PowerProtect Data Manager 19.15 Kubernetes User Guide

Protection policies for Kubernetes namespace protection

Protection policies define sets of objectives that apply to specific periods of time. These objectives drive configuration, active protection, and copy-data-management operations that satisfy the business requirements for the specified data. Each policy type has its own set of user objectives.

Only the Administrator role can create or edit protection policies.

The next topics discuss protection policy terminology, concepts, and available options for planning protection policies. All protection policies require a primary backup or retention objective. The remaining objectives are optional.

A Kubernetes protection policy enables you to select namespaces in the Kubernetes cluster that you want to back up. When PowerProtect Data Manager backs up a Kubernetes namespace, the following items are included in the protection policy backup:

• Kubernetes resources, in addition to the contents of the persistent volumes bound to PVCs in that namespace. Kubernetes resources are backed up using Velero. Upstream Kubernetes resources such as Deployments, StatefulSets, DaemonSets, Pods, Secrets, ConfigMap, Custom Resources, Service, ServiceAccount, Role, and RoleBinding are backed up as part of the Kubernetes resources.
• Cluster resources are backed up automatically as part of the Kubernetes protection policy. These resources include cluster roles, cluster role bindings, and custom resource definitions (CRDs) that are associated with namespace-scoped resources.

  Any CRDs that are associated with the namespace are only backed up if a corresponding Custom Resource for that CRD exists in the namespace.

• For OpenShift, OpenShift-specific resources such as DeploymentConfig, BuildConfig, and ImageStream are also protected using the Velero OpenShift plug-in.

  Container images are not protected as part of the ImageStream resource.