89 lines
3.1 KiB
YAML
89 lines
3.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: arschrock-postgresql-backup
|
|
namespace: backup
|
|
data:
|
|
backup.sh: |
|
|
#!/bin/sh
|
|
set -eu
|
|
test "$(stat -f -c %T /backup)" = bcachefs
|
|
test -d /backup/kubernetes/postgresql/arschrock
|
|
test "$(stat -c %u /backup/kubernetes/postgresql/arschrock)" = 962
|
|
test -S /postgresql/.s.PGSQL.5432
|
|
export PGHOST=/postgresql PGUSER=postgres PGDATABASE=postgres
|
|
destination="/backup/kubernetes/postgresql/arschrock/$(date -u +%Y-%m-%dT%H-%M-%SZ)"
|
|
mkdir -m 0700 "$destination"
|
|
pg_dumpall --globals-only > "$destination/globals.sql.partial"
|
|
test -s "$destination/globals.sql.partial"
|
|
mv "$destination/globals.sql.partial" "$destination/globals.sql"
|
|
psql -AtX -v ON_ERROR_STOP=1 -c 'SELECT datname FROM pg_database WHERE datallowconn AND NOT datistemplate ORDER BY datname' > "$destination/databases.list"
|
|
while IFS= read -r database; do
|
|
case "$database" in
|
|
*[!a-zA-Z0-9_-]*|'') echo "Unsafe database name: $database" >&2; exit 1 ;;
|
|
esac
|
|
pg_dump --format=custom --file="$destination/$database.dump.partial" --dbname="$database"
|
|
pg_restore --list "$destination/$database.dump.partial" >/dev/null
|
|
mv "$destination/$database.dump.partial" "$destination/$database.dump"
|
|
done < "$destination/databases.list"
|
|
test "$(find "$destination" -maxdepth 1 -name '*.dump' | wc -l)" -gt 0
|
|
date -u +%FT%TZ > "$destination/complete"
|
|
echo "Completed PostgreSQL backup at $destination"
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: arschrock-postgresql-backup
|
|
namespace: backup
|
|
spec:
|
|
schedule: "15 2 * * *"
|
|
timeZone: Europe/Vienna
|
|
concurrencyPolicy: Forbid
|
|
startingDeadlineSeconds: 3600
|
|
successfulJobsHistoryLimit: 7
|
|
failedJobsHistoryLimit: 7
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
activeDeadlineSeconds: 14400
|
|
template:
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: arschrock
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsUser: 962
|
|
runAsGroup: 962
|
|
containers:
|
|
- name: pg-dump
|
|
image: postgres:18.6
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/bin/sh, /scripts/backup.sh]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
- name: postgresql-socket
|
|
mountPath: /postgresql
|
|
readOnly: true
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
volumes:
|
|
- name: backup
|
|
hostPath:
|
|
path: /mnt/backup
|
|
type: Directory
|
|
- name: postgresql-socket
|
|
hostPath:
|
|
path: /run/postgresql
|
|
type: Directory
|
|
- name: scripts
|
|
configMap:
|
|
name: arschrock-postgresql-backup
|
|
defaultMode: 0555
|