Veritas CloudPoint Administrator's Guide

About tag-based asset protection

The process of deploying a workload in the cloud is getting easier than in the past. Whether it is a development environment, a simple application instance, or a complex production deployment, virtual instances can be up and running within a few clicks. This ease of provisioning has led to a proliferation in the kinds of workloads and also the number of instances that are getting deployed in the cloud. The challenge is limited not only to the management of such a diverse environment, but also in the implementation of data protection policies in an ever expanding cloud footprint.

CloudPoint makes it easier by automatically discovering all the assets in your cloud environment. The periodic discovery ensures that any addition or deletion of workloads does not go unnoticed and all asset changes remain accounted for. You can easily configure a CloudPoint protection policy and assign it to the desired workloads.

The responsibility of data protection is entirely on the backup and data protection administrators. They need to monitor the number of workloads, determine the kind of data protection that is needed, and ensure that the required workloads are protected by assigning the correct protection policy. Also, if any of the protected workloads no longer exist or are no longer required to be protected, the task of removing that asset from the assigned protection policies also remains with the administrators.

With release 2.2, CloudPoint introduces a feature called as Tag-based asset protection that is designed to automate the data protection policy assignment process. Tag-based asset protection provides an intelligent and automated mechanism to protect assets based on user-defined tags. Tagging is a method where you can use descriptive text labels and assign them to the assets, either during the asset creation or at any time during the active life of the asset. When CloudPoint discovers the assets, it also scans the tags associated with those assets and then automatically assigns a matching pre-defined protection policy to the asset.

During each discovery cycle, CloudPoint checks the asset tags and automatically assigns a matching protection policy to the asset. Similarly, if a tag is removed from an asset, and if that asset is associated with a matching policy, then CloudPoint removes that asset from the policy. Then, the asset is no longer protected by that policy. Tag-based asset protection allows you to assign or unassign protection policies to a large number of assets simultaneously. This eliminates the manual task of navigating through the CloudPoint UI and choosing a protection policy for an asset individually.

CloudPoint stores all the information about configured policies, discovered assets and their associated tags in a MongoDB database. The CloudPoint coordinator service and the policy engine service together make use of this information to control and manage data protection using the tag-based asset protection.

The CloudPoint coordinator keeps a track of all the changes to the assets and their tags. During the CloudPoint discovery cycle, the CloudPoint plug-in sends all the asset data to the coordinator. The coordinator compares this information with the records in the MongoDB database and identifies all the assets and asset tags that are added, modified, or removed since the last discovery and then sends that information to the policy engine. The policy engine uses this information and determines whether to assign a policy to an asset or to remove an existing policy from an asset.

The CloudPoint policy engine keeps a track of all the changes that are made to CloudPoint policies. Whenever a new policy is created, the policy engine requests the coordinator for a list of tagged assets. The coordinator polls the MongoDB database and sends that information to the policy engine. If any of the asset tag matches the new policy name, the policy engine requests the coordinator to attach that policy to the asset.

Depending on the change, CloudPoint performs the following actions during each discovery cycle: