Enable backup and snapshot protection on Azure NetApp volumes

Problem

AWS workloads have automatic backup protection on FSx OpenZFS file systems — 30-day retention with daily backups at 02:00 UTC. Azure workloads have no equivalent protection on their NetApp volumes. These volumes hold the same critical data (user home directories, shared project storage) but have zero backup or snapshot coverage today.

If an Azure NetApp volume is corrupted or accidentally modified, there is currently no recovery path short of support escalation.

Current state

AWS (aws_workload_persistent.py):

• automatic_backup_retention_days=30
• daily_automatic_backup_start_time="02:00" (configurable)
• copy_tags_to_backups=True

Azure (azure_workload_persistent.py):

• No data_protection parameter on CapacityPoolVolume resources
• No snapshot policy
• No backup vault or backup policy

Proposed changes

Add three new resources to the Azure persistent infrastructure and wire them into each volume:

1. Snapshot policy

Create an azure_native.netapp.SnapshotPolicy on the NetApp account with a daily schedule (matching the AWS 02:00 UTC window). Retain enough snapshots for fast local recovery (e.g. 7 daily).

2. Backup vault

Create an azure_native.netapp.BackupVault on the NetApp account. This stores backups separately from the volume, surviving volume deletion.

3. Backup policy

Create an azure_native.netapp.BackupPolicy on the NetApp account with 30 daily backups retained (matching AWS FSx retention).

4. Wire into volumes

Add data_protection to each CapacityPoolVolume:

data_protection=netapp.VolumePropertiesDataProtectionArgs(
    backup=netapp.VolumeBackupPropertiesArgs(
        backup_policy_id=backup_policy.id,
        backup_vault_id=backup_vault.id,
    ),
    snapshot=netapp.VolumeSnapshotPropertiesArgs(
        snapshot_policy_id=snapshot_policy.id,
    ),
)

Configuration

Add to AzureWorkloadConfig:

Field	Default	Notes
netapp_daily_backup_start_time	"02:00"	Hour/minute UTC for daily snapshots and backups
netapp_backup_retention_days	30	Daily backups to retain
netapp_snapshot_retention_days	7	Daily snapshots to retain (local, fast restore)

Rollout notes

• Existing volumes will need a Pulumi import or careful state management since they weren't created with data_protection. Test with --dry-run first.
• The first backup per volume is a full copy — may take significant time depending on volume size. Schedule during low-usage windows.
• Backups require an active snapshot policy on the volume, so snapshot policy must be assigned before backup is enabled.
• protect_persistent_resources should also apply to the backup vault.

Manual interim steps

Until this is codified in Pulumi, backups can be enabled manually per-account in the Azure portal:

1. Create a snapshot policy under the NetApp account > Data protection > Snapshot policy
2. Assign the snapshot policy to each volume
3. Create a backup vault under the NetApp account > Data protection > Backup vaults
4. Create a backup policy under the NetApp account > Data protection > Backup policies (30 daily)
5. Enable backups on each volume, selecting the vault and policy