PowerProtect Data Manager 19.11 Kubernetes User Guide

Only native Kubernetes resources are supported for protection in PowerProtect Data Manager

PowerProtect Data Manager supports protection of native Kubernetes resources only. If a namespace contains any Kubernetes distribution-specific resource or any other kind of custom resource, backup and recovery operations might fail. Therefore, ensure that you do not include such namespaces in PowerProtect Data Manager Kubernetes protection policies.

Application pods might not appear in running state after restore when restoring to a new namespace with a different name

When performing a Kubernetes restore to a new namespace that has a different name than the namespace the backup copy was created from, the application pods might not appear in running state after restore in some scenarios. For example, this can occur if the application has environment variables or other configuration elements that adhere to the namespace from which the backup copy was created, such as variables that point to services using FQDN in the form my-svc.my-namespace.svc.cluster-domain.example or headless services using FQDN in the form pod-name.my-headless-svc.my-namespace.svc.cluster-domain.example.

If this issue occurs, manually edit the deployments after the restore.

Backups of persistent volumes on FCD fail when VMware CSI driver and storageclass are installed after Kubernetes cluster asset source is added

The PowerProtect controller configures itself and Velero for the protection of persistent volumes on first class disks (FCDs) if the controller detects a storage class with the VMware CSI provisioner csi.vsphere.vmware.com. If the VMware CSI driver and storageclass are installed after the Kubernetes cluster is added as an asset source to PowerProtect Data Manager, FCD backups fail with an error indicating failed to create backup job.

To resolve this issue, restart the PowerProtect controller by running the following commands:

kubectl get pod -n powerprotect

kubectl delete pod pod name obtained above -n powerprotect

ApplicationTemplate considerations when performing Kubernetes cluster disaster recovery

When performing a Kubernetes cluster disaster recovery, if any changes were made to ApplicationTemplate, the Kubernetes administrator will need to recreate the ApplicationTemplate in the PowerProtect Data Manager namespace.

The section Disaster recovery considerations provides more information.

Pods in pending state due to missing PVC cause namespace backups to fail

If a Kubernetes namespace contains a pod that is in pending state because the pod references a PVC that is not present, the backup of that namespace will fail.

To resolve this issue, perform one of the following:

• Create the missing PVC, or
• Delete the pod if it is no longer required.

Troubleshooting Velero or Controller pod failures

The PowerProtect Data Manager Velero or Controller pod might fail to start, for example, due to a deployment failure or a bad image URI. If one of these pods fails to start, an alert appears indicating that the pod is not running on the cluster.

If the PowerProtect Data Manager Controller pod is not running, run the following command:

kubectl describe pod -n powerprotect

If the PowerProtect Data Manager Velero pod is not running, run the following command:

kubectl describe pod -n velero-ppdm

Errors or events in the command output enable you to determine why the failure occurred.

Verify CSI driver functioning properly if "Failed to create Proxy Pods" error appears during restore

If the restore fails with the error Failed to create Proxy Pods. Creating Pod exceeds safeguard limit of 10 minutes, verify that the CSI driver is functioning properly and is able to dynamically provision volumes.

Add alternate storage class mapping if mismatch between original cluster and target cluster for restore (API restore only)

When restoring to a different cluster using the API, the storage class of the target cluster might not have the same name and underlying storage provider as the original cluster of the namespace backup. If there is a mismatch, then the restore fails.

To add an alternate storage class mapping for restores performed via the API, complete the following steps:

1. Create a ConfigMap ppdm-restore-storage-class-mapping in the PowerProtect namespace on the target cluster for the restore.
2. In the data section of the ConfigMap, add a storage class mapping in the following format:

   old storage class: new storage class

   For example, if all PVCs that were backed up using the storage class csi-hostpath-sc will be restored to a cluster using the storage class xio-csi-sc, type:

   csi-hostpath-sc: xio-csi-sc

Add alternate storage class mapping for temporary PVCs created from snapshot during non-FCD backup

In some scenarios, the storage class of the PVC being backed up might not be the most appropriate storage class for the temporary PVC created from the snapshot during the backup. For example, when creating a volume from a snapshot, a dedicated storage class that does not allocate space for the temporary PVC might be preferred. This can be useful for backing up NFS PVs and use a storageclass with rootclient enabled.

To add an alternate storage class mapping for temporary PVCs, perform the following:

1. Create a ConfigMap ppdm-snapshot-storage-class-mapping in the PowerProtect namespace.
2. In the data section of the ConfigMap, add a storage class mapping in the following format:

   storage class of PVC being backed up: storage class to use for snapshot PVC

   For example, in the mapping xio-csi-sc: xio-csi-sc-snapshot-promoter, if the PVC being backed up uses the storage class xio-csi-sc, the snapshot PVC will be created using the storage class xio-csi-sc-snapshot-promoter.