SmokyZoneandClaude Sonnet 5
2ee46ceb4a
- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
83 lines
2.7 KiB
YAML
83 lines
2.7 KiB
YAML
{{- if .Values.backup.enabled }}
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: expense-tracker-backups
|
|
namespace: {{ .Values.namespace.name }}
|
|
labels:
|
|
app.kubernetes.io/name: expense-tracker-backup
|
|
{{- include "expense-tracker.labels" . | nindent 4 }}
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
{{- if .Values.backup.persistence.storageClassName }}
|
|
storageClassName: {{ .Values.backup.persistence.storageClassName }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.backup.persistence.size }}
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: expense-tracker-backup
|
|
namespace: {{ .Values.namespace.name }}
|
|
labels:
|
|
app.kubernetes.io/name: expense-tracker-backup
|
|
{{- include "expense-tracker.labels" . | nindent 4 }}
|
|
spec:
|
|
schedule: {{ .Values.backup.schedule | quote }}
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 2
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: expense-tracker-backup
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
securityContext:
|
|
runAsUser: 70
|
|
runAsGroup: 70
|
|
fsGroup: 70
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: pg-dump
|
|
image: {{ .Values.postgres.image | quote }}
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- |
|
|
f="/backup/{{ .Values.postgres.database }}-$(date +%Y%m%d-%H%M%S).dump"
|
|
# Write to a temp name first so a failed dump never looks like a good backup.
|
|
pg_dump --format=custom --no-owner -f "$f.partial"
|
|
mv "$f.partial" "$f"
|
|
echo "wrote $f ($(du -h "$f" | cut -f1))"
|
|
find /backup -name '*.dump' -mtime +{{ .Values.backup.retentionDays }} -print -delete
|
|
find /backup -name '*.partial' -mmin +60 -delete
|
|
ls -lh /backup
|
|
env:
|
|
{{- include "expense-tracker.pgenv" . | nindent 16 }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 256Mi
|
|
volumeMounts:
|
|
- name: backups
|
|
mountPath: /backup
|
|
volumes:
|
|
- name: backups
|
|
persistentVolumeClaim:
|
|
claimName: expense-tracker-backups
|
|
{{- end }}
|