Welcome to Dell Technologies PowerProtect Data Manager version 19.7
New Features Series.
How to protect a Tanzu Kubernetes Guest Cluster.
Reference Dell Knowledge Article # 184431.
This video was created to
Describe the Architecture and Configuration
of VMware Tanzu Kubernetes Clusters
with Dell EMC PowerProtect Data Manager
and explain how the VMware vSphere with Tanzu workloads are protected.
This video presents the following
What is vSphere with Tanzu?
Tanzu Kubernetes Guest clusters and Supervisor clusters.
PowerProtect Data Manager Protecting VMware
Tanzu Kubernetes Guest Clusters.
Configuring PowerProtect Data Manager to protect Tanzu Kubernetes workloads.
What is vSphere with Tanzu?
VMware vSphere with Tanzu transforms vSphere clusters into a platform
on which Kubernetes workloads can be run directly on Hypervisor Layer.
As a vSphere administrator
you enable existing vSphere clusters for workload management
thus creating a Kubernetes layer within the ESXi hosts
that are part of the cluster.
Tanzu Kubernetes Guest Clusters and Supervisor Clusters.
When a vSphere cluster is configured for Kubernetes workloads
thus becoming a Supervisor cluster
it adds objects to the vCenter Server inventory
such as Namespaces, vSphere Pods and Tanzu Kubernetes clusters
provisioned using the grid Service.
A Tanzu Kubernetes Cluster runs inside Virtual Machines on the Supervisor layer
and not on vSphere Pods.
And the pods running in the Kubernetes Tanzu Guest cluster
will not have direct access to the supervisor cluster resource.
PowerProtect Data Manager
Protecting VMware Tanzu Kubernetes Guest Clusters.
PowerProtect Data Manager allows IT operators
and backup admins to manage VMware Tanzu clusters
and their protection through a single management UI.
It uses the Discovery Service Account
and the Token to integrate with kubeAPIserver of Kubernetes cluster.
Discovers the Namespaces, Labels and Pods in the Environment.
Once the discovery of cluster completes
the cluster is added as an Asset Source and Associated Namespaces
as Assets are available to be protected.
The cProxy of PowerProtect Data Manager
doesn’t have access to supervisor resources.
PowerProtect Data Manager does not use cProxy for backup and restore process.
However, it utilizes the vProxy Based Protection Solution.
Before you begin.
Before adding a Tanzu Kubernetes guest Cluster in PowerProtect Data Manager
for Namespace and PVC protection
the following one-time configuration is required to set up the Supervisor cluster.
Enable Velero vSphere Operator from the vCenter UI.
Enable Change Block Tracking in Guest Cluster.
Install Velero and Velero-vSphere-Plugin using the Velero-vSphere command line.
In this demo
Configuring PowerProtect Data Manager
to Protect a VMware Tanzu Kubernetes Cluster.
Log into PowerProtect Data Manager UI and select Infrastructure.
Select Asset Sources, enable vCenter and Kubernetes Asset Sources.
Add a VMware vCenter Server that hosts the Tanzu Kubernetes Guest Cluster.
Select vCenter tab and click Add.
In the name field, specify the vCenter Server name
then specify its fully qualified domain name or the IP address.
Under Host Credentials choose an existing vCenter user credentials
or you can add new credentials.
Ensure that you specify the credentials
for a user whose role is defined at the vCenter level.
Then click Save.
If you want to schedule a full discovery at a certain time every day
move the schedule discovery slider to the right, and then specify a time.
Save the configuration and finish.
Now vCenter is added as an Asset Source.
Then, click on the Kubernetes tab
to add Kubernetes cluster and Asset Source.
Click Add.
For Kubernetes Tanzu Guest Cluster
move the slider to the right
and select the vCenter server
that contains the guest cluster from the list.
Under Host Credentials
click Add to add the service account token for the Kubernetes cluster.
The service account must have adequate permissions
and bound to a cluster role.
Then, click Save.
Click Verify to review the certificate and token information.
Save the configuration and finish.
Tanzu Kubernetes cluster is added successfully
and discovery status is “Ok.”
The Namespaces in the cluster
should appear in the Kubernetes tab of the Assets window.
Under the Virtual Machine tab
Virtual Machines are successfully discovered.
Under the Kubernetes tab
Namespaces are now available for protection.
Now, go to Tanzu Kubernetes Cluster command line.
Upon adding the Kubernetes Cluster as an Asset Source
a PowerProtect controller is installed on the cluster
which is also used to install Velero with Data Domain Object Store plugin
and vSphere plugin.
Run kubectl command to list Namespaces.
You can see here, all namespaces in the cluster
including powerprotect and velero-ppdm.
Now, let’s have a look on the pods in each namespace.
Run kubectl command to list pods in namespaces.
The powerproject namespace contains powerproject-controller pod
and velero-ppdm namespace contains velero pod
and backup-driver pod
which is responsible to take and delete snapshots
for parallel virtualized CSI volumes of Tanzu Kubernetes Clusters.
Then, go back to PowerProtect Data Manager UI
to add a VM Direct Engine that is dedicated to Kubernetes workloads.
From Infrastructure, select Protection Engines.
Click Add to add a new engine.
Specify the details for the Protection Engine.
For Supported Protection Type option, select Kubernetes.
Complete the network configuration and review the summary.
Then, finish.
VM Direct Engine is now available under Protection Engines.
Now, we can create a protection policy to protect our guest cluster.
From the Protection menu, select Protection Policies and click Add.
Specify the policy name, select policy type as Kubernetes
and click Next.
Select the purpose of the backup.
Either Crash Consistent to snapshot persistent volumes
bound to the persistent volume claims in the namespace
or Exclusion to exclude in this group
from protection activities and protection rule assistant.
Then, click Next.
In the Assets page, select assets you wish to back up
and click Next.
In the schedule page, click on + Backup to add primary backup.
Select Recurrence as hourly, daily, weekly or monthly
and fill in the details accordingly.
Then, click Ok.
You can either use an existing storage unit
or create a new one.
Click on Select to view available storage units.
Then, click Next.
Verify the provided information is correct under the Summary section
and click on Finish.
To monitor the running configuration jobs, click Go to Jobs.
We have two configuration jobs for the created policy.
Both configuration tasks completed successfully.
PowerProtect Data Manager performs backups according to the backup schedule.
In order to run a manual backup
select the protection policy and click on Protect Now.
You can select some of the assets
or all assets defined in the protection policy.
Then, click Next.
On the configuration page, select from the available backup types
and edit the retention period if you want to change the default settings.
Then, click Next.
Review the settings and click Protect Now.
Go to jobs to monitor the backup progress.
Here, you can see the backup task’s progress.
Backup jobs for both assets are running now.
Backup completed successfully.
To show job details
click the magnifying glass icon in the Details column
next to the job name.
In the Details pane, scroll down until the task summary is visible.
Tasks for both assets completed successfully.
You can view backup copies for each asset.
From infrastructure, select Assets and click Kubernetes tab.
You can filter with policy name.
Select the required asset and click on View Copies.
You can see here the backup copy details.
And if you click on View All, under PVCs Exclusion tab
you will be able to see the volumes included
and excluded from this backup.
Important notes.
Discovery of a Kubernetes cluster
discovers Namespaces that contain volumes from both Container Storage Interface
and non-Container Storage Interface-based storage.
However, backup and recovery are supported
only from Container Storage Interface-based storage.
There should be a minimum of one VM Direct Engine per Supervisor cluster.
Reference the following for more information.
PowerProtect Data Manager 19.7 Administration and User Guide.
And vSphere with Tanzu Configuration and Management Guide.
Thank you for watching.