unkin-agent
9da206dc7c
PVCs and CloudNativePG Clusters need S3 buckets and backup schedules
provisioned consistently. This operator watches the
backups.unkin.net/{schedule,destination} annotations on those objects and
provisions everything needed to back them up, with no new CRDs.
- Add a PVC controller that provisions cephrgw ObjectStoreUser/Bucket/BucketAccess,
auto-generates a restic repo-password Secret and creates a k8up Schedule scoped
to the PVC via spec.backup.volumes[].persistentVolumeClaim.claimName.
- Add a CNPG Cluster controller that provisions the same bucket stack, idempotently
patches spec.backup.barmanObjectStore (leaving a user-set destinationPath alone
with a Warning event) and creates a ScheduledBackup.
- Resolve destinations through a ConfigMap lookup table; requeue until the
BucketAccess is Ready before creating schedule resources; own-reference created
resources and retain bucket data by default.
- Add schedule-mapping helpers (k8up 5-field/shortcut pass-through, CNPG 6-field
seconds-first) and deterministic, length-bounded name derivation.
- Add unit tests (schedule mapping, name derivation, destination resolution) and
envtest controller tests for both paths, wiring the external CRDs into envtest.
- Add kubebuilder-generated RBAC, a Dockerfile (distroless/nonroot), Woodpecker
lint/test/build pipelines and a tag-triggered image push to the artifactapi
docker-internal registry, plus a version-bump Makefile and deploy manifests.
autobackup-operator
A Kubernetes operator that watches for backups.unkin.net/* annotations on
PersistentVolumeClaims and CloudNativePG Clusters and provisions the S3
bucket + backup-schedule resources needed to back them up. No new CRDs — it is
purely annotation-driven on existing objects.
Annotations
| Annotation | Meaning |
|---|---|
backups.unkin.net/schedule |
@hourly / @daily / @weekly (plus @monthly/@yearly) or a raw cron expression. Absence means "not managed". |
backups.unkin.net/destination |
A logical destination name resolved via the destinations ConfigMap. |
backups.unkin.net/purge-on-delete |
"true" opts into deleting the bucket stack when the schedule annotation is removed (default: retain bucket data). |
What it does
For every annotated object the operator, in the object's own namespace and owner-referenced to it:
- Provisions a cephrgw (
ceph.unkin.net/v1alpha1)ObjectStoreUser,Bucket(versioning: true,retainOnDelete: true) and read-writeBucketAccess. - Waits for the
BucketAccessto becomeReady(requeues until then). - Then wires up the backup schedule:
- PVC → k8up (
k8up.io/v1Schedule): S3 backend from the cephrgw credential Secret, an auto-generated restic repo-password Secret, and the backup scoped to exactly this PVC viaspec.backup.volumes[].persistentVolumeClaim.claimName. Sane prune retention (keepDaily 7, keepWeekly 4). - CNPG Cluster (
postgresql.cnpg.io/v1): patchesspec.backup.barmanObjectStore(idempotently; a user-set differentdestinationPathis left untouched with a Warning event) and creates aScheduledBackupwith a 6-field (seconds-first) cron.
- PVC → k8up (
Destinations ConfigMap
The operator resolves destination names against a ConfigMap in its own
namespace (autobackup-operator/autobackup-destinations by default). See
config/samples/destinations.yaml.
Schedule mapping
- k8up accepts cron nicknames natively and 5-field cron expressions; the value is validated and passed through.
- CNPG requires a 6-field (seconds-first) cron: nicknames are expanded and a
5-field cron gains a leading
0seconds field.
Invalid schedules surface as Warning events on the annotated object.
Development
make build # build the operator binary
make test # unit + envtest controller tests (fetches envtest binaries)
make lint # go vet
make generate # regenerate config/rbac/role.yaml from kubebuilder markers
Dependencies are vendored so the container build and CI need no access to the
private cephrgw-operator module.
Release
make patch|minor|major tags and pushes vX.Y.Z. A v* tag triggers the
Woodpecker docker pipeline, which builds and pushes
artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator:<tag>.