You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Policy 1 - Azure Backup Extension should be installed in AKS clusters
18
18
19
-
It is an [audit-only](../governance/policy/concepts/effects.md#audit) policy. This policy identifies which AKS clusters don't have backup extension installed but doesn't automatically install backup extension for these AKS clusters. It is useful when you're only looking to evaluate the overall preparedness of the AKS clusters for backup compliance but not looking to take action immediately.
19
+
Use this [audit-only](../governance/policy/concepts/effects.md#audit) policy to identify the AKS clusters that don't have the backup extension installed. However, this policy doesn't automatically install the backup extension to these AKS clusters. It's useful only to evaluate the overall readiness of the AKS clusters for backup compliance, and not to take action immediately.
20
20
21
21
## Policy 2 - Azure Backup should be enabled for AKS clusters
22
22
23
-
It is an [audit-only](../governance/policy/concepts/effects.md#audit) policy. This policy identifies which clusters don't have backup enabled but doesn't automatically configure backups for these clusters. It's useful when you're only looking to evaluate the overall compliance of the clusters but not looking to take action immediately.
23
+
Use this [audit-only](../governance/policy/concepts/effects.md#audit) policy to identify the clusters that don't have backups enabled. However, this policy doesn't automatically configure backups for these clusters. It's useful only to evaluate the overall compliance of the clusters, and not to take action immediately.
24
24
25
25
## Policy 3 - Install Azure Backup Extension in AKS clusters (Managed Cluster) with a given tag.
26
26
@@ -32,6 +32,8 @@ A central backup team in an organization can use this policy to install backup e
32
32
33
33
## Supported Scenarios
34
34
35
+
Before you audit and enforce backups for AKS clusters, see the following scenarios supported:
36
+
35
37
* The built-in policy is currently supported only for Azure Kubernetes Service clusters.
36
38
37
39
* Users must take care to ensure that the necessary [prerequisites](azure-kubernetes-service-cluster-backup-concept.md#Backup Extension) are enabled before Policies 3 and 4 are assigned.
@@ -42,25 +44,35 @@ A central backup team in an organization can use this policy to install backup e
42
44
43
45
## Using the built-in policies
44
46
45
-
The below steps describe the end-to-end process of assigning Policy 3: **Install Azure Backup Extension in AKS clusters (Managed Cluster) with a given tag**. Similar instructions apply for the other policies. Once assigned, any new AKS cluster created under this scope has backup extension installed automatically.
47
+
This section describes the end-to-end process of assigning Policy 3: **Install Azure Backup Extension in AKS clusters (Managed Cluster) with a given tag**. Similar instructions apply for the other policies. Once assigned, any new AKS cluster created under this scope has backup extension installed automatically.
48
+
49
+
To assign Policy 3, follow these steps:
46
50
47
51
1. Sign in to the Azure portal and navigate to the **Policy** Dashboard.
52
+
48
53
2. Select **Definitions** in the left menu to get a list of all built-in policies across Azure Resources.
54
+
49
55
3. Filter the list for **Category=Backup** and select the policy named *Install Azure Backup Extension in AKS clusters (Managed Cluster) with a given tag*.
50
56
:::image type="content" source="./media/azure-kubernetes-service-cluster-backup-policy/policy-dashboard-inline.png" alt-text="Screenshot showing how to filter the list by category on Policy dashboard." lightbox="./media/backup-azure-auto-enable-backup/policy-dashboard-expanded.png":::
57
+
51
58
4. Select the name of the policy. You're then redirected to the detailed definition for this policy.
52
59

60
+
53
61
5. Select the **Assign** button at the top of the pane. This redirects you to the **Assign Policy** pane.
62
+
54
63
6. Under **Basics**, select the three dots next to the **Scope** field. It opens up a right context pane where you can select the subscription for the policy to be applied on. You can also optionally select a resource group, so that the policy is applied only for AKS clusters in a particular resource group.
55
64

65
+
56
66
7. In the **Parameters** tab, choose a location from the drop-down, and select the storage account to which the backup extension installed in the AKS cluster in the scope must be associated. You can also choose to specify a tag name and an array of tag values. An AKS cluster that contains any of the specified values for the given tag are excluded from the scope of the policy assignment.
57
67

68
+
58
69
8. Ensure that **Effect** is set to deployIfNotExists.
70
+
59
71
9. Navigate to **Review+create** and select **Create**.
60
72
61
73
> [!NOTE]
62
74
>
63
-
> -Azure Policy can also be used on existing AKS clusters, using [remediation](../governance/policy/how-to/remediate-resources.md).
75
+
> -Use [remediation](../governance/policy/how-to/remediate-resources.md) to enable these policies on existing AKS clusters.
0 commit comments