- Notes, cautions, and warnings
- Preface
- PowerProtect Data Manager for Kubernetes Overview
- About asset sources, assets, and storage
- Prerequisites
- Supported Internet Protocol versions
- Encryption in-flight
- Roadmap for Kubernetes cluster protection
- Roadmap for Tanzu Kubernetes guest cluster protection
- Updating PowerProtect Data Manager from version 19.13 or earlier to the latest version in a Kubernetes environment
- Security configuration
- Enabling the Kubernetes Cluster
- Adding a Kubernetes cluster asset source
- Prerequisites to Tanzu Kubernetes guest cluster protection
- Prerequisites to Kubernetes cluster discovery
- Enable an asset source
- Delete an asset source
- Add a VMware vCenter Server
- Add a Kubernetes cluster
- Controller Configurations
- Customizing the PowerProtect Data Manager pod configuration
- Add a VM Direct Engine
- Managing Storage, Assets, and Protection for Kubernetes Clusters
- Protection policies for Kubernetes namespace protection
- Supported protection policy purposes
- Supported protection policy objectives
- Replication triggers
- Roadmap for planning a protection policy
- Before you add a protection policy for Kubernetes namespace protection
- Add a protection policy for Kubernetes namespace protection
- Extended retention for protection policies created in PowerProtect Data Manager 19.11 or earlier
- Add a service-level agreement
- Protection rules
- Edit the retention period for backup copies
- Delete backup copies
- Using the PowerFlex volumegroup snapshot extension
- Protecting PVCs in PowerScale access zones
- Protection policies for Kubernetes namespace protection
- Restoring Kubernetes Namespaces and PVCs
- Kubernetes Cluster Best Practices and Troubleshooting
- PPDMK8SDIAG diagnostics tool
- Configuration changes required for use of optimized data path and first class disks
- Recommendations and considerations when using a Kubernetes cluster
- Support Network File System (NFS) root squashing
- Update the Velero or OADP version used by PowerProtect Data Manager
- VM Direct protection engine overview
- Troubleshooting network setup issues
- Troubleshooting Kubernetes cluster issues
- Restore to original cannot be completed when datastore containing FCD is shared across vCenters
- Specify volumesnapshotclass for v1 CSI snapshots
- Enabling protection when the vSphere CSI driver is installed as a process
- Considerations when protecting nonsnapshot CSI volumes
- Pod configuration not updated in Velero deployment when field is omitted from patch string
- Backups fail or hang on OpenShift after a new PowerProtect Data Manager deployment
- Restore of imagestream and imagestreamtags cannot be completed on OpenShift
- Data protection operations for high availability Kubernetes cluster might fail when API server not configured to send ROOT certificate
- Kubernetes cluster on Amazon Elastic Kubernetes Service certificate considerations
- Removing PowerProtect Data Manager components from a Kubernetes cluster
- Increase the number of worker threads in Supervisor cluster backup-driver if Velero timeout occurs
- Velero pod backup and restore might fail if namespace being protected contains a large number of resources
- vSphere CSI backups might fail when the File System agent is used as the data mover
- Pull images from Docker Hub as authenticated user if Docker pull limits reached
- Warning displays when temporary persistent volumes not deleted by CSI driver before timeout
- Application-Consistent Database Backups in Kubernetes
- About application-consistent database backups in Kubernetes
- Obtain and deploy the CLI package
- About application templates
- Deploy application templates
- Perform application-consistent backups
- Verify application-consistent backups
- Disaster recovery considerations
- Granular-level restore considerations
- Log truncation considerations
- Glossary
PowerProtect Data Manager 19.15 Kubernetes User Guide
Restoring a Kubernetes namespace
After namespace contents are backed up as part of a Kubernetes cluster protection policy in the PowerProtect Data Manager UI, you can perform restores from individual namespace backups.
All types of restore are performed from the window. Restore options include the following:
- Restore to Original: Restore to the original namespace on the original cluster.
- Restore to New: Create a namespace, and restore to this location on the original cluster or a different cluster.
- Restore to Existing: Restore to an existing namespace in the original cluster or a different cluster.
The Restore button, which launches the Restore wizard, is disabled until you select a namespace in the window.
Select a namespace and then click Restore to launch the Restore wizard. Alternatively, you can select a namespace and then click View Copies.
In both instances, you must select a backup in the first page of the Restore wizard before proceeding to the Purpose page, which displays the available restore options.
NOTE: Manually replicating backups to
DD storage will not create PCS records in
PowerProtect Data Manager. It is recommended to perform these backups on the local tier, as a
Cloud Tier backup requires a recall operation.
Restore considerations
Review the following information and considerations for awareness prior to performing a Kubernetes namespace or PVC restore.
When PVCs are being used by a job that runs for a long time (for example, a job that spawns pods to download/ upload large content to or from a server), restores might not complete successfully. Performing a restore to original or restore to existing for Kubernetes PVCs requires that all objects using the PVCs be shut down.
Restoring Kubernetes asset backups to an earlier Kubernetes cluster version is not supported. For example, if the backup was performed on a Kubernetes cluster version 1.20, you cannot restore this backup to a cluster version earlier than 1.20.
Namespaces that were backed up in OpenShift distributions cannot be restored to other Kubernetes distributions.
If the cluster applies a restricted security policy to the namespace being restored, then a security policy that has readOnlyRootFilesystem set to false and runAsUser set to RunAsAny must be used.
NOTE:If you are restoring to a non-VMware CSI volume or to any volume that does not have a
ppdm-serviceaccount service account in the target namespace, the
default service account is used. If you do not want to bind the
default service account to a security policy with
readOnlyRootFilesystem set to
false and
runAsUser set to
RunAsAny, then create a
ppdm-serviceaccount service account for this purpose.
For Kubernetes clusters on vSphere, the custom resources that are listed in https://github.com/vmware-tanzu/velero-plugin-for-vsphere/blob/main/docs/supervisor-notes.md are excluded during restore.
When restoring PVCs to the original or an existing namespace, PowerProtect Data Manager scales down the pods using the PVC being restored. If the application running in the namespace being restored is managed by an operator, the operator might interfere with the PowerProtect Data Manager scale down operation. In such scenarios, scale down the operators manually before performing the restore, and then scale back up after the restore is complete.
When performing a restore to a new namespace in the PowerProtect Data Manager UI, you can choose a different storage class for some of the PVCs being restored, depending on the provisioner. For example, you can restore a PVC from a Ceph CSI storage class to a PowerFlex CSI storage class. Changing the storage class can be useful in the following scenarios:
- When restoring PVCs and namespaces from one cluster to another cluster that uses different storage.
- When migrating data from one storage class to another, for example, when retiring the back-end storage.
- When migrating data between on-premises storage and cloud storage.
When selecting a storage class, some non-CSI storage classes that are not supported might be displayed for selection, such as vSphere volumes.
NOTE:If the PVC being restored already exists in the target cluster, the storage class of the existing PVC is not changed upon restore. Also, restore from a vSPhere CSI storage class to other CSI storage classes is not supported.
When restoring a nonsnapshot Container Storage Interface (CSI) storage volume to an alternate storage class, ensure that the target storage class supports the access mode of the backed-up PVC. For example, if the backed-up PVC has an access mode of RWX, the target storage class must support RWX mode.
When restoring Kubernetes resources that are controlled by a webhook, changes might be required to the webhook configuration to successfully perform the restore. For example, the application appconnect.ibm.com contains an admission controller webhook mutate.configuration.upsert.appconnect.ibm.com that can prevent Velero restores. In such scenarios, review the application documentation for more information about making changes to the webhook configuration.
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\