From 6a13ca758a1c55b43d4fcbf18f92ec0e9fe86d58 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 30 Jul 2026 23:44:50 +1000 Subject: [PATCH] cephrgw: recreate cnpg backup buckets on ec placement (step 3) (#316) Final step of the ec migration: the old buckets were purged in #315, so the operator will now create fresh ones on the ec placement target. Restores the nine Bucket CRs with placementTarget: ec and retainOnDelete: true (purge disabled again for safety). - re-add the nine cnpg backup Bucket resources on ec, retainOnDelete: true Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/316 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/artifactapi/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/authentik/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/encapi/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/grafana/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/litellm/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/netbox/cnpg_backup.yaml | 15 +++++++++++++++ apps/base/paperclip/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/puppet/cnpg_backup.yaml | 18 ++++++++++++++++++ apps/base/woodpecker/cnpg_backup.yaml | 18 ++++++++++++++++++ 9 files changed, 159 insertions(+) diff --git a/apps/base/artifactapi/cnpg_backup.yaml b/apps/base/artifactapi/cnpg_backup.yaml index 72c1efe..e96d678 100644 --- a/apps/base/artifactapi/cnpg_backup.yaml +++ b/apps/base/artifactapi/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-artifactapi + namespace: artifactapi +spec: + placementTarget: ec + bucketName: cnpg-artifactapi + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-artifactapi-backup + versioning: false + tags: + app: artifactapi + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/authentik/cnpg_backup.yaml b/apps/base/authentik/cnpg_backup.yaml index 7167dae..a10a041 100644 --- a/apps/base/authentik/cnpg_backup.yaml +++ b/apps/base/authentik/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-authentik + namespace: authentik +spec: + placementTarget: ec + bucketName: cnpg-authentik + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-authentik-backup + versioning: false + tags: + app: authentik + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/encapi/cnpg_backup.yaml b/apps/base/encapi/cnpg_backup.yaml index a7bcf5d..a03ca84 100644 --- a/apps/base/encapi/cnpg_backup.yaml +++ b/apps/base/encapi/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-encapi + namespace: encapi +spec: + placementTarget: ec + bucketName: cnpg-encapi + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-encapi-backup + versioning: false + tags: + app: encapi + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/grafana/cnpg_backup.yaml b/apps/base/grafana/cnpg_backup.yaml index 9d6f9df..654d23b 100644 --- a/apps/base/grafana/cnpg_backup.yaml +++ b/apps/base/grafana/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-grafana + namespace: grafana +spec: + placementTarget: ec + bucketName: cnpg-grafana + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-grafana-backup + versioning: false + tags: + app: grafana + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/litellm/cnpg_backup.yaml b/apps/base/litellm/cnpg_backup.yaml index c4bee5c..05710b0 100644 --- a/apps/base/litellm/cnpg_backup.yaml +++ b/apps/base/litellm/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-litellm + namespace: litellm +spec: + placementTarget: ec + bucketName: cnpg-litellm + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-litellm-backup + versioning: false + tags: + app: litellm + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/netbox/cnpg_backup.yaml b/apps/base/netbox/cnpg_backup.yaml index d32ecfd..bb4e2fd 100644 --- a/apps/base/netbox/cnpg_backup.yaml +++ b/apps/base/netbox/cnpg_backup.yaml @@ -19,6 +19,21 @@ spec: # Keep the RGW user (and thus the keys) if this CR is ever deleted. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-netbox + namespace: netbox +spec: + placementTarget: ec + bucketName: cnpg-netbox + ownerRef: cnpg-netbox-backup + versioning: false + tags: + app: netbox + purpose: cnpg-backup + retainOnDelete: true +--- apiVersion: postgresql.cnpg.io/v1 kind: ScheduledBackup metadata: diff --git a/apps/base/paperclip/cnpg_backup.yaml b/apps/base/paperclip/cnpg_backup.yaml index c3f2e90..19660f2 100644 --- a/apps/base/paperclip/cnpg_backup.yaml +++ b/apps/base/paperclip/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-paperclip + namespace: paperclip +spec: + placementTarget: ec + bucketName: cnpg-paperclip + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-paperclip-backup + versioning: false + tags: + app: paperclip + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/puppet/cnpg_backup.yaml b/apps/base/puppet/cnpg_backup.yaml index 65aec28..0251a81 100644 --- a/apps/base/puppet/cnpg_backup.yaml +++ b/apps/base/puppet/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-puppet + namespace: puppet +spec: + placementTarget: ec + bucketName: cnpg-puppet + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-puppet-backup + versioning: false + tags: + app: puppet + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8 diff --git a/apps/base/woodpecker/cnpg_backup.yaml b/apps/base/woodpecker/cnpg_backup.yaml index d9e6ce9..7dd023e 100644 --- a/apps/base/woodpecker/cnpg_backup.yaml +++ b/apps/base/woodpecker/cnpg_backup.yaml @@ -20,6 +20,24 @@ spec: # in-flight restore can still reach the archive. retainOnDelete: true --- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: cnpg-woodpecker + namespace: woodpecker +spec: + placementTarget: ec + bucketName: cnpg-woodpecker + # The owner user has full control of its own bucket (read + write), which is + # all the backup/restore identity needs — no extra BucketAccess grant. + ownerRef: cnpg-woodpecker-backup + versioning: false + tags: + app: woodpecker + purpose: cnpg-backup + # Never drop the backups if the CR is removed; retire buckets by hand. + retainOnDelete: true +--- # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's # spec.backup.barmanObjectStore; this schedules the periodic full backup that # WAL is layered on top of. Schedules are staggered across clusters so the 8