Add user-engine backup and rollback verification

sso-mfa/k8s/user-engine/restore-drill.yaml

@@ -0,0 +1,62 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: user-engine-restore-drill
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine-restore-drill
+    app.kubernetes.io/part-of: user-engine
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: user-engine-restore-drill
+        app.kubernetes.io/part-of: user-engine
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 26
+        runAsGroup: 26
+        fsGroup: 26
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: restore
+          image: ghcr.io/cloudnative-pg/postgresql:17.5
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - -ec
+            - |
+              latest="$(find /backup -type f -name 'user-engine-*.dump' | sort | tail -1)"
+              test -n "${latest}"
+              sha256sum --check "${latest}.sha256"
+              initdb --no-locale --encoding=UTF8 -D /restore/data >/dev/null
+              pg_ctl -D /restore/data -o '-k /tmp -p 55432' -w start >/dev/null
+              trap 'pg_ctl -D /restore/data -m immediate stop >/dev/null' EXIT
+              createdb -h /tmp -p 55432 user_engine_restore
+              pg_restore --exit-on-error --no-owner --no-acl \
+                -h /tmp -p 55432 -d user_engine_restore "${latest}"
+              tables="$(psql -At -h /tmp -p 55432 -d user_engine_restore \
+                -c "select count(*) from pg_catalog.pg_tables where schemaname='public'")"
+              migrations="$(psql -At -h /tmp -p 55432 -d user_engine_restore \
+                -c 'select count(*) from user_engine_schema_versions')"
+              test "${tables}" -gt 0
+              test "${migrations}" -gt 0
+              echo "restore_complete tables=${tables} migrations=${migrations}"
+          volumeMounts:
+            - {name: backup, mountPath: /backup, readOnly: true}
+            - {name: restore, mountPath: /restore}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: ["ALL"]}
+          resources:
+            requests: {cpu: 50m, memory: 128Mi}
+            limits: {cpu: "1", memory: 512Mi}
+      volumes:
+        - name: backup
+          persistentVolumeClaim: {claimName: user-engine-backups}
+        - name: restore
+          emptyDir: {}