Upgrade Portworx Backup in air-gapped environment

Prerequisites

• Make sure all the MongoDB pods are in Ready state

If you are in an air-gapped environment, then follow the steps below to upgrade Portworx Backup from the prior versions to 2.8.1:

1. To pull the Docker images listed in Air-gapped install and push them to an internal registry:

   a. Download the pxcentral-ag-install-backup.sh air-gapped bootstrap Portworx Backup install script:

   curl -o pxcentral-ag-install-backup.sh -L "https://install.portworx.com/pxcentral-air-gapped?px-backup=true"

   You can also download the install script for a specific release by specifying version in the query.

   For example:

   curl -o pxcentral-ag-install-backup.sh -L "https://install.portworx.com/pxcentral-air-gapped?version=2.8.1&px-backup=true"

   b. Provide execute permission for the install script:

   chmod +x pxcentral-ag-install-backup.sh

   c. Pull the container images using the pxcentral-ag-install-backup.sh script:

   ./pxcentral-ag-install-backup.sh pull

   d. Push the images to a local registry server, accessible by the air-gapped nodes. Replace <repo> with your registry location:

   ./pxcentral-ag-install-backup.sh push <repo>

2. To generate the customized values-px-central.yaml for Portworx Backup installation spec (Helm command):
   

   a. Access Portworx Central portal.
   

   b. From the home page, navigate to Backup Services under Explore our Products.
   

   c. Click I agree to EULA and go through the Portworx Products Terms of Use carefully.
   

   d. Navigate back to the Portworx Central portal and click Start Free Trial.
   

   e. In the Spec Details provide the following values:

   1. Backup Version: select the required version of Portworx Backup from the drop-down list

   2. Namespace: provide the name of the namespace where you want an instance of Portworx Backup to be installed

   3. Install using: choose Helm 3

   4. Select your environment: choose On-Premises or Cloud based on your storage environment

   5. StorageClass Name: name of the StorageClass, refer tooltip for more details

   6. Use your OIDC: Select this option only if your external authorization provider is Auth0 and key in the following fields:

      1. Endpoint
      2. Client ID
      3. Client Secret

      These values can be fetched from the Auth0 web console.

   7. Use existing Prometheus: select this checkbox if you have to use your existing Prometheus stack to monitor Portworx Backup and enter the values for the following fields:

      1. Prometheus Endpoint: enter details of the endpoint where your Prometheus is installed
      2. Alertmanager Endpoint: enter details of the endpoint where your Alertmanager is installed
      3. Prometheus secret name: enter secret name of your Prometheus stack
      4. Alertmanager secret name: enter secret name of your Alertmanager
      5. Custom email template from PX-Backup: select to upload Portworx Backup's custom email template to your pre-configured Alertmanager for email notifications

   8. Use custom registry: for air-gapped environments

      1. Custom Image Repository Location: path of custom image repository
      2. Image Pull Secret(s): create a secret only if image pulling from an internal repository requires credentials
      note

      Create a secret only if pulling image from an internal repository requires credentials.

3. Click Next to navigate to Finish tab.

4. Under Step 2 in the web console, click values-px-central.yaml file to download the default options.

5. Retrieve all custom values you used during the Portworx Backup installation. Enter the following helm get values command to generate a YAML file, replacing the <namespace> and <release-name> parameters to match your environment:

   helm get values --namespace <namespace> <release-name> -o yaml> values.yaml

6. Append the following text to values.yaml at the end of images section:

   mysqlInitImage:
     registry: <custom-registry-path>
     repo: <custom-repo-path>
   preUpgradeHookImage:
     registry: <custom-registry-path>
     repo: <custom-repo-path>
   mongodbImageMap:
     registry: <custom-registry-path>
     repo: <custom-repo-path>

7. Modify the values-px-central.yaml downloaded from Portworx Central portal in Step 4 with the changed values from values.yaml.

   For example, replace storage class value in values-px-central.yaml with that of values.yaml.

8. (Optional) Delete the Prometheus operator deployment upgrade to avoid conflicts:

   kubectl delete deploy prometheus-operator -n <px-backup namespace>
   note

   Execute this step only if you have configured Prometheus and Grafana following the steps mentioned in the topic Configure Prometheus and Grafana.

9. Delete the post install hook job:

   kubectl delete job pxcentral-post-install-hook --namespace <namespace>

10. From the machine where you run the helm3 command:

    a. Download the latest px-central package with the following command.

    curl -O  https://raw.githubusercontent.com/portworx/helm/master/stable/px-central-2.8.1.tgz

    b. Modify the Helm command generated from Step 2 of web console to provide the helm package, instead of providing the repository. Also ensure that, you update the helm command timeout parameter to 120m without fail as shown in the following command:

    helm upgrade px-central px-central-2.8.1.tgz --namespace <name of namespace> --create-namespace --version 2.8.1 -f values-px-central.yaml --timeout=120m
    note

    Portworx Backup supports object lock from release version 2.2.0. For more information, refer to S3 Object Lock in Portworx Backup. You need the permissions listed below to check if the bucket configured in the backup location supports object lock. If you are upgrading to Portworx Backup 2.2.0 from any lower version, ensure that the following object lock related permissions are enabled in the AWS web console:

    • s3:GetBucketObjectLockConfiguration
    • s3:GetObjectLegalHold
    • s3:GetObjectRetention

Access permissions in Portworx Backup 2.x.x

Users with admin role can access the following resources in the Portworx Backup web console:

• Can view and backup clusters that you added
• Can view all user created backups in the Backups page
• Can view all Portworx backup security objects such as cloud credentials, backup locations, schedule policies, and backup rules of all users
• Cannot view all non-Portworx Backup User Management objects

The access permissions available to a user in case of backup sync are:

• If a user is the owner of a bucket, then the Backups page lists backups of all users who used that bucket

• If a user is a collaborator, then the user can view own backups only