# Rubrik Integration with PCD

## Overview

Rubrik Cloud Data Management (CDM) is a backup appliance that provides agentless backup, recovery, and disaster recovery for virtual machines running in <code class="expression">space.vars.product\_name</code> ( <code class="expression">space.vars.product\_acronym</code>).

This guide explains how to connect Rubrik to your <code class="expression">space.vars.product\_acronym</code> environment so it can automatically discover and protect your VMs.

### Prerequisites

Before you begin, ensure you meet the following criteria.

**Rubrik CDM:**

* Access to your Rubrik CDM portal at `https://<your-domain>.my.rubrik.com`
* Rubrik CDM appliance deployed and accessible from your <code class="expression">space.vars.product\_acronym</code> environment.
* Administrator privileges in the Rubrik portal.

<code class="expression">space.vars.product\_acronym</code> **environment:**

* <code class="expression">space.vars.product\_acronym</code> version **2025.10-112** or later.
* Administrator access to create users and assign roles.
* Access to run `pcdctl` commands.

**Network requirements:**

* Rubrik appliance can reach the endpoint (HTTPS/443).
* Rubrik appliance can reach proxy VMs on TCP ports 12800 and 12801.
* Proxy VMs and the Rubrik appliance are on the same network, or routing is configured between them.

**For disaster recovery replication (optional):**

* Second Rubrik CDM appliance
* Network connectivity between both Rubrik appliances.
* Rubrik **9.4.1-p1-30807** or later

## Configure <code class="expression">space.vars.product\_acronym</code> user for Rubrik

Rubrik requires a dedicated <code class="expression">space.vars.product\_acronym</code> user with system-scoped admin privileges. System-scoped privileges enable Rubrik to discover and manage VMs across all tenants and domains, without being restricted to a single project.

#### Create the Rubrik user

1. Create a dedicated user for Rubrik in <code class="expression">space.vars.product\_acronym</code>:

```bash
   # Example user: rubrik-system-user@acme.com
   # Replace with your actual domain
```

2. Assign system-scoped admin privileges to the user:

```bash
   pcdctl role add --user 'rubrik-system-user@acme.com' --user-domain default --system all admin
```

3. Verify the role assignment:

```bash
   pcdctl role assignment list --user 'rubrik-system-user@acme.com'
```

Confirm the output includes:

* The user exists in the list
* An assignment row where the **System** column shows `all`

Example output:

```
   +-------------+---------------------------+-------+---------+--------+--------+-----------+
   | Role        | User                      | Group | Project | Domain | System | Inherited |
   +-------------+---------------------------+-------+---------+--------+--------+-----------+
   | 0a39274e... | b38b3de8cd904395...       |       | 857...  |        |        | False     |
   | 0a39274e... | b38b3de8cd904395...       |       |         |        | all    | False     |
   +-------------+---------------------------+-------+---------+--------+--------+-----------+
```

#### Test the connection

Before configuring Rubrik, verify that the user can authenticate with the system scope:

1. Set environment variables for the Rubrik user:

```bash
   export OS_USERNAME=rubrik-system-user@acme.com
   export OS_PASSWORD=<your-password>
   export OS_AUTH_URL=https://<DU-FQDN>/keystone/v3
   export OS_IDENTITY_API_VERSION=3
   export OS_USER_DOMAIN_NAME=Default
   export OS_SYSTEM_SCOPE=system
```

2. Test authentication:

```bash
   openstack token issue
```

If successful, you will see token details. If this fails, verify the user credentials and role assignment before proceeding.

## Connect Rubrik CDM to <code class="expression">space.vars.product\_acronym</code>

After configuring the <code class="expression">space.vars.product\_acronym</code> user, add your <code class="expression">space.vars.product\_acronym</code> environment as a data source in Rubrik CDM.

#### Add Certificates to Rubrik CDM

Starting version 9.4.2 of Rubrik CDM, please add the certificate(s)

1. Get the list of endpoints. There are two primary:

   * `https://<DU-FQDN>/`
   * `https://<some ip address for galnce/`

   <figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FHtIGFzYXtl3FFrIGqvGq%2Fimage.png?alt=media&#x26;token=04741921-9dda-4db4-9209-1b00ae7b7b54" alt=""><figcaption></figcaption></figure>

2. Export the certificate(s) for both endpoints.\
   Go to the URls (a, b) above and click on the `https`  and use certificate export for the root or the self-signed certificates to export those certificates as `.pem` files.

3. Import certificates into the CDM\
   On Rubirk CDM portal, navigate to **Settings > Security > Certificate Management** and import the certificates. Ensure you enable **Include in Truststore**

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FJuY3U9HJUamO5HfDrMfF%2Fimage.png?alt=media&#x26;token=3a2e5ac3-a5b7-4a67-973b-d8854fd31f09" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FoTPfXMn61NcawfDj0zQt%2Fimage.png?alt=media&#x26;token=77e8e1bd-5cf3-4d33-899c-291dfc465c25" alt=""><figcaption></figcaption></figure>

#### Add <code class="expression">space.vars.product\_acronym</code> as an OpenStack data source

1. In the Rubrik CDM portal, navigate to **Settings** > **Datasource** > **OpenStack** > **Add OpenStack**.<br>

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2Frkt8xfLkhAR17ECFodEl%2FScreenshot%202026-02-09%20at%2012.23.51.png?alt=media&#x26;token=07395daa-801d-4178-af0e-968ba6de5639" alt="" width="563"><figcaption></figcaption></figure>

2. In the configuration wizard, enter the following:\
   **IP Address/Fully Qualified Domain Name:**

```
   <DU-FQDN>/keystone/v3
```

{% hint style="info" %}
**Important:** Do not include `https://` in this field. Rubrik adds the protocol automatically.
{% endhint %}

Example: `pcd-region1.example.com/keystone/v3`

3. For the **Image (Glance)** endpoint type, select **Admin endpoint**.<br>

   <figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2Fj6u6bsvfU56mOgTydJRI%2Fimage.png?alt=media&#x26;token=8c1f09f4-ad2b-4484-8aa9-88c747e16af5" alt=""><figcaption></figcaption></figure>

The admin endpoint allows Rubrik to access the full image catalog across all tenants. The public endpoint will not provide sufficient access.

4. Enter the credentials for your Rubrik user:

* **Username:** `rubrik-system-user@acme.com`
* **Password:** The password you set for this user
* **User Domain Name:** `Default`

5. Complete the remaining wizard fields with your environment details.
6. Click **Add** to save the configuration.

#### Verify inventory discovery

After adding the data source, Rubrik begins discovering your VM inventory. This process takes 5-10 minutes.

To verify successful discovery:

1. Navigate to **Data Protection** > **Inventory** > **OpenStack Virtual Machine**.

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FyOyStPsZBOb2L4lGVU7y%2Fimage.png?alt=media&#x26;token=10b4a9a1-3edd-487c-9ccb-db89f5cb22ff" alt=""><figcaption></figcaption></figure>

2. Confirm all expected VMs appear in the list.
   * VMs are organized by availability zone, which maps to your <code class="expression">space.vars.product\_acronym</code> clusters.
   * You can filter by **Domains or Projects** in the inventory view.

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FZoMVwlmbMz8tZkZPIlb5%2Fimage.png?alt=media&#x26;token=738fbba6-067a-450e-80cf-fbec6394e80e" alt=""><figcaption></figcaption></figure>

3. If VMs do not appear after 10 minutes, verify the following:

* Network connectivity from the Rubrik appliance to the <code class="expression">space.vars.product\_acronym</code> keystone endpoint.
* User credentials and system-scoped privileges.
* Rubrik appliance logs for connection errors.

### Network configuration

Rubrik creates a proxy VM in each tenant during backup or restore operations. The Rubrik appliance communicates with these proxy VMs to transfer data.

#### Proxy VM deployment

When you run your first backup or restore in a tenant, Rubrik automatically:

1. Uploads a proxy image to the tenant's Glance catalog.
2. Creates a proxy VM instance in the tenant.
3. Configures the proxy VM for data transfer operations.

The proxy VM remains running throughout backup/restore operations, and you will find new Rubrik Proxy VMs in your tenant, as shown here.

<figure><img src="https://1100565312-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIYcmHH6U169jTwihxwwy%2Fuploads%2FtfTUN2cd3h1ZyOJTM5if%2Fimage.png?alt=media&#x26;token=ff9dd324-0db5-48b7-a620-612ccdddd704" alt=""><figcaption></figcaption></figure>

#### Network requirements

For successful backup and restore operations:

* **Network placement:** Rubrik appliance and proxy VMs must be on the same network.
* **Port access:** The Rubrik appliance must reach proxy VMs on TCP ports 12800 and 12801.
* **Routing:** Ensure no firewalls or security groups block traffic between the appliance and proxy VMs.

#### Troubleshooting

After Rubrik creates a proxy VM in your tenant, verify connectivity:

1. Identify the proxy VM in your tenant (typically named `rubrik-proxy-<tenant-name>`).
2. Note the proxy VM's IP address.
3. From the Rubrik appliance, test connectivity on required ports:

```bash
   nc -zv <proxy-vm-ip> 12800
   nc -zv <proxy-vm-ip> 12801
```

Both ports should show as open/connected. If either test fails, check:

* Security group rules on the proxy VM.
* Network routing between the Rubrik appliance and the <code class="expression">space.vars.product\_acronym</code> tenant network.
* Firewall rules in your environment.

#### Constraints

* Rubrik backup only works for VMs and volumes that are not ephemeral
* The Rubrik system relies on VM snapshots, and this depends on the snapshot quota of the tenant under which the VM lives. If you have a large number of VMs that need backup concurrently, increase the snapshot quota.