188 lines
6.3 KiB
YAML
188 lines
6.3 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: s3-backup-script
|
|
namespace: rook-ceph
|
|
data:
|
|
buckets.list: |
|
|
nextcloud nextcloud
|
|
wiki-js wiki-js
|
|
pixelfed pixelfed
|
|
quay quay
|
|
influxdb influxdb
|
|
asciinema asciinema
|
|
nextcloud-new nextcloud
|
|
loops loops
|
|
synapse synapse
|
|
authentik authentik
|
|
mastodon mastodon
|
|
gramps gramps
|
|
backup.sh: |
|
|
#!/bin/sh
|
|
set -eu
|
|
backup_fs=$(awk '$2 == "/backup" { print $3; exit }' /proc/mounts)
|
|
echo "Backup filesystem: $backup_fs"
|
|
test "$backup_fs" = bcachefs
|
|
endpoint=http://rook-ceph-rgw-my-store.rook-ceph.svc:80
|
|
failures=0
|
|
while read -r bucket owner; do
|
|
test -n "$bucket" || continue
|
|
remote="BACKUP_$(printf '%s' "$bucket" | tr '[:lower:]-' '[:upper:]_')"
|
|
access_key=$(cat "/run/rgw/$owner/AccessKey")
|
|
secret_key=$(cat "/run/rgw/$owner/SecretKey")
|
|
test -n "$access_key" -a -n "$secret_key"
|
|
export "RCLONE_CONFIG_${remote}_TYPE=s3"
|
|
export "RCLONE_CONFIG_${remote}_PROVIDER=Ceph"
|
|
export "RCLONE_CONFIG_${remote}_ENDPOINT=$endpoint"
|
|
export "RCLONE_CONFIG_${remote}_REGION="
|
|
export "RCLONE_CONFIG_${remote}_ACCESS_KEY_ID=$access_key"
|
|
export "RCLONE_CONFIG_${remote}_SECRET_ACCESS_KEY=$secret_key"
|
|
unset access_key secret_key
|
|
echo "Syncing RGW bucket $bucket"
|
|
if ! rclone --config /dev/null sync "$remote:$bucket" "/backup/$bucket" --transfers 2 --checkers 4 --stats 1m; then
|
|
echo "RGW backup failed for bucket $bucket" >&2
|
|
failures=$((failures + 1))
|
|
fi
|
|
done < /scripts/buckets.list
|
|
test "$failures" -eq 0 || exit 1
|
|
echo "Completed all RGW bucket mirrors"
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: s3-backup
|
|
namespace: rook-ceph
|
|
spec:
|
|
schedule: "0 13 * * *"
|
|
timeZone: Europe/Vienna
|
|
concurrencyPolicy: Forbid
|
|
startingDeadlineSeconds: 3600
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 7
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
activeDeadlineSeconds: 172800
|
|
template:
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: arschrock
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
automountServiceAccountToken: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsUser: 962
|
|
runAsGroup: 962
|
|
containers:
|
|
- name: rclone
|
|
image: rclone/rclone:1.75.0
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/bin/sh, /scripts/backup.sh]
|
|
env:
|
|
- name: XDG_CONFIG_HOME
|
|
value: /tmp/.config
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
- name: rgw-asciinema
|
|
mountPath: /run/rgw/asciinema
|
|
readOnly: true
|
|
- name: rgw-authentik
|
|
mountPath: /run/rgw/authentik
|
|
readOnly: true
|
|
- name: rgw-gramps
|
|
mountPath: /run/rgw/gramps
|
|
readOnly: true
|
|
- name: rgw-influxdb
|
|
mountPath: /run/rgw/influxdb
|
|
readOnly: true
|
|
- name: rgw-loops
|
|
mountPath: /run/rgw/loops
|
|
readOnly: true
|
|
- name: rgw-mastodon
|
|
mountPath: /run/rgw/mastodon
|
|
readOnly: true
|
|
- name: rgw-nextcloud
|
|
mountPath: /run/rgw/nextcloud
|
|
readOnly: true
|
|
- name: rgw-pixelfed
|
|
mountPath: /run/rgw/pixelfed
|
|
readOnly: true
|
|
- name: rgw-quay
|
|
mountPath: /run/rgw/quay
|
|
readOnly: true
|
|
- name: rgw-synapse
|
|
mountPath: /run/rgw/synapse
|
|
readOnly: true
|
|
- name: rgw-wiki-js
|
|
mountPath: /run/rgw/wiki-js
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: backup
|
|
hostPath:
|
|
path: /mnt/backup/kubernetes/s3
|
|
type: Directory
|
|
- name: scripts
|
|
configMap:
|
|
name: s3-backup-script
|
|
defaultMode: 0555
|
|
- name: rgw-asciinema
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-asciinema
|
|
defaultMode: 0444
|
|
- name: rgw-authentik
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-authentik
|
|
defaultMode: 0444
|
|
- name: rgw-gramps
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-gramps
|
|
defaultMode: 0444
|
|
- name: rgw-influxdb
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-influxdb
|
|
defaultMode: 0444
|
|
- name: rgw-loops
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-loops
|
|
defaultMode: 0444
|
|
- name: rgw-mastodon
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-mastodon
|
|
defaultMode: 0444
|
|
- name: rgw-nextcloud
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-nextcloud
|
|
defaultMode: 0444
|
|
- name: rgw-pixelfed
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-pixelfed
|
|
defaultMode: 0444
|
|
- name: rgw-quay
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-quay
|
|
defaultMode: 0444
|
|
- name: rgw-synapse
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-synapse
|
|
defaultMode: 0444
|
|
- name: rgw-wiki-js
|
|
secret:
|
|
secretName: rook-ceph-object-user-my-store-wiki-js
|
|
defaultMode: 0444
|
|
- name: tmp
|
|
emptyDir: {}
|