Rubrik integration with Private Cloud Director

Integrate Rubrik Cloud Data Management with Private Cloud Director for VM backup, restore, and disaster recovery replication.

Overview

Rubrik Cloud Data Management (CDM) is a backup appliance that provides agentless backup, recovery, and disaster recovery for virtual machines running in Private Cloud Director ( PCD).

This guide explains how to connect Rubrik to your PCD environment so it can automatically discover and protect your VMs.

Prerequisites

Before you begin, ensure you meet the following criteria.

Rubrik CDM:

• Access to your Rubrik CDM portal at https://<your-domain>.my.rubrik.com

• Rubrik CDM appliance deployed and accessible from your PCD environment.

• Administrator privileges in the Rubrik portal.

PCD environment:

• PCD version 2025.10-112 or later.

• Administrator access to create users and assign roles.

• Access to run pcdctl commands.

Network requirements:

• Rubrik appliance can reach the endpoint (HTTPS/443).

• Rubrik appliance can reach proxy VMs on TCP ports 12800 and 12801.

• Proxy VMs and the Rubrik appliance are on the same network, or routing is configured between them.

For disaster recovery replication (optional):

• Second Rubrik CDM appliance

• Network connectivity between both Rubrik appliances.

• Rubrik 9.4.1-p1-30807 or later

Configure PCD user for Rubrik

Rubrik requires a dedicated PCD user with system-scoped admin privileges. System-scoped privileges enable Rubrik to discover and manage VMs across all tenants and domains, without being restricted to a single project.

Create the Rubrik user

1. Create a dedicated user for Rubrik in PCD:

   # Example user: [email protected]
   # Replace with your actual domain

1. Assign system-scoped admin privileges to the user:

   pcdctl role add --user '[email protected]' --user-domain default --system all admin

1. Verify the role assignment:

   pcdctl role assignment list --user '[email protected]'

Confirm the output includes:

• The user exists in the list

• An assignment row where the System column shows all

Example output:

   +-------------+---------------------------+-------+---------+--------+--------+-----------+
   | Role        | User                      | Group | Project | Domain | System | Inherited |
   +-------------+---------------------------+-------+---------+--------+--------+-----------+
   | 0a39274e... | b38b3de8cd904395...       |       | 857...  |        |        | False     |
   | 0a39274e... | b38b3de8cd904395...       |       |         |        | all    | False     |
   +-------------+---------------------------+-------+---------+--------+--------+-----------+

Test the connection

Before configuring Rubrik, verify that the user can authenticate with the system scope:

1. Set environment variables for the Rubrik user:

   export [email protected]
   export OS_PASSWORD=<your-password>
   export OS_AUTH_URL=https://<DU-FQDN>/keystone/v3
   export OS_IDENTITY_API_VERSION=3
   export OS_USER_DOMAIN_NAME=Default
   export OS_SYSTEM_SCOPE=system

1. Test authentication:

   openstack token issue

If successful, you will see token details. If this fails, verify the user credentials and role assignment before proceeding.

Connect Rubrik CDM to PCD

After configuring the PCD user, add your PCD environment as a data source in Rubrik CDM.

Add PCD as an OpenStack data source

1. In the Rubrik CDM portal, navigate to Settings > Datasource > OpenStack > Add OpenStack.

1. In the configuration wizard, enter the following:

   IP Address/Fully Qualified Domain Name:

   <DU-FQDN>/keystone/v3

Important: Do not include https:// in this field. Rubrik adds the protocol automatically.

Example: pcd-region1.example.com/keystone/v3

1. For the Image (Glance) endpoint type, select Admin endpoint.

   

The admin endpoint allows Rubrik to access the full image catalog across all tenants. The public endpoint will not provide sufficient access.

1. Enter the credentials for your Rubrik user:

• Username: [email protected]

• Password: The password you set for this user

• User Domain Name: Default

1. Complete the remaining wizard fields with your environment details.

2. Click Add to save the configuration.

Verify inventory discovery

After adding the data source, Rubrik begins discovering your VM inventory. This process takes 5-10 minutes.

To verify successful discovery:

1. Navigate to Data Protection > Inventory > OpenStack Virtual Machine.

1. Confirm all expected VMs appear in the list.

   • VMs are organized by availability zone, which maps to your PCD clusters.

   • You can filter by Domains or Projects in the inventory view.

1. If VMs do not appear after 10 minutes, verify the following:

• Network connectivity from the Rubrik appliance to the PCD keystone endpoint.

• User credentials and system-scoped privileges.

• Rubrik appliance logs for connection errors.

Network configuration

Rubrik creates a proxy VM in each tenant during backup or restore operations. The Rubrik appliance communicates with these proxy VMs to transfer data.

Proxy VM deployment

When you run your first backup or restore in a tenant, Rubrik automatically:

1. Uploads a proxy image to the tenant's Glance catalog.

2. Creates a proxy VM instance in the tenant.

3. Configures the proxy VM for data transfer operations.

The proxy VM remains running for the duration of backup/restore operations, and you will find new Rubrik Proxy VMs in your tenant, as seen here.

Network requirements

For successful backup and restore operations:

• Network placement: Rubrik appliance and proxy VMs must be on the same network.

• Port access: The Rubrik appliance must reach proxy VMs on TCP ports 12800 and 12801.

• Routing: Ensure no firewalls or security groups block traffic between the appliance and proxy VMs.

TroubleShooting

After Rubrik creates a proxy VM in your tenant, verify connectivity:

1. Identify the proxy VM in your tenant (typically named rubrik-proxy-<tenant-name>).

2. Note the proxy VM's IP address.

3. From the Rubrik appliance, test connectivity on required ports:

   nc -zv <proxy-vm-ip> 12800
   nc -zv <proxy-vm-ip> 12801

Both ports should show as open/connected. If either test fails, check:

• Security group rules on the proxy VM.

• Network routing between the Rubrik appliance and the PCD tenant network.

• Firewall rules in your environment.

Constraints

• Rubrik backup only works for VMs and volumes that are not ephemeral

• Rubrik system relies on snapshots of the VMs and such depends on the snapshot quota of the tenant under which the VM lives. If you have a large number of VMs that needs backup concurrently please increase the snapshot quota