如何确保存储账户所有文件共享均被Recovery Services Vault自动备份？

方案一：用Azure Policy实现自动修正 #

直接通过自定义策略强制将新创建的文件共享（包括AKS PVC生成的）加入备份策略，开启自动修正后无需手动干预：

• 1. 创建自定义Policy定义，核心逻辑是检查存储账户下的文件共享是否已被指定Recovery Vault保护，未保护则自动添加
• 2. 关键Policy规则片段（可根据你的环境调整参数）：

  {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts/fileServices/shares"
        },
        {
          "not": {
            "field": "Microsoft.RecoveryServices/protectedItems/id",
            "contains": "[parameters('recoveryVaultId')]"
          }
        }
      ]
    },
    "then": {
      "effect": "deployIfNotExists",
      "details": {
        "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
        "name": "[concat(parameters('recoveryVaultName'), '/Azure/StorageContainer;storage;[resourceGroup().name];[split(field('id'),'/')[4]]/FileShare;[split(field('id'),'/')[8]]')]",
        "existenceCondition": {
          "field": "Microsoft.RecoveryServices/protectedItems/provisioningState",
          "equals": "Succeeded"
        },
        "roleDefinitionIds": [
          "/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
        ],
        "deployment": {
          "properties": {
            "mode": "incremental",
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "resources": [
                {
                  "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                  "apiVersion": "2023-01-01",
                  "name": "[concat(parameters('recoveryVaultName'), '/Azure/StorageContainer;storage;[resourceGroup().name];[split(field('id'),'/')[4]]/FileShare;[split(field('id'),'/')[8]]')]",
                  "properties": {
                    "protectedItemType": "Microsoft.Storage/storageAccounts/fileServices/shares",
                    "policyId": "[parameters('backupPolicyId')]",
                    "sourceResourceId": "[field('id')]"
                  }
                }
              ]
            },
            "parameters": {
              "recoveryVaultName": {
                "value": "[parameters('recoveryVaultName')]"
              },
              "backupPolicyId": {
                "value": "[parameters('backupPolicyId')]"
              }
            }
          }
        }
      }
    }
  }
  

• 3. 部署Policy时，开启自动修正选项，并给Policy分配「备份参与者」角色，确保它有权限修改备份配置。

方案二：用Azure自动化账户Runbook定期扫描 #

通过脚本定期检查存储账户下的文件共享，把未加入备份的自动添加进去：

• 1. 在自动化账户中创建PowerShell Runbook，示例脚本：

  # 替换为你的资源信息
  $resourceGroupName = "你的资源组名称"
  $storageAccountName = "AKS用的存储账户名"
  $recoveryVaultName = "你的Recovery Service Vault名称"
  $backupPolicyName = "已配置的备份策略名称"
  
  # 获取存储账户下所有文件共享
  $shares = Get-AzStorageShare -ResourceGroupName $resourceGroupName -StorageAccountName $storageAccountName
  
  # 初始化Recovery Vault上下文
  $vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $recoveryVaultName
  Set-AzRecoveryServicesVaultContext -Vault $vault
  $backupPolicy = Get-AzRecoveryServicesBackupProtectionPolicy -Name $backupPolicyName
  
  # 遍历共享，检查并添加备份
  foreach ($share in $shares) {
      $existingProtection = Get-AzRecoveryServicesBackupItem -BackupManagementType AzureStorage -WorkloadType AzureFiles -VaultId $vault.Id | Where-Object { $_.Name -eq $share.Name }
      if (-not $existingProtection) {
          Enable-AzRecoveryServicesBackupProtection -Policy $backupPolicy -Name $share.Name -ResourceGroupName $resourceGroupName -StorageAccountName $storageAccountName
          Write-Output "已为文件共享 $($share.Name) 启用备份保护"
      }
  }
  

• 2. 给自动化账户分配「存储账户读取者」和「Recovery Service Vault备份参与者」角色，确保脚本有权限执行操作。
• 3. 创建执行计划，比如每小时运行一次，这样AKS新建PVC生成的文件共享会被及时纳入备份。

关键注意点 #

• AKS生成的PVC文件共享命名格式通常是pvc-<随机UUID>，上述两种方案都会自动识别这类共享，无需额外配置。
• 测试时可以手动创建一个PVC，然后检查Policy或Runbook是否自动将对应的共享加入备份策略。
• 如果用Policy，要确保Policy的作用范围覆盖AKS存储账户所在的资源组或订阅。

内容的提问来源于stack exchange，提问作者Mathias Indermühle