From 9b2e7795ef5fc120622cc651e3838940ec07fede Mon Sep 17 00:00:00 2001 From: alexlebens Date: Wed, 3 Jul 2024 19:23:42 -0500 Subject: [PATCH] backup config pvc --- .../freshrss/templates/external-secret.yaml | 137 +++++++++++++----- .../templates/replication-source.yaml | 27 ++++ 2 files changed, 125 insertions(+), 39 deletions(-) create mode 100644 clusters/cl01tl/applications/freshrss/templates/replication-source.yaml diff --git a/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml b/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml index 93920aa6e..69d709088 100644 --- a/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml +++ b/clusters/cl01tl/applications/freshrss/templates/external-secret.yaml @@ -1,44 +1,5 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret -metadata: - name: freshrss-oidc-secret - namespace: {{ .Release.Namespace }} - labels: - app.kubernetes.io/name: {{ .Release.Name }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/component: web - app.kubernetes.io/part-of: {{ .Release.Name }} -spec: - secretStoreRef: - kind: ClusterSecretStore - name: vault - data: - - secretKey: OIDC_CLIENT_ID - remoteRef: - conversionStrategy: Default - decodingStrategy: None - key: /authentik/oidc/freshrss - metadataPolicy: None - property: client - - secretKey: OIDC_CLIENT_SECRET - remoteRef: - conversionStrategy: Default - decodingStrategy: None - key: /authentik/oidc/freshrss - metadataPolicy: None - property: secret - - secretKey: OIDC_CLIENT_CRYPTO_KEY - remoteRef: - conversionStrategy: Default - decodingStrategy: None - key: /authentik/oidc/freshrss - metadataPolicy: None - property: crypto-key - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret metadata: name: freshrss-install-secret namespace: {{ .Release.Namespace }} @@ -75,6 +36,45 @@ spec: metadataPolicy: None property: ADMIN_API_PASSWORD +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: freshrss-oidc-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: OIDC_CLIENT_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/freshrss + metadataPolicy: None + property: client + - secretKey: OIDC_CLIENT_SECRET + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/freshrss + metadataPolicy: None + property: secret + - secretKey: OIDC_CLIENT_CRYPTO_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/freshrss + metadataPolicy: None + property: crypto-key + --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret @@ -100,6 +100,65 @@ spec: metadataPolicy: None property: token +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: freshrss-config-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: freshrss-config-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + template: + mergePolicy: Merge + engineVersion: v2 + data: + RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/freshrss/freshrss-config" + data: + - secretKey: BUCKET_ENDPOINT + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: S3_BUCKET_ENDPOINT + - secretKey: RESTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: RESTIC_PASSWORD + - secretKey: AWS_DEFAULT_REGION + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: AWS_DEFAULT_REGION + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: access_key + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: secret_key + --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret diff --git a/clusters/cl01tl/applications/freshrss/templates/replication-source.yaml b/clusters/cl01tl/applications/freshrss/templates/replication-source.yaml new file mode 100644 index 000000000..6ea71b814 --- /dev/null +++ b/clusters/cl01tl/applications/freshrss/templates/replication-source.yaml @@ -0,0 +1,27 @@ +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: freshrss-config-backup-source + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: freshrss-config-backup-source + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + sourcePVC: freshrss-config + trigger: + schedule: 0 */6 * * * + restic: + pruneIntervalDays: 14 + repository: freshrss-config-backup-secret + retain: + hourly: 1 + daily: 1 + weekly: 7 + monthly: 4 + yearly: 4 + copyMethod: Snapshot + storageClassName: ceph-block + volumeSnapshotClassName: ceph-blockpool-snapshot