Kubernetes data protection using a containerized file system data agent

A system comprising:

• a first computing device that operates outside a Kubernetes cluster, wherein the first computing device comprises one or more first hardware processors and non-transitory computer-readable media comprising computer-executable instructions, which, when executed by the one or more first hardware processors, cause the first computing device to:
• receive a notice of a backup job of primary data that is stored in a first persistent volume of the Kubernetes cluster,
• use a first communicative connection with an Application Programming Interface server (API server) of the Kubernetes cluster to:
• (a) cause the Kubernetes cluster to create a secondary persistent volume that comprises primary data captured in a snapshot of the first persistent volume, (b) cause the Kubernetes cluster to instantiate a worker pod, which is attached to the secondary persistent volume and is configured with computer-executable instructions for a file system data agent and with a cloned security certificate corresponding to the Kubernetes cluster, and (c) cause the worker pod to execute the file system data agent, and
• terminate the first communicative connection to the API server, based on determining that the worker pod is executing the file system data agent;
• wherein the worker pod executes on a second computing device that comprises one or more hardware processors, and wherein the file system data agent executing at the worker pod is configured to:
• identify, among the primary data in the secondary persistent volume, payload data and payload-related metadata that changed since a reference time, and
• use the cloned security certificate to securely communicate with a third computing device of the system, wherein the third computing device comprises one or more hardware processors and operates outside the Kubernetes cluster, and
• transmit the payload data and the payload-related metadata that changed to the third computing device, which is configured to generate one or more backup copies based thereon, and to store the one or more backup copies at a secondary storage that is configured outside the Kubernetes cluster;
• and
• wherein the computer-executable instructions further cause the first computing device to:
• based on determining that all of the payload data and the payload-related metadata have been transmitted by the file system data agent, use a second communicative connection with the API server to cause the Kubernetes cluster to tear down one or more of:
• the worker pod, the secondary persistent volume, and the snapshot.