107 lines
3.8 KiB
YAML
107 lines
3.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: postgresql-backup-script
|
|
data:
|
|
backup.sh: |
|
|
#!/bin/sh
|
|
set -eu
|
|
test "$(stat -f -c %T /backup)" = bcachefs
|
|
case "$BACKUP_TARGET" in *[!a-zA-Z0-9_-]*|'') echo "Invalid backup target" >&2; exit 1 ;; esac
|
|
PGUSER="${PGUSER:-postgres}"
|
|
PGDATABASE="${PGDATABASE:-postgres}"
|
|
export PGUSER PGDATABASE
|
|
test -n "$PGHOST" -a -n "$PGUSER" -a -n "$PGPASSWORD"
|
|
root="/backup/kubernetes/postgresql/$BACKUP_TARGET"
|
|
mkdir -p "$root"
|
|
run="$root/$(date -u +%Y-%m-%dT%H-%M-%SZ)"
|
|
mkdir -m 0700 "$run"
|
|
if [ "$BACKUP_MODE" = all ]; then
|
|
pg_dumpall --globals-only --no-role-passwords > "$run/globals.sql.partial"
|
|
test -s "$run/globals.sql.partial"
|
|
mv "$run/globals.sql.partial" "$run/globals.sql"
|
|
psql -AtX -v ON_ERROR_STOP=1 -d postgres -c 'SELECT datname FROM pg_database WHERE datallowconn AND NOT datistemplate ORDER BY datname' > "$run/databases.list"
|
|
while IFS= read -r database; do
|
|
case "$database" in *[!a-zA-Z0-9_-]*|'') echo "Invalid database name" >&2; exit 1 ;; esac
|
|
pg_dump --format=custom --file="$run/$database.dump.partial" --dbname="$database"
|
|
pg_restore --list "$run/$database.dump.partial" >/dev/null
|
|
mv "$run/$database.dump.partial" "$run/$database.dump"
|
|
done < "$run/databases.list"
|
|
test "$(find "$run" -maxdepth 1 -name '*.dump' | wc -l)" -gt 0
|
|
else
|
|
case "$PGDATABASE" in *[!a-zA-Z0-9_-]*|'') echo "Invalid database name" >&2; exit 1 ;; esac
|
|
pg_dump --format=custom --file="$run/$PGDATABASE.dump.partial" --dbname="$PGDATABASE"
|
|
pg_restore --list "$run/$PGDATABASE.dump.partial" >/dev/null
|
|
mv "$run/$PGDATABASE.dump.partial" "$run/$PGDATABASE.dump"
|
|
fi
|
|
date -u +%FT%TZ > "$run/complete"
|
|
echo "Completed PostgreSQL backup for $BACKUP_TARGET at $run"
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: postgresql-backup
|
|
spec:
|
|
schedule: "30 2 * * *"
|
|
timeZone: Europe/Vienna
|
|
concurrencyPolicy: Forbid
|
|
startingDeadlineSeconds: 600
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 7
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
activeDeadlineSeconds: 21600
|
|
template:
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: arschrock
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
automountServiceAccountToken: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsUser: 962
|
|
runAsGroup: 962
|
|
containers:
|
|
- name: pg-dump
|
|
image: postgres:18.6
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/bin/sh, /scripts/backup.sh]
|
|
env:
|
|
- name: BACKUP_TARGET
|
|
value: target
|
|
- name: BACKUP_MODE
|
|
value: all
|
|
- name: PGHOST
|
|
value: postgresql
|
|
- name: PGSSLMODE
|
|
value: prefer
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-backup-credentials
|
|
key: password
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
volumes:
|
|
- name: backup
|
|
hostPath:
|
|
path: /mnt/backup
|
|
type: Directory
|
|
- name: scripts
|
|
configMap:
|
|
name: postgresql-backup-script
|
|
defaultMode: 0555
|