Observability, Security, Backup, and DR
Cloud-native operations need three lenses: can you see it, can you prove who did what, and can you get it back? NCP-CN checks that you use Kubernetes-native tooling alongside Prism rather than treating either as sufficient alone.
Observability
- Prism Central covers infrastructure: VM metrics, alerts, events, audits.
- NKP ships a centralized Prometheus/Grafana/Alertmanager and Loki stack at the management cluster; workload clusters forward metrics and logs.
- Alert on what users feel: API server latency, PVC capacity, node pressure, CrashLoopBackOff, certificate expiry.
Security
- Flow Network Security microsegments at the vNIC; combine it with Kubernetes NetworkPolicy - the two enforce at different layers and neither replaces the other.
- RBAC and admission control decide what can be deployed; keep cluster-admin off application teams.
- Integrate NKP with the enterprise IdP through Dex so audit trails map to real users.
Backup and DR
- Velero backs up Kubernetes objects; CSI VolumeSnapshots capture PV data. Both are needed - objects without data restore an empty app, data without objects restores an orphan.
- NDK adds application-consistent snapshots and cross-cluster restore for stateful workloads.
- Prism protection domains and Leap cover VM-level DR for the clusters themselves.
Worked example
A namespace restore leaves pods Pending with unbound PVCs. Reasoning: Velero restored the PVC objects, but the VolumeSnapshotClass was missing from the backup or the snapshot content belonged to another cluster. Restore the CSI snapshot data first, or use NDK cross-cluster restore, then re-run the Velero restore.
Traps
Backing up only VM snapshots for stateful pods; forgetting etcd or the management cluster's own state; assuming Flow Security quarantines a compromised workload automatically; alerting on infrastructure only and missing certificate expiry.