mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
93 lines
2.8 KiB
YAML
93 lines
2.8 KiB
YAML
# Backups of authentik's database by CNPG itself, through the barman cloud
|
|
# plugin (apps/templates/plugin-barman-cloud-helm.yaml): a base backup every
|
|
# night, and every WAL segment as soon as it is full or 5 minutes old
|
|
# (archive_timeout). Both go to the bucket cnpg-authentik in Garage on the
|
|
# NAS (nas/garage), so the database can be restored to any moment of the
|
|
# last 30 days. Velero copies the data directory while PostgreSQL runs,
|
|
# which is not a consistent copy.
|
|
# The key is Garage's cnpg-authentik, in Vault as kv/cnpg-authentik-s3; it
|
|
# can only reach this bucket.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-postgres-s3
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: authentik-postgres-s3
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
ACCESS_KEY_ID: "{{ .access_key_id }}"
|
|
ACCESS_SECRET_KEY: "{{ .secret_access_key }}"
|
|
# Garage rejects requests signed for another region
|
|
REGION: garage
|
|
data:
|
|
- secretKey: access_key_id
|
|
remoteRef:
|
|
key: kv/cnpg-authentik-s3
|
|
property: access_key_id
|
|
- secretKey: secret_access_key
|
|
remoteRef:
|
|
key: kv/cnpg-authentik-s3
|
|
property: secret_access_key
|
|
---
|
|
apiVersion: barmancloud.cnpg.io/v1
|
|
kind: ObjectStore
|
|
metadata:
|
|
name: authentik-postgres
|
|
annotations:
|
|
# The CRD comes with the plugin's own app
|
|
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
|
spec:
|
|
retentionPolicy: 30d
|
|
configuration:
|
|
destinationPath: s3://cnpg-authentik/
|
|
endpointURL: http://192.168.1.99:3900
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: authentik-postgres-s3
|
|
key: ACCESS_KEY_ID
|
|
secretAccessKey:
|
|
name: authentik-postgres-s3
|
|
key: ACCESS_SECRET_KEY
|
|
region:
|
|
name: authentik-postgres-s3
|
|
key: REGION
|
|
wal:
|
|
compression: gzip
|
|
data:
|
|
compression: gzip
|
|
instanceSidecarConfiguration:
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
env:
|
|
# Newer boto3 adds checksums that S3-compatible stores can reject;
|
|
# the plugin's docs suggest sending them only when required.
|
|
- name: AWS_REQUEST_CHECKSUM_CALCULATION
|
|
value: when_required
|
|
- name: AWS_RESPONSE_CHECKSUM_VALIDATION
|
|
value: when_required
|
|
---
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: ScheduledBackup
|
|
metadata:
|
|
name: authentik-postgres-daily
|
|
spec:
|
|
cluster:
|
|
name: authentik-postgres
|
|
# 03:00 UTC, after Longhorn's and Velero's backups; immediate: one right
|
|
# away, so WAL archiving has a base backup to start from.
|
|
schedule: "0 0 3 * * *"
|
|
immediate: true
|
|
backupOwnerReference: self
|
|
method: plugin
|
|
pluginConfiguration:
|
|
name: barman-cloud.cloudnative-pg.io
|