add mover security context

charts/volsync-target/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: volsync-target
-version: 0.1.0
+version: 0.4.0
 description: Volsync Replication set to target specific PVC with preconfigured settings
 keywords:
   - volsync-target

charts/volsync-target/README.md

@@ -1,6 +1,6 @@
 # volsync-target
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![AppVersion: 0.14.0](https://img.shields.io/badge/AppVersion-0.14.0-informational?style=flat-square)
+![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![AppVersion: 0.14.0](https://img.shields.io/badge/AppVersion-0.14.0-informational?style=flat-square)
 
 Volsync Replication set to target specific PVC with preconfigured settings
 
@@ -29,6 +29,7 @@ Volsync Replication set to target specific PVC with preconfigured settings
 | local.externalSecret | object | `{"credentialPath":"/garage/home-infra/volsync-backups","volsyncPath":"/volsync/restic/garage-local"}` | External Secret configuration |
 | local.restic | object | `{"cacheCapacity":"1Gi","copyMethod":"Snapshot","pruneIntervalDays":7,"repository":"","retain":{"daily":3,"hourly":1,"monthly":2,"weekly":2,"yearly":4},"storageClassName":"ceph-block","volumeSnapshotClassName":"ceph-blockpool-snapshot"}` | Backup configuration, inserted directly into the yaml |
 | local.schedule | string | `"0 2 * * *"` | 5 character cron schedule |
+| moverSecurityContext | object | `{}` | Glocal security context for restic mover |
 | nameOverride | string | `""` | Default pattern follows <pvcTarget>-backup |
 | namespaceOverride | string | `""` | Override the namespace of the chart |
 | pvcTarget | string | `"data"` | Name of the PVC target |

charts/volsync-target/templates/external-secret.yaml

@@ -87,35 +87,35 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.volsyncPath | required "External Secret Volsync remote path is required" }}
+        key: {{ .Values.remote.externalSecret.volsyncPath | required "External Secret Volsync remote path is required" }}
         metadataPolicy: None
         property: BUCKET_ENDPOINT
     - secretKey: RESTIC_PASSWORD
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.volsyncPath | required "External Secret Volsync remote path is required" }}
+        key: {{ .Values.remote.externalSecret.volsyncPath | required "External Secret Volsync remote path is required" }}
         metadataPolicy: None
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
+        key: {{ .Values.remote.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
         metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
+        key: {{ .Values.remote.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
         metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
+        key: {{ .Values.remote.externalSecret.credentialPath | required "External Secret Credential remote path is required" }}
         metadataPolicy: None
         property: ACCESS_SECRET_KEY
 {{- end }}
@@ -148,35 +148,35 @@ spec:
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.volsyncPath | required "External Secret Volsync external path is required" }}
+        key: {{ .Values.external.externalSecret.volsyncPath | required "External Secret Volsync external path is required" }}
         metadataPolicy: None
         property: BUCKET_ENDPOINT
     - secretKey: RESTIC_PASSWORD
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.volsyncPath | required "External Secret Volsync external path is required" }}
+        key: {{ .Values.external.externalSecret.volsyncPath | required "External Secret Volsync external path is required" }}
         metadataPolicy: None
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
+        key: {{ .Values.external.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
         metadataPolicy: None
         property: AWS_DEFAULT_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
+        key: {{ .Values.external.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
         metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: {{ .Values.local.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
+        key: {{ .Values.external.externalSecret.credentialPath | required "External Secret Credential external path is required" }}
         metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
 {{- end }}

charts/volsync-target/templates/replication-source.yaml

@@ -21,7 +21,13 @@ spec:
     retain:
     {{- with .Values.local.restic.retain }}
       {{- toYaml . | nindent 6 }}
-    {{ end }}
+    {{- end }}
+    {{- if .Values.moverSecurityContext }}
+      moverSecurityContext:
+      {{- with .Values.moverSecurityContext }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
     copyMethod: {{ .Values.local.restic.copyMethod }}
     storageClassName: {{ .Values.local.restic.storageClassName }}
     volumeSnapshotClassName: {{ .Values.local.restic.volumeSnapshotClassName }}
@@ -51,7 +57,13 @@ spec:
     retain:
     {{- with .Values.remote.restic.retain }}
       {{- toYaml . | nindent 6 }}
-    {{ end }}
+    {{- end }}
+    {{- if .Values.moverSecurityContext }}
+      moverSecurityContext:
+      {{- with .Values.moverSecurityContext }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
     copyMethod: {{ .Values.remote.restic.copyMethod }}
     storageClassName: {{ .Values.remote.restic.storageClassName }}
     volumeSnapshotClassName: {{ .Values.remote.restic.volumeSnapshotClassName }}
@@ -81,7 +93,13 @@ spec:
     retain:
     {{- with .Values.external.restic.retain }}
       {{- toYaml . | nindent 6 }}
-    {{ end }}
+    {{- end }}
+    {{- if .Values.moverSecurityContext }}
+      moverSecurityContext:
+      {{- with .Values.moverSecurityContext }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
     copyMethod: {{ .Values.external.restic.copyMethod }}
     storageClassName: {{ .Values.external.restic.storageClassName }}
     volumeSnapshotClassName: {{ .Values.external.restic.volumeSnapshotClassName }}

charts/volsync-target/values.yaml

@@ -10,6 +10,9 @@ additionalLabels: {}
 # -- Name of the PVC target
 pvcTarget: "data"
 
+# -- Glocal security context for restic mover
+moverSecurityContext: {}
+
 # -- Use external secrets
 externalSecrets:
   enabled: true