You can deploy the backup proxy using either of the following methods:
Option A: Deploy backup proxy using QCOW2 appliance image
Use this method to deploy a pre-configured Druva backup proxy appliance directly using the OpenStack QCOW2 image format.
Step 1: Download the QCOW2 image to OpenStack Glance
To download QCOW2 Image:
Log in to the Management Console > Protect > OpenStack.
Click Register New Project and select Download QCOW2 Image (or download from the Druva Downloads Page).
Step 2: Launch the backup proxy appliance instance
Log in to the OpenStack Horizon Dashboard. Navigate to Admin > Images > Create Image. Upload the QCOW2 downloaded image to Glance.
Navigate to Horizon Dashboard > Project > Compute > Instances and click Launch Instance.
In the Details tab provide the name of the instance, for example,
druva-backup-proxy-appliance.In the Source tab, select Image and choose the standard QCOW2 image (for example,
ubuntu-24). Set the minimum volume size to 100 GB.In the Available collapsible section, locate the image. Click the upward arrow (↑) button in that row to allocate the image. After allocation, the image is displayed under the Allocated section. Click Next.
In the Flavor tab, choose a flavor with at least 8 vCPUs and 8 GB RAM.
Flavors manage the sizing for the compute, memory, and storage capacity of the instance.To do this, locate the flavor (for example, standardbackup) in the Available collapsible section. Click the upward arrow (↑) button in that row to allocate the flavor. After allocation, the flavor is displayed under the Allocated section. Click Next.
Navigate to the Networks tab. Attach your backup/management network. Networks provide the communication channels for instances in the cloud. Ensure outbound HTTPS internet connectivity to Druva Cloud endpoints.
Locate these items in the Available collapsible section and click the upward arrow (↑) button in that row for allocation. Click Next.
Navigate to the Security Groups tab. Select a security group that allows outbound traffic on TCP Port 443 and internal SSH (Port 22).
Click Launch Instance.
Step 3: Activate and register the QCOW2 proxy appliance
Log in to the backup proxy virtual machine via console or SSH.
(Optional) Configure HTTP Web Proxy if required:
/opt/Druva/EnterpriseWorkloads/bin/EnterpriseWorkloadsAgent web-proxy-config \ -s -t http -i <WEB-PROXY-IP> -p <PORT>Activate the proxy with your Druva activation token:
EnterpriseWorkloadsAgent openstack activate --token <ACTIVATION_TOKEN>Register OpenStack Keystone credentials:
EnterpriseWorkloadsAgent openstack setcred --identityEndpoint <provide OpenStack identity endpoint> --user <username> --userDomainName <user domain name>
For example,
EnterpriseWorkloadsAgent openstack setcred --identityEndpoint http://172.16.72.135/openstack-keystone/v3 --user admin --userDomainName admin_domain
Option B: Create backup proxy VM and install proxy packages
Use this method if you want to provision your own base Linux VM (for example, Ubuntu 22.04 LTS) and install the Druva Enterprise Workloads agent package manually.
Step 1: Deploy the backup proxy VM in OpenStack
Log in to the OpenStack Horizon Dashboard.
Select your project (for example, dev2).
Navigate to Project > Compute > Instances and click Launch Instance. Click Next.
In the Details tab, specify an instance name. Click Next.
In the Source tab, select Image and choose the standard QCOW2 image (for example, ubuntu-24).
In the Available collapsible section, locate the ubuntu-24 image. Click the upward arrow ( ↑ ) button in that row to allocate the image. After allocation, the image is displayed under the Allocated section. Click Next.Create or use an existing flavor with configuration (with at least 8 vCPUs and 8 GB RAM). In the Flavor tab, choose the flavor you have created.
To do this, locate the flavor (for example, standardbackup) in the Available collapsible section. Click the upward arrow ( ↑ ) button in that row to allocate the flavor. After allocation, the flavor is displayed under the Allocated section. Click Next.In the Networks tab, attach the required networks (for example, Private and external-network). Networks provide the communication channels for instances in the cloud.
Locate these items in the Available collapsible section and click the upward arrow ( ↑ ) button in that row for allocation. Click Next.(Optional) Provide the network port information. Ports provide extra communication channels to your instances. You can select ports instead of networks or a mix of both. Click Next.
(Optional) Select the Security Group to launch the instance in. Click Next.
Add a Key Pair. A key pair allows you to SSH into your newly created instance. You may select an existing key pair, import a key pair, or generate a new key pair. Click Next.
(Optional) In the Configuration tab, customize your instance after it has launched using the options available here. Click Next.
(Optional) In the Security Groups tab, assign a server group to launch the instance in. Click Next.
(Optional) In the Scheduler Hints tab, add scheduler hints to your instance. Click Next.
(Optional) In the Metadata tab, add the metadata items to your instance.
Click Launch Instance.
Step 2: Download and install the backup agent package
Download Package from Management Console:
Log in to the Management Console.
Navigate to Protect > OpenStack (or select your organization first if multi-tenant/orgs are enabled).
Click Register New Project.
Under Download Backup Proxy, download the latest Linux Debian/RPM package (EnterpriseWorkloads-OpenStackBackupProxy-x.x.x-amd64.deb).
Install the agent package:
Access the backup proxy VM terminal via SSH or console and execute:
sudo dpkg -i EnterpriseWorkloads-OpenStackBackupProxy-7.0.0-xxxxxx-amd64.deb
When prompted for package signature verification, select yes or no based on your organization's security policy.
(Optional) Configure Web proxy:
If your OpenStack environment routes outbound internet traffic through an HTTP proxy server, run:
/opt/Druva/EnterpriseWorkloads/bin/EnterpriseWorkloadsAgent web-proxy-config \ -s -t http -i <WEB-PROXY-IP> -p <PORT> -u <USERNAME> -p <PASSWORD>📝 Note
Communication within the OpenStack deployment will happen without the web proxy route.
Step 3: Node activation and OpenStack credentials setup
Generate Activation Token
In the Druva Management Console, go to Protect > OpenStack > Register New Project.
Under Activate Backup Proxy, click Copy Token.
Activate the proxy agent
Run the activation command on the Proxy VM terminal:
EnterpriseWorkloadsAgent openstack activate --token <ACTIVATION_TOKEN>
Configure OpenStack Cloud credentials
Configure the OpenStack Keystone API authentication credentials on the proxy so it can manage snapshots and volume attachments during backups:
Using OpenStack Keystone user credentials:
EnterpriseWorkloadsAgent openstack setcred --identityEndpoint <provide OpenStack identity endpoint> --user <username> --userDomainName <user domain name>For example,
EnterpriseWorkloadsAgent openstack setcred --identityEndpoint http://172.16.72.135/openstack-keystone/v3 --user admin --userDomainName admin_domainYou will be prompted to enter the password for the OpenStack user.
Handling Self-Signed SSL certificates:
To skip SSL certificate verification (testing environments):
EnterpriseWorkloadsAgent openstack setopenstackcred ... --skipCertVerifyTo specify a customer CA certificate bundle:
EnterpriseWorkloadsAgent openstack setopenstackcred ... --caCertsBundlePath /etc/ssl/certs/openstack-ca.pem



