unkinben
6e8a061b94
Step 1 of moving the CNPG backup buckets to ec placement: RGW can't move an existing bucket, so they must be dropped and recreated. This lets the operator actually delete the buckets (with their objects) when the CRs are removed in step 2. - set retainOnDelete: false and purgeOnDelete: true on all nine cnpg backup Bucket CRs - leave ObjectStoreUser/BucketAccess untouched so the backup-s3 secrets persist Reviewed-on: #313 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
---
|
|
# Ceph RGW (S3) backup target for the authentik CNPG cluster, provisioned by the
|
|
# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
|
|
# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
|
|
# its own namespace, so backups are per-database rather than one shared bucket.
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: ObjectStoreUser
|
|
metadata:
|
|
name: cnpg-authentik-backup
|
|
namespace: authentik
|
|
spec:
|
|
displayName: "CNPG backup owner (authentik)"
|
|
# RGW users are global; keep the uid namespace-qualified so it never collides.
|
|
uid: cnpg-authentik-backup
|
|
maxBuckets: 5
|
|
# Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
|
|
# S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
|
|
secretName: cnpg-authentik-backup-s3
|
|
# Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
|
|
# in-flight restore can still reach the archive.
|
|
retainOnDelete: true
|
|
---
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: Bucket
|
|
metadata:
|
|
name: cnpg-authentik
|
|
namespace: authentik
|
|
spec:
|
|
placementTarget: ec
|
|
bucketName: cnpg-authentik
|
|
# The owner user has full control of its own bucket (read + write), which is
|
|
# all the backup/restore identity needs — no extra BucketAccess grant.
|
|
ownerRef: cnpg-authentik-backup
|
|
versioning: false
|
|
tags:
|
|
app: authentik
|
|
purpose: cnpg-backup
|
|
# Never drop the backups if the CR is removed; retire buckets by hand.
|
|
retainOnDelete: false
|
|
purgeOnDelete: true
|
|
---
|
|
# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
|
|
# spec.backup.barmanObjectStore; this schedules the periodic full backup that
|
|
# WAL is layered on top of. Schedules are staggered across clusters so the 8
|
|
# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: ScheduledBackup
|
|
metadata:
|
|
name: cnpg-authentik-nightly
|
|
namespace: authentik
|
|
spec:
|
|
schedule: "0 0 1 * * *"
|
|
immediate: false
|
|
backupOwnerReference: self
|
|
method: barmanObjectStore
|
|
cluster:
|
|
name: postgres
|