Skip to main content
Version: 3.1

Install from AWS Marketplace

Applicable to Classic mode only

You can install Portworx Backup from the Amazon Web Services (AWS) Marketplace in your AWS account. After installation, you can use the same account to send metering data to AWS. You can also back up and restore applications and Portworx Backup data for any Amazon Elastic Kubernetes Service (EKS) cluster.

Prerequisite​

Ensure that the following prerequisites are met before you install Portworx Backup from AWS Marketplace:

  • AWS Marketplace subscription: Subscribe to Portworx Backup in the AWS Marketplace before proceeding. Without an active subscription, the Helm install will fail at the metering step.

  • AWS Load Balancer Controller: The AWS Load Balancer Controller must be installed on your EKS cluster. It is required to provision the Application Load Balancer (ALB) used for UI access. Without it, the hostname for the Portworx Backup UI will never appear after installation.

  • IAM permissions for the installing user: The AWS user or role running the eksctl commands must have the following IAM permissions:

    • iam:CreateOpenIDConnectProvider
    • iam:CreateRole
    • iam:AttachRolePolicy
    • eks:DescribeCluster

    Without these permissions, the eksctl utils associate-iam-oidc-provider and eksctl create iamserviceaccount commands will fail.

  • Configure IAM permissions with EKS cluster.

    Create an IAMServiceAccount for Portworx Backup and configure it with permissions for EKS cluster to send metering data to AWS:

    1. Enable the IAM OIDC Provider for your EKS cluster. Replace the <region> and <clustername> parameters to match your environment.
    eksctl utils associate-iam-oidc-provider --region=<region> --cluster=<clustername> --approve
    1. Update the existing IAMServiceAccount or create a local service account for Portworx Backup, and link it to your EKS cluster.
      Change the namespace if you are not deploying the Portworx Backup instance, and replace the <clustername> with your EKS cluster.
    note

    The <pxb-namespace> must exist before running this command. Create it first with kubectl create namespace <pxb-namespace> if it does not already exist.

    eksctl create iamserviceaccount --name px-backup-account --namespace <pxb-namespace> --cluster <clustername> --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess \
    --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage --approve --override-existing-serviceaccounts

  • Add Stork environment variable to point to the AWS image repository

    For each EKS application cluster that you add to Portworx Backup, you must include the MARKET_PLACE=aws environment variable so that Stork uses the AWS Marketplace image registry. For supported Stork versions, see the compatibility matrix.

    Add the following environment variable to the Stork deployment (or to the StorageCluster spec under spec.stork.env if using the Portworx Operator):

    - name: MARKET_PLACE
      value: aws

    Stork uses this environment variable to pick the appropriate Kopia executor image from the AWS Marketplace repository.

Procedure​

To install Portworx Backup from AWS Marketplace using the px-central Helm chart, follow these steps:

  1. Add the Portworx AWS Helm chart:

    helm repo add aws-portworx https://raw.githubusercontent.com/portworx/aws-helm/master/stable

  2. Install Portworx Backup using the Helm chart.

    helm install <release-name> aws-portworx/px-central --namespace <pxb-namespace> --set persistentStorage.enabled=true,persistentStorage.storageClassName=gp2,pxbackup.enabled=true --create-namespace
    note

    The example above uses the gp2 storage class. On EKS clusters running Kubernetes 1.23 or later, the default storage class is gp3. Replace gp2 with gp3 (or the name of your cluster's default storage class) if gp2 is not available in your environment.

    Replace:

    • <release-name> with a unique name for this Helm release (for example, px-central). This is the Helm release name, not the Portworx Backup version.
    • <pxb-namespace> with the namespace where you want to deploy Portworx Backup.

    For information about the configurable parameters, see Portworx Backup Helm chart reference.

    note

    You can override the default administrator password, and set a custom password to access the Portworx Backup web console using the oidc.centralOIDC.defaultPassword option.

What to do next​

  • Install Stork on all application clusters.
    For information about installing Stork, see Stork installation.
    For information about Stork and Portworx Backup compatibility, see Stork compatibility matrix.

  • Access Portworx Backup UI using load balancer endpoint
    In addition to accessing Portworx Backup from the CLI, you can access it on a Web browser using the load balancer endpoint.
    To access Portworx Backup UI using load balancer endpoint, follow these steps:

    1. Get the load balancer endpoint for Portworx Backup using one of the following commands:

      kubectl get svc --namespace <pxb-namespace> px-backup-ui -o jsonpath="{.status.loadBalancer.ingress[0].hostname}"
      kubectl get svc --namespace <pxb-namespace> px-backup-ui -o jsonpath="{.status.loadBalancer.ingress[0].ip}"

    2. Access Portworx Backup and Keycloak using the endpoint:

      • Portworx Backup: http://<LB_endpoint>
      • Portworx Backup Keycloak: http://<LB_endpoint>/auth
    caution

    These http:// endpoints expose the administrative console and Keycloak over unencrypted HTTP, which causes credentials and API traffic to be transmitted in plaintext. Use HTTP only for temporary access on a trusted, private network. For secure access, use TLS by terminating it at the load balancer or exposing the UI through an ingress configured with HTTPS. For details, see Configure Access to Portworx Backup Web Console.

    note

    After running the kubectl get svc commands, allow a few minutes for the AWS load balancer to become active. If the hostname field is empty, the load balancer may still be provisioning. Verify that the px-backup-ui service has an external hostname assigned before attempting to access the UI. You can watch the status with:

    kubectl get svc px-backup-ui -n <pxb-namespace> -w

Uninstall Helm chart​

To uninstall the Helm chart, follow these steps:

  1. Uninstall the Helm chart. Use the same <release-name> you chose during installation (step 2 of the procedure); it is not necessarily px-central. To find the release name, run helm list --namespace <pxb-namespace>:

    helm uninstall <release-name> --namespace <pxb-namespace>

  2. (Optional, destructive) Delete the namespace only if you want to remove Portworx Backup and all of its data:

    kubectl delete ns <pxb-namespace>
    caution

    The kubectl delete ns command permanently deletes all resources in the namespace, including pxc-credentials, other Secrets, and the PVCs that store MongoDB, MySQL, and PostgreSQL data. This action is irreversible and results in the loss of Portworx Backup metadata. Skip this step if you plan to reinstall Portworx Backup or retain the existing data. If the namespace contains other workloads, delete only the Portworx Backup resources instead of deleting the entire namespace.

Last updated on
In this topic: