apiVersion: batch/v1
kind: CronJob
metadata:
  name: talos-external
  labels:
    app.kubernetes.io/controller: external
    app.kubernetes.io/instance: talos
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: talos
    helm.sh/chart: etcd-backup-5.0.1
  namespace: talos
spec:
  suspend: false
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 30
  timeZone: America/Chicago
  schedule: "0 4 * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      parallelism: 1
      backoffLimit: 3
      template:
        metadata:
          labels:
            app.kubernetes.io/controller: external
            app.kubernetes.io/instance: talos
            app.kubernetes.io/name: talos
        spec:
          enableServiceLinks: false
          serviceAccountName: talos
          automountServiceAccountToken: true
          hostIPC: false
          hostNetwork: false
          hostPID: false
          dnsPolicy: ClusterFirst
          restartPolicy: Never
          nodeSelector:
            node-role.kubernetes.io/control-plane: ""
          tolerations:
            - effect: NoSchedule
              key: node-role.kubernetes.io/control-plane
              operator: Exists
          containers:
            - command:
                - /talos-backup
              env:
                - name: AWS_ACCESS_KEY_ID
                  valueFrom:
                    secretKeyRef:
                      key: AWS_ACCESS_KEY_ID
                      name: talos-etcd-backup-external-config
                - name: AWS_SECRET_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      key: AWS_SECRET_ACCESS_KEY
                      name: talos-etcd-backup-external-config
                - name: AWS_REGION
                  valueFrom:
                    secretKeyRef:
                      key: AWS_REGION
                      name: talos-etcd-backup-external-config
                - name: CUSTOM_S3_ENDPOINT
                  value: https://s3.us-east-005.backblazeb2.com
                - name: BUCKET
                  valueFrom:
                    secretKeyRef:
                      key: BUCKET_NAME
                      name: talos-etcd-backup-external-config
                - name: S3_PREFIX
                  value: cl01tl/etcd
                - name: CLUSTER_NAME
                  value: cl01tl
                - name: AGE_X25519_PUBLIC_KEY
                  valueFrom:
                    secretKeyRef:
                      key: AGE_X25519_PUBLIC_KEY
                      name: talos-etcd-backup-external-config
                - name: USE_PATH_STYLE
                  value: "false"
              image: ghcr.io/siderolabs/talos-backup:v0.1.0-beta.3-10-gb9fd478@sha256:7fc186ff37a3137f470082cb609bf1dc3bcece13dd9a6421ec09cfdf4f33ae6c
              name: backup
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                    - ALL
                runAsGroup: 1000
                runAsNonRoot: true
                runAsUser: 1000
                seccompProfile:
                  type: RuntimeDefault
              volumeMounts:
                - mountPath: /var/run/secrets/talos.dev
                  mountPropagation: None
                  name: secret
                  readOnly: true
                - mountPath: /.talos
                  name: talos
                - mountPath: /tmp
                  name: tmp
              workingDir: /tmp
            - args:
                - -ec
                - /scripts/prune.sh
              command:
                - /bin/sh
              env:
                - name: TARGET
                  value: External
                - name: DATE_RANGE_SECONDS
                  value: "1209600"
              envFrom:
                - secretRef:
                    name: talos-etcd-backup-external-config
                - secretRef:
                    name: talos-ntfy-config
              image: d3fk/s3cmd:latest@sha256:d66cc5677b30b31a7981f9fde0af064a9072e8b8a57d5e9b4cc02f44f02acbf2
              name: s3-prune
              volumeMounts:
                - mountPath: /root/.s3cfg
                  mountPropagation: None
                  name: etcd-backup-external-config
                  readOnly: true
                  subPath: .s3cfg
                - mountPath: /scripts/prune.sh
                  name: prune-script
                  subPath: prune.sh
          volumes:
            - csi:
                driver: secrets-store.csi.k8s.io
                readOnly: true
                volumeAttributes:
                  secretProviderClass: talos-etcd-backup-external-config
              name: etcd-backup-external-config
            - configMap:
                defaultMode: 493
                name: talos-prune-script
              name: prune-script
            - name: secret
              secret:
                secretName: talos-backup-secrets
            - emptyDir:
                medium: Memory
              name: talos
            - emptyDir:
                medium: Memory
              name: tmp
