The Application Backup feature in Stork, which enables the backup of both application data (PVCs) and its corresponding Kubernetes object configurations (such as Deployments, Services, and ConfigMaps), was introduced in Stork version 2.3. Versions prior to 2.3 only supported snapshotting Portworx volumes without the associated application context. Therefore, 2.3 is the minimum required version to perform an Application Backup.

A. Any Stork version works: This is incorrect because the Application Backup feature, which uses the ApplicationBackup CRD, was a specific feature introduced in version 2.3 and is not present in earlier versions.

B. Stork 23.3.0: While this version and later versions support Application Backups, it is not the minimum required version. The functionality has been available since the much earlier 2.3 release.

1. Portworx Official Documentation

"Backup and restore applications using Stork": Under the "Prerequisites" section

the documentation explicitly states the minimum version requirement.

Reference: "Stork version 2.3 or newer."

Source: Portworx Enterprise Documentation

Storage Operations -> Backup and Restore -> Stork -> Backup and restore applications using Stork. (The exact URL may change

but the path within the documentation hierarchy is consistent).

When troubleshooting a down Portworx node, the first and most fundamental step is to verify the health of the underlying Kubernetes infrastructure. Portworx runs as a daemonset on Kubernetes nodes, and its health is directly dependent on the node's status. The command kubectl get node -o wide provides a cluster-wide overview, confirming if all nodes are in a Ready state and can schedule pods. If a Kubernetes node is NotReady, no application-level troubleshooting for Portworx on that node will succeed until the underlying node issue is resolved. This approach follows the standard bottom-up troubleshooting methodology, starting with the foundational layer (Kubernetes) before moving to the application layer (Portworx).

A. pxctl status to check the status of Portworx on the node.

This command checks the Portworx application status. It is a secondary step, as it will likely fail or provide misleading information if the underlying Kubernetes node is not healthy.

C. journalctl -u kubelet to identify the problem on the node.

This is a deep-dive diagnostic command to check kubelet logs. It is typically used after kubectl get node has identified a specific node as NotReady or unhealthy.

1. Portworx Enterprise Documentation

"Troubleshoot Portworx on Kubernetes": The official troubleshooting guide for Portworx on Kubernetes consistently uses kubectl commands as the initial step to assess the state of the environment. For instance

in the section "Portworx pods are not running

" the first action is to use kubectl get pods and kubectl describe pod

which presumes the Kubernetes nodes themselves are functional. Verifying node status with kubectl get nodes is the prerequisite step to ensure the scheduler can even attempt to place pods.

Source: Portworx Enterprise Documentation

Section: Monitor and Troubleshoot -> Troubleshoot Portworx -> Troubleshoot Portworx on Kubernetes.

2. Portworx Enterprise Documentation

"Prerequisites": All installation guides for Portworx on any Kubernetes distribution list a healthy

functional Kubernetes cluster as a primary prerequisite. A core indicator of a healthy cluster is that all nodes are in the Ready state. Therefore

checking this status is the logical first step in any troubleshooting scenario that might involve infrastructure failure.

Source: Portworx Enterprise Documentation

Section: Install and Configure -> Install Portworx -> Install Portworx on Kubernetes -> Prerequisites.

In Portworx, a local snapshot is a point-in-time, read-only image of a volume that resides within the same cluster as the original volume. These snapshots are created using a copy-on-write mechanism, making them instantaneous and space-efficient. They are primarily used for rapid operational recovery, such as restoring data from accidental deletion or application corruption, and for cloning volumes for development, testing, or analytics purposes, all within the local cluster environment.

A. A snapshot stored in a remote data center is referred to as a remote or cloud snapshot, specifically designed for disaster recovery, not a local snapshot.

B. A snapshot automatically backed up to the cloud is a "cloudsnap." While Portworx supports this, it is a distinct feature from a standard local snapshot.

1. Portworx Enterprise Documentation

"Create and use local snapshots": This document explicitly states

"Portworx can take snapshots of your volumes. These snapshots are local to a cluster... A local snapshot is a point-in-time copy of a volume that you can use to create a clone of that volume." This confirms that the snapshot's location is the same cluster.

2. Portworx Enterprise Documentation

"Volume Snapshots": The overview section distinguishes between different types of snapshots: "These snapshots can be local to a cluster or pushed to a cloud provider." This clearly separates the concept of a "local" snapshot from one stored remotely in the cloud.

3. Portworx Enterprise Documentation

"pxctl volume snapshot create": The command reference for creating snapshots shows options for local creation. The documentation for cloudsnaps (--cloudsnap) demonstrates that sending a snapshot to a remote location requires specific

separate parameters

reinforcing that the default snapshot is local to the cluster.

A Portworx volume is considered "Public" when the guestaccess parameter is enabled for it. This setting allows any authenticated user within the Portworx security domain to access the volume with a specified level of permission (read, write, or admin), even if they are not the owner or explicitly listed as a collaborator. This mechanism is the designated method for sharing a volume broadly across users in the cluster, effectively making it a public resource.

A. A volume owned by system.admin is simply under the control of that specific administrative role. Ownership does not inherently grant access to all other users.

C. When Portworx security is enabled, every volume is created with an associated owner. A volume without ownership is not the defined mechanism for making it public.

1. Portworx Enterprise Documentation

"Security -> Portworx with Kubernetes -> Volume-based access control -> Ownership and access": In the section "Make a volume public

" the documentation explicitly states: "You can make a volume public by granting access to guests. When you set guestaccess to read

write

or admin

any authenticated user can access the volume with the specified access level." This directly confirms that guest access defines a public volume.

2. Portworx Enterprise Documentation

"Security -> Portworx with Kubernetes -> Volume-based access control -> Ownership and access": The "Ownership" section clarifies: "When you create a volume

you become its owner." This refutes the idea that a volume can be public by having no owner.

When using the shared secret authentication method, Portworx requires the Kubernetes secret containing the authentication token to be located in the same namespace as the application that is requesting storage. The Portworx StorageClass is configured with parameters (px.io/secret-name and px.io/secret-namespace: ${pvc.namespace}) that instruct the CSI provisioner to dynamically look for the secret in the namespace where the PersistentVolumeClaim (PVC) is being created. This ensures that only applications within that specific namespace can use the secret to authenticate and provision Portworx volumes, adhering to Kubernetes' namespaced security model.

B. In the 'default' namespace: This is incorrect. Placing the secret in the default namespace would not make it accessible to applications in other namespaces without additional, non-standard configuration.

C. In the same namespace as the Portworx installation: This is incorrect. Storing the secret in the Portworx system namespace (e.g., kube-system) would require complex cross-namespace RBAC permissions for every application, which is not the standard procedure.

1. Portworx Enterprise Documentation

"Security -> With Kubernetes -> Configure Portworx security with Kubernetes secrets": This document explicitly states

"Create a Kubernetes secret in the namespace where you will be creating your PVCs." It provides the example command kubectl -n create secret generic px-secret ... to create the secret in the target application namespace.

2. Portworx Enterprise Documentation

"Storage Operations -> Storage Provisioning in Kubernetes -> Dynamic Provisioning": This page details the StorageClass parameters. It shows the use of px.io/secret-namespace: ${pvc.namespace}

which confirms that the provisioner resolves the secret's namespace to be the same as the PVC's namespace at the time of creation.