---
# k8up Schedule: restic backups of the fafflix-config PVC (library metadata,
# plugins, config XML) to the dedicated Ceph RGW config-backup bucket. S3 creds
# come from the cephrgw BucketAccess Secret (fafflix-config-backup-s3); the
# restic repo password comes from Vault via the fafflix-k8up-restic Secret.
#
# s3.ceph.unkin.net presents the internal unkin.net CA, which the k8up/restic
# image does not trust by default, so the reflected vault-ca-cert Secret is
# mounted into every job pod and pointed at via backend.tlsOptions.caCert.
apiVersion: k8up.io/v1
kind: Schedule
metadata:
  name: fafflix-config
  namespace: fafflix
spec:
  backend:
    repoPasswordSecretRef:
      name: fafflix-k8up-restic
      key: password
    s3:
      endpoint: https://s3.ceph.unkin.net
      bucket: fafflix-config-backup
      accessKeyIDSecretRef:
        name: fafflix-config-backup-s3
        key: AWS_ACCESS_KEY_ID
      secretAccessKeySecretRef:
        name: fafflix-config-backup-s3
        key: AWS_SECRET_ACCESS_KEY
    tlsOptions:
      caCert: /etc/k8up/ca/ca.crt
    volumeMounts:
      - name: vault-ca
        mountPath: /etc/k8up/ca
        readOnly: true
  backup:
    schedule: "0 2 * * *"
    failedJobsHistoryLimit: 3
    successfulJobsHistoryLimit: 3
    volumes:
      - name: vault-ca
        secret:
          secretName: vault-ca-cert
  prune:
    schedule: "0 3 * * 0"
    retention:
      keepDaily: 14
      keepWeekly: 8
      keepMonthly: 12
    volumes:
      - name: vault-ca
        secret:
          secretName: vault-ca-cert
  check:
    schedule: "0 4 * * 0"
    volumes:
      - name: vault-ca
        secret:
          secretName: vault-ca-cert