clusters/cl01tl/manifests/vault/ConfigMap-vault-backup-script.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vault-backup-script
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault-backup-script
+    app.kubernetes.io/instance: vault
+    app.kubernetes.io/part-of: vault
+data:
+  backup.sh: |
+    echo " ";
+    echo ">> Running S3 backup for Vault snapshot";
+    if s3cmd sync --no-check-certificate -v /opt/backup "${BUCKET}/cl01tl/cl01tl-vault-snapshots/"; then
+        echo ">> Sync succeeded"
+    else
+        echo ">> ERROR: Sync failed"
+    fi

clusters/cl01tl/manifests/vault/ConfigMap-vault-snapshot-script.yaml

@@ -8,15 +8,45 @@ metadata:
     app.kubernetes.io/instance: vault
     app.kubernetes.io/part-of: vault
 data:
-  update.sh: |
-    BACKUP_FOLDER=/opt/backup
-    BACKUP_FILE=$(ls -t $BACKUP_FOLDER | head -n 1)
+  snapshot.sh: |
+    MAX_RETRIES=5
+    SUCCESS=false
+
+    for ((i=1; i<=$MAX_RETRIES; i++)); do
+        if apk update --short &> /dev/null; then
+            echo ">> Attempt $i: Repositories are reachable";
+            SUCCESS=true;
+            break;
+        else
+            echo ">> Attempt $i: Connection failed, retrying in 5 seconds ...";
+            sleep 5;
+        fi;
+    done;
+
+    if [ "$SUCCESS" = false ]; then
+        echo ">> ERROR: Could not connect to apk repositories after $MAX_RETRIES attempts, exiting ...";
+        exit 1;
+    fi
+
+    if ! command -v jq 2>&1 >/dev/null;
+    then
+        echo "jq could not be found, installing";
+        apk add --no-cache jq;
+        if [ $? -eq 0 ]; then
+            echo ">> Installation successful";
+        else
+            echo ">> Installation failed with exit code $?";
+            exit 1;
+        fi;
+    fi;
 
     echo " ";
-    echo ">> Running S3 backup for Vault snapshot";
+    echo ">> Fetching Vault token";
+    export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token);
 
-    if s3cmd put --no-check-md5 --no-check-certificate -v "$BACKUP_FOLDER/$BACKUP_FILE" "${BUCKET}/cl01tl/cl01tl-vault-snapshots/$BACKUP_FILE"; then
-        echo ">> Upload succeeded"
-    else
-        echo ">> ERROR: Upload failed"
-    fi
+    echo " ";
+    echo ">> Taking Vault snapsot ...";
+    vault operator raft snapshot save /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap
+
+    echo " ";
+    echo ">> Completed Vault snapshot";

clusters/cl01tl/manifests/vault/CronJob-vault-snapshot.yaml

@@ -31,6 +31,9 @@ spec:
           enableServiceLinks: false
           serviceAccountName: default
           automountServiceAccountToken: true
+          securityContext:
+            runAsGroup: 1000
+            runAsUser: 100
           hostIPC: false
           hostNetwork: false
           hostPID: false

clusters/cl01tl/manifests/vault/Deployment-vault.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vault
+  labels:
+    app.kubernetes.io/controller: main
+    app.kubernetes.io/instance: vault
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: vault
+    helm.sh/chart: temp-4.5.0
+  namespace: vault
+spec:
+  revisionHistoryLimit: 3
+  replicas: 0
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: main
+      app.kubernetes.io/name: vault
+      app.kubernetes.io/instance: vault
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/controller: main
+        app.kubernetes.io/instance: vault
+        app.kubernetes.io/name: vault
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+        - command:
+            - sleep
+            - infinity
+          image: ubuntu:resolute-20251208
+          imagePullPolicy: IfNotPresent
+          name: main
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          volumeMounts:
+            - mountPath: /opt/backup
+              name: backup
+            - mountPath: /opt/backup-old
+              name: backup-old
+      volumes:
+        - name: backup
+          persistentVolumeClaim:
+            claimName: vault-storage-backup
+        - name: backup-old
+          persistentVolumeClaim:
+            claimName: vault-nfs-storage-backup

clusters/cl01tl/manifests/vault/Pod-vault-server-test.yaml

@@ -34,16 +34,10 @@ spec:
 
           exit 0
       volumeMounts:
-        - mountPath: /opt/backups-old/
-          name: vault-nfs-storage-backup
-          readOnly: true
         - mountPath: /opt/backups/
           name: vault-storage-backup
           readOnly: false
   volumes:
-    - name: vault-nfs-storage-backup
-      persistentVolumeClaim:
-        claimName: vault-nfs-storage-backup
     - name: vault-storage-backup
       persistentVolumeClaim:
         claimName: vault-storage-backup

clusters/cl01tl/manifests/vault/StatefulSet-vault.yaml

@@ -48,9 +48,6 @@ spec:
         - name: config
           configMap:
             name: vault-config
-        - name: vault-nfs-storage-backup
-          persistentVolumeClaim:
-            claimName: vault-nfs-storage-backup
         - name: vault-storage-backup
           persistentVolumeClaim:
             claimName: vault-storage-backup
@@ -113,9 +110,6 @@ spec:
               mountPath: /vault/data
             - name: config
               mountPath: /vault/config
-            - mountPath: /opt/backups-old/
-              name: vault-nfs-storage-backup
-              readOnly: true
             - mountPath: /opt/backups/
               name: vault-storage-backup
               readOnly: false