feat(ocis-backup): adds oCIS volume backup CronJobs
Implements daily online backups for oCIS persistent volumes. Each CronJob uses `rclone` to sync its respective PVC to a Storage Box, mounting the volume read-only to ensure zero downtime. Pod affinity is configured to schedule the backup job on the same node as the consuming application pod. This covers `idm`, `storagesystem`, and `storageusers` data volumes.
This commit is contained in:
Felix Wolf
parent
d65181de78
commit
122e03f3ec
120
prototypes/ocis/ytt/volume-backup-cronjob.ytt.yaml
Normal file
120
prototypes/ocis/ytt/volume-backup-cronjob.ytt.yaml
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
#@ load("@ytt:data", "data")
|
||||
|
||||
#@ ns = data.values.application.namespace
|
||||
|
||||
#! Daily online volume backup. One CronJob per oCIS PVC, each pinned
|
||||
#! via podAffinity to the consumer pod that already holds that volume.
|
||||
#! Mounts the RWO PVC read-only alongside the running app — no
|
||||
#! downtime, no scale-down dance, no cross-pod coupling.
|
||||
#!
|
||||
#! Storage Box layout (latest-state mirror):
|
||||
#! storagebox:ocis-volumes/{pvc}/...
|
||||
#!
|
||||
#! NOTE: online backup — not crash-consistent. decomposedfs writes may
|
||||
#! be caught mid-flight. Acceptable trade for zero-downtime.
|
||||
|
||||
#@ targets = [
|
||||
#@ {"app": "storageusers", "pvc": "storageusers-data"},
|
||||
#@ {"app": "idm", "pvc": "idm-data"},
|
||||
#@ {"app": "storagesystem", "pvc": "storagesystem-data"},
|
||||
#@ ]
|
||||
|
||||
#@ for t in targets:
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: #@ "ocis-volume-backup-{}".format(t["app"])
|
||||
namespace: #@ ns
|
||||
spec:
|
||||
schedule: "30 2 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 86400
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1009
|
||||
runAsGroup: 1009
|
||||
fsGroup: 1009
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
affinity:
|
||||
podAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: #@ t["app"]
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- name: rclone
|
||||
image: rclone/rclone:1.69.0
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- |
|
||||
set -eu
|
||||
echo "[backup] Syncing ${PVC}..."
|
||||
rclone sync "/pvc" "storagebox:ocis-volumes/${PVC}" \
|
||||
--links \
|
||||
--transfers=4 \
|
||||
-v
|
||||
echo "[backup] Done."
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
env:
|
||||
- name: PVC
|
||||
value: #@ t["app"]
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_TYPE
|
||||
value: sftp
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_PORT
|
||||
value: "23"
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
|
||||
value: /etc/storagebox/ssh-key
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ocis-storagebox-credentials
|
||||
key: host
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ocis-storagebox-credentials
|
||||
key: user
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumeMounts:
|
||||
- name: pvc
|
||||
mountPath: /pvc
|
||||
readOnly: true
|
||||
- name: storagebox-ssh
|
||||
mountPath: /etc/storagebox
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: pvc
|
||||
persistentVolumeClaim:
|
||||
claimName: #@ t["pvc"]
|
||||
- name: storagebox-ssh
|
||||
secret:
|
||||
secretName: ocis-storagebox-credentials
|
||||
items:
|
||||
- key: ssh-key
|
||||
path: ssh-key
|
||||
defaultMode: 0440
|
||||
#@ end
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
annotations:
|
||||
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
||||
name: ocis-volume-backup-idm
|
||||
namespace: ocis
|
||||
spec:
|
||||
concurrencyPolicy: Forbid
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
affinity:
|
||||
podAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: idm
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- args:
|
||||
- |
|
||||
set -eu
|
||||
echo "[backup] Syncing ${PVC}..."
|
||||
rclone sync "/pvc" "storagebox:ocis-volumes/${PVC}" \
|
||||
--links \
|
||||
--transfers=4 \
|
||||
-v
|
||||
echo "[backup] Done."
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
env:
|
||||
- name: PVC
|
||||
value: idm
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_TYPE
|
||||
value: sftp
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_PORT
|
||||
value: "23"
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
|
||||
value: /etc/storagebox/ssh-key
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: host
|
||||
name: ocis-storagebox-credentials
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: ocis-storagebox-credentials
|
||||
image: rclone/rclone:1.69.0
|
||||
name: rclone
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- mountPath: /pvc
|
||||
name: pvc
|
||||
readOnly: true
|
||||
- mountPath: /etc/storagebox
|
||||
name: storagebox-ssh
|
||||
readOnly: true
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 1009
|
||||
runAsGroup: 1009
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1009
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: pvc
|
||||
persistentVolumeClaim:
|
||||
claimName: idm-data
|
||||
- name: storagebox-ssh
|
||||
secret:
|
||||
defaultMode: 288
|
||||
items:
|
||||
- key: ssh-key
|
||||
path: ssh-key
|
||||
secretName: ocis-storagebox-credentials
|
||||
ttlSecondsAfterFinished: 86400
|
||||
schedule: 30 2 * * *
|
||||
successfulJobsHistoryLimit: 3
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
annotations:
|
||||
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
||||
name: ocis-volume-backup-storagesystem
|
||||
namespace: ocis
|
||||
spec:
|
||||
concurrencyPolicy: Forbid
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
affinity:
|
||||
podAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: storagesystem
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- args:
|
||||
- |
|
||||
set -eu
|
||||
echo "[backup] Syncing ${PVC}..."
|
||||
rclone sync "/pvc" "storagebox:ocis-volumes/${PVC}" \
|
||||
--links \
|
||||
--transfers=4 \
|
||||
-v
|
||||
echo "[backup] Done."
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
env:
|
||||
- name: PVC
|
||||
value: storagesystem
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_TYPE
|
||||
value: sftp
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_PORT
|
||||
value: "23"
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
|
||||
value: /etc/storagebox/ssh-key
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: host
|
||||
name: ocis-storagebox-credentials
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: ocis-storagebox-credentials
|
||||
image: rclone/rclone:1.69.0
|
||||
name: rclone
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- mountPath: /pvc
|
||||
name: pvc
|
||||
readOnly: true
|
||||
- mountPath: /etc/storagebox
|
||||
name: storagebox-ssh
|
||||
readOnly: true
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 1009
|
||||
runAsGroup: 1009
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1009
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: pvc
|
||||
persistentVolumeClaim:
|
||||
claimName: storagesystem-data
|
||||
- name: storagebox-ssh
|
||||
secret:
|
||||
defaultMode: 288
|
||||
items:
|
||||
- key: ssh-key
|
||||
path: ssh-key
|
||||
secretName: ocis-storagebox-credentials
|
||||
ttlSecondsAfterFinished: 86400
|
||||
schedule: 30 2 * * *
|
||||
successfulJobsHistoryLimit: 3
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
annotations:
|
||||
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
||||
name: ocis-volume-backup-storageusers
|
||||
namespace: ocis
|
||||
spec:
|
||||
concurrencyPolicy: Forbid
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
affinity:
|
||||
podAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: storageusers
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- args:
|
||||
- |
|
||||
set -eu
|
||||
echo "[backup] Syncing ${PVC}..."
|
||||
rclone sync "/pvc" "storagebox:ocis-volumes/${PVC}" \
|
||||
--links \
|
||||
--transfers=4 \
|
||||
-v
|
||||
echo "[backup] Done."
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
env:
|
||||
- name: PVC
|
||||
value: storageusers
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_TYPE
|
||||
value: sftp
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_PORT
|
||||
value: "23"
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
|
||||
value: /etc/storagebox/ssh-key
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
|
||||
value: none
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: host
|
||||
name: ocis-storagebox-credentials
|
||||
- name: RCLONE_CONFIG_STORAGEBOX_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: ocis-storagebox-credentials
|
||||
image: rclone/rclone:1.69.0
|
||||
name: rclone
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- mountPath: /pvc
|
||||
name: pvc
|
||||
readOnly: true
|
||||
- mountPath: /etc/storagebox
|
||||
name: storagebox-ssh
|
||||
readOnly: true
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 1009
|
||||
runAsGroup: 1009
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1009
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: pvc
|
||||
persistentVolumeClaim:
|
||||
claimName: storageusers-data
|
||||
- name: storagebox-ssh
|
||||
secret:
|
||||
defaultMode: 288
|
||||
items:
|
||||
- key: ssh-key
|
||||
path: ssh-key
|
||||
secretName: ocis-storagebox-credentials
|
||||
ttlSecondsAfterFinished: 86400
|
||||
schedule: 30 2 * * *
|
||||
successfulJobsHistoryLimit: 3
|
||||
Loading…
Reference in a new issue