure storage and permissions.
   3. Specify the storage for the velero namespace.
   4. Provide the appropriate vCenter user with the edit permission/role on the velero namespace.
4. Download the command line binary:
   • For the Supervisor cluster version 1.21 and earlier, download the command line binary Velero vSphere Operator CLI v1.1.0.
   • For the Supervisor cluster version 1.22 and later, download the command line binary Velero vSphere Operator CLI v1.2.0.
5. Log in to the Supervisor cluster:
   1. In the vSphere Client, navigate to vSphere Cluster > Namespaces, and select the Supervisor namespace. Select the Summary tab, and then select Open under Link to CLI Tools to download the two executable files kubectl (the standard Kubernetes CLI) and kubectl-vsphere (the vSphere Plugin for kubectl). These files help you to authenticate with the Supervisor Cluster and Tanzu Kubernetes clusters using your vCenter Single Sign-On credentials. These instructions are also provided in the following article.
   2. Log in to Supervisor cluster by using the following command with the appropriate vCenter user:
      kubectl-vsphere login --insecure-skip-tls-verify --server=supervisor-cluster-ip-address -- vsphere-username username
6. Switch the context to the Supervisor cluster by running the following command:
   kubectl config use-context supervisor-cluster-ip-address
7. Use the Velero vSphere Operator CLI to install the velero-plugin-for-vSphere into the velero namespace:
   • For Supervisor cluster version 1.21 and earlier, run velero-vsphere install --namespace velero --plugins vsphereveleroplugin/velero-plugin-for-vsphere:v1.4.0 --no-secret --no-default-backup-location --use-volume-snapshots=false
   • For Supervisor cluster version 1.22 and later, run velero-vsphere install --namespace velero --plugins vsphereveleroplugin/velero-plugin-for-vsphere:v1.4.0 --image velero/velero:v1.8.1 --no-secret --no-default-backup-location --use-volume-snapshots=false
8. Using the same command line, enable changed block tracking (CBT) in the guest clusters:
   # velero-vsphere configure --enable-cbt-in-guests
   Once enabled, this setting is applied to the current cluster and all incoming guest clusters.

   NOTE In Tanzu Kubernetes clusters with vSphere version 7.0 U2 and later, the command to enable CBT might return the error Failed to configure CBT on all VMs in guest clusters. If this occurs, verify that you have logged in to the Supervisor cluster as a vCenter admin, and then perform the following steps:

   1. Edit the ConfigMap vmware-system-tkg-system-service-accounts in the vmware-system-tkg namespace on the Supervisor cluster to add the following line:

      'system.serviceaccount.service-account-name.default: "true"'

      Where the service-account-name matches the name of the namespace that is created after the Velero operator installation. To obtain this name (svc-velero-vsphere-domain-xyz), you can log in to the vSphere Client, or use the command kubectl get ns | grep svc-velero-vsphere.

   2. Restart the TKGS controller by running the command kubectl rollout restart deployment vmware[1]system-tkg-controller-manager -n vmware-system-tkg.

   3. Retry the command velero-vsphere configure --enable-cbt-in-guests.

   4. Optionally, verify that CBT is enabled in guest cluster virtual machines in a Supervisor namespace by running the following command:

      kubectl get virtualmachine -n guest-cluster-namespace

      If CBT is enabled, the following command returns the value TRUE:

      kubectl get virtualmachine guest-cluster-node-VM-name -n guest-cluster-namespace -o jsonpath='{.status.changeBlockTracking}'

9. Verify that the velero-plugin-for-vSphere installation was successful by running the following command:
   kubectl -n velero get veleroservice default -o json | jq '.status'

   A successful installation displays a status of Completed, along with the version.