Merge pull request #297428 from rajats22/backupupdates31032025

Updates in AKS Backup CLI and Support Matrix Docs

Author: prmerger-automator[bot]

articles/backup/azure-kubernetes-service-cluster-backup-support-matrix.md

@@ -18,9 +18,13 @@ You can use [Azure Backup](./backup-overview.md) to help protect Azure Kubernete
 
 ## Supported regions
 
-- Operational Tier support for AKS backup is supported in all the following Azure public cloud regions: East US, North Europe, West Europe, South East Asia, West US 2, East US 2, West US, North Central US, Central US, France Central, Korea Central, Australia East, UK South, East Asia, West Central US, Japan East, South Central US, West US 3, Canada Central, Canada East, Australia South East, Central India, Norway East, Germany West Central, Switzerland North, Sweden Central, Japan West, UK West, Korea South, South Africa North, South India, France South, Brazil South, UAE North, China East 2, China East 3, China North 2, China North 3, USGov Virginia, USGov Arizona, and USGov Texas.
+- Operational Tier support for AKS backup is supported in all the following Azure public cloud regions:
 
-- Vault Tier and Cross Region Restore support for AKS backup are available in the following regions: East US, West US, West US 3, North Europe, West Europe, North Central US, South Central US, West Central US, East US 2, Central US, UK South, UK West, East Asia, South-East Asia, Japan East South India, Central India, Canada Central, and Norway East.
+Australia East, Australia Southeast, Brazil South, Canada Central, Canada East, Central India, Central US, China East 2, China East 3, China North 2, China North 3, East Asia, East US, East US 2, France Central, France South, Germany West Central, Italy North, Japan East, Japan West, Korea Central, Korea South, North Central US, North Europe, Norway East, South Africa North, South Central US, South India,  Southeast Asia, Sweden Central, Switzerland North, UAE North, UK South, Uk West, US GOV Arizona, US GOV Texas, US GOV Virginia, West Central US, West Europe, West US, West US 2, West US 3.
+
+- Vault Tier and Cross Region Restore support for AKS backup are available in the following regions: 
+
+Canada Central, Central India, Central US, East Asia, East US, East US 2, Japan East, North Central US, North Europe, Norway East, South Central US, South India, South-East Asia, UK South, UK West, West Central US, West Europe, West US, West US 3.
 
 
   >[!Note]
@@ -34,11 +38,11 @@ You can use [Azure Backup](./backup-overview.md) to help protect Azure Kubernete
 
 - Provide a new and empty blob container as input while installing backup extension in an AKS cluster for the first time. Don't use same blob container for more than one AKS cluster. 
 
-- AKS backups do not support in-tree volumes. You can back up only CSI driver-based volumes. You can [migrate from tree volumes to CSI driver-based persistent volumes](/azure/aks/csi-migrate-in-tree-volumes).
+- AKS backups don't support in-tree volumes. You can back up only CSI driver-based volumes. You can [migrate from tree volumes to CSI driver-based persistent volumes](/azure/aks/csi-migrate-in-tree-volumes).
 
 - Currently, an AKS backup supports only the backup of Azure disk-based persistent volumes (enabled by the CSI driver). The supported Azure Disk SKUs are Standard HDD, Standard SSD, and Premium SSD. The disks belonging to Premium SSD v2 and Ultra Disk SKU aren't supported. Both static and dynamically provisioned volumes are supported. For backup of static disks, the persistent volumes specification should have the *storage class* defined in the **YAML** file, otherwise such persistent volumes are skipped from the backup operation.
 
-- Azure Files shares and Azure Blob Storage persistent volumes are not supported by AKS backup due to lack of CSI Driver-based snapshotting capability. If you're using said persistent volumes in your AKS clusters, you can configure backups for them via the Azure Backup solutions. For more information, see [Azure file share backup](azure-file-share-backup-overview.md) and [Azure Blob Storage backup](blob-backup-overview.md).
+- Azure Files shares and Azure Blob Storage persistent volumes aren't supported by AKS backup due to lack of CSI Driver-based snapshotting capability. If you're using said persistent volumes in your AKS clusters, you can configure backups for them via the Azure Backup solutions. For more information, see [Azure file share backup](azure-file-share-backup-overview.md) and [Azure Blob Storage backup](blob-backup-overview.md).
 
 - Any unsupported persistent volume type is skipped while a backup is being created for the AKS cluster.
 
@@ -50,7 +54,7 @@ You can use [Azure Backup](./backup-overview.md) to help protect Azure Kubernete
 
 - Azure Backup for AKS is currently not supported for Network Isolated AKS clusters.
 
-- Don't install AKS Backup Extension along with Velero or other Velero-based backup services. Addtionally ensure that your Kubernetes resources does not have labels of annotations containing word `velero.io` except in recommended scenarios, otherwise this could lead to unexpected behaviour.
+- Don't install AKS Backup Extension along with Velero or other Velero-based backup services. Additionally ensure that your Kubernetes resources do not have labels of annotations containing word `velero.io` except in recommended scenarios, otherwise this could lead to unexpected behavior.
 
 - You must install the backup extension in the AKS cluster. If you're using Azure CLI to install the backup extension, ensure that the version is 2.41 or later. Use `az upgrade` command to upgrade the Azure CLI.
 
@@ -68,7 +72,7 @@ You can use [Azure Backup](./backup-overview.md) to help protect Azure Kubernete
 
 - For successful backup and restore operations, the Backup vault's managed identity requires role assignments. If you don't have the required permissions, permission problems might happen during backup configuration or restore operations soon after you assign roles because the role assignments take a few minutes to take effect. [Learn about role definitions](azure-kubernetes-service-cluster-backup-concept.md#required-roles-and-permissions).
 
-- Backup vault doesn't support Azure Lighthouse. Thus, cross tenant management can't be enabled by Lighthouse for Azure Backup for AKS and you cannot backup/restore AKS Clusters across tenant.
+- Backup vault doesn't support Azure Lighthouse. Thus, cross tenant management can't be enabled by Lighthouse for Azure Backup for AKS and you can't backup/restore AKS Clusters across tenant.
 
 - The following namespaces are skipped from Backup Configuration and not configured for backups: `kube-system`, `kube-node-lease`, `kube-public`.
 
@@ -92,9 +96,9 @@ You can use [Azure Backup](./backup-overview.md) to help protect Azure Kubernete
 
 - Currently, backup instances with <= 100 disks attached as persistent volume are supported. Backup and restore operations might fail if number of disks are higher than the limit. 
 
-- Only Azure Disks with public access enabled from all networks are eligible to be moved to the Vault Tier; if there are disks with network access apart from public access, tiering operation will fail. 
+- Only Azure Disks with public access enabled from all networks are eligible to be moved to the Vault Tier; if there are disks with network access apart from public access, tiering operation fails. 
 
-- *Disaster Recovery* feature is only available between Azure Paired Regions (if backup is configured in a Geo Redundant Backup vault). The backup data is only available in an Azure paired region. For example, if you have an AKS cluster in East US that is backed up in a Geo Redundant Backup vault, the backup data is also available in West US for restore.
+- *Disaster Recovery* feature is only available between Azure Paired Regions (if backup is configured in a Geo Redundant Backup vault with Cross Region Restore enabled on them). The backup data is only available in an Azure paired region. For example, if you have an AKS cluster in East US that is backed up in a Geo Redundant Backup vault with Cross Region Restore enabled on them, the backup data is also available in West US for restore.
 
 - Only one scheduled recovery point is available in Vault Tier per day that is providing an RPO of 24 hours in the primary region. For secondary region, the recovery point can take up to 12 hours, thus providing an RPO of 36 hours.
 

articles/backup/azure-kubernetes-service-cluster-backup-using-cli.md

@@ -214,6 +214,23 @@ Once the vault and policy creation are complete, you need to perform the followi
    az k8s-extension create --name azure-aks-backup --extension-type microsoft.dataprotection.kubernetes --scope cluster --cluster-type managedClusters --cluster-name $akscluster --resource-group $aksclusterresourcegroup --release-train stable --configuration-settings blobContainer=$blobcontainer storageAccount=$storageaccount storageAccountResourceGroup=$storageaccountresourcegroup storageAccountSubscriptionId=$subscriptionId
    ```
 
+  In case the AKS cluster is within a virtual network, then you will have to create a private endpoint, connecting thw storage account with the virtual network in which the AKS cluster resides.
+
+  ```azurecli
+  #Fetch the Subnet ID using the name of the virtual network and subnet in which cluster resides 
+  $PESubnetId = az network vnet subnet show --resource-group $aksMCResourceGroup --vnet-name $aksVnetName  --name $PESubnetName --query 'id' --output tsv
+
+  #Create a Private Endpoint between Storage Account and the Virtual Network.
+  az network private-endpoint create `
+    --resource-group $aksclusterresourcegroup `
+    --name $StoragePrivateEndpoint `
+    --vnet-name $aksVnetName `
+    --subnet $PESubnetId `
+    --private-connection-resource-id $(az storage account show --nameD $storageaccount --resource-group $storageaccountresourcegroup --query "id" --output tsv) `
+    --group-ids "blob" `
+    --connection-name "StoragePESharedVNetConnection"
+  ```
+
    As part of extension installation, a user identity is created in the AKS cluster's Node Pool Resource Group. For the extension to access the storage account, you need to provide this identity the **Storage Blob Data Contributor** role. To assign the required role, run the following command:
 
    ```azurecli