PowerProtect Data Manager 19.17 Kubernetes User Guide

PDF

Enabling protection when the vSphere CSI driver is installed as a process

PowerProtect Data Manager leverages the vSphere Velero plug-in to protect VMware Cloud Native Storage volumes that use VADP snapshots. To take these snapshots, PowerProtect Data Manager and the Velero plug-in require the location and credentials of the vCenter Server. This information is provided in a VMware CSI driver secret with the name vsphere-config-secret or csi-vsphere-config. This secret must be present in the kube-system or vmware-system-csi namespace.

Some distributions, such as TKGI 1.11 and later, automatically install the CSI driver as a process rather than the method specified in the VMware vSphere Container Storage Plug-in Documentation. If the CSI driver is installed automatically as a process, PowerProtect Data Manager and the Velero plug-in are unable to obtain the CSI secret in the Kubernetes cluster. Without this information, PowerProtect Data Manager is unable to protect these environments.

When you add or edit the Kubernetes cluster asset source in the PowerProtect Data Manager UI, and a VMware CSI driver secret with the name vsphere-config-secret or csi-vsphere-config is not present, move the VMware CSI Driver as process slider to the right under Advanced Settings, and then select the vCenter Server asset source. Add a Kubernetes cluster provides the details for specifying Kubernetes cluster advanced settings. When VMware CSI Driver as process is enabled, PowerProtect Data Manager creates the secret vsphere-config-secret in the powerprotect namespace as part of the discovery process.

NOTE: Due to a Velero vSphere plugin and vSphere CSI driver issue, if there is a backslash (\) or quotation mark (") character contained in the vCenter username or password, those characters must be escaped in the CSI driver secret by adding a backslash in front of them. For example, if the vCenter password is Admin!23\'", then both the backslash and quotation mark characters need to be escaped in the secret, as in: 
password = "Admin!23\\'\""
Single quotation mark (') characters do not need to be escaped. The username should also be in a <username>@<domain> format, instead of <domain>\<username>.

When a vCenter asset source is added for Kubernetes cluster protection only and you do not want PowerProtect Data Manager to discover the asset source, you can use the REST API to create or update the vCenter asset source and set the assetSource flag to false. This property is documented in the "Create an inventory source" topic of the PowerProtect Data Manager Public REST API documentation.

NOTE:When you add the vCenter Server asset source that is associated to this Kubernetes cluster, the following minimum vCenter user privileges are required:
  • Datastore.Low level file operations
  • Tasks.Create task
  • Tasks.Update task
NOTE:You can also provide the vCenter information and credentials to PowerProtect Data Manager optionally using the API. Follow the instructions in the section "Enabling protection when the vSphere CSI driver is installed as a process" under Back up and restore Kubernetes in the PowerProtect Data Manager Public REST API documentation.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\