121 lines
3.8 KiB
YAML
121 lines
3.8 KiB
YAML
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: user-engine-backups
|
|
namespace: user-engine
|
|
labels:
|
|
app.kubernetes.io/name: user-engine-backup
|
|
app.kubernetes.io/part-of: user-engine
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
resources:
|
|
requests: {storage: 1Gi}
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: user-engine-backup
|
|
namespace: user-engine
|
|
labels:
|
|
app.kubernetes.io/name: user-engine-backup
|
|
app.kubernetes.io/part-of: user-engine
|
|
spec:
|
|
schedule: "0 4 * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: user-engine-backup
|
|
app.kubernetes.io/part-of: user-engine
|
|
spec:
|
|
restartPolicy: Never
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 26
|
|
runAsGroup: 26
|
|
fsGroup: 26
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: backup
|
|
image: ghcr.io/cloudnative-pg/postgresql:17.5
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef: {name: user-engine-pg-app, key: uri}
|
|
command:
|
|
- /bin/bash
|
|
- -ec
|
|
- |
|
|
umask 077
|
|
stamp="$(date -u +%Y%m%dT%H%M%SZ)"
|
|
target="/backup/user-engine-${stamp}.dump"
|
|
for attempt in $(seq 1 30); do
|
|
if pg_isready --dbname="${DATABASE_URL}" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
test "${attempt}" -lt 30
|
|
sleep 2
|
|
done
|
|
pg_dump --format=custom --no-owner --no-acl \
|
|
--file="${target}.partial" "${DATABASE_URL}"
|
|
pg_restore --list "${target}.partial" >/dev/null
|
|
mv "${target}.partial" "${target}"
|
|
sha256sum "${target}" >"${target}.sha256"
|
|
find /backup -type f -name 'user-engine-*.dump*' -mtime +7 -delete
|
|
echo "backup_complete file=$(basename "${target}")"
|
|
volumeMounts:
|
|
- {name: backup, mountPath: /backup}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: 500m, memory: 256Mi}
|
|
volumes:
|
|
- name: backup
|
|
persistentVolumeClaim: {claimName: user-engine-backups}
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: user-engine-backup
|
|
namespace: user-engine
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: user-engine-backup
|
|
app.kubernetes.io/part-of: user-engine
|
|
policyTypes: [Egress]
|
|
egress:
|
|
- to:
|
|
- podSelector:
|
|
matchLabels: {cnpg.io/cluster: user-engine-pg}
|
|
ports: [{protocol: TCP, port: 5432}]
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels: {kubernetes.io/metadata.name: kube-system}
|
|
ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: user-engine-postgres-backup-ingress
|
|
namespace: user-engine
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {cnpg.io/cluster: user-engine-pg}
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: user-engine-backup
|
|
app.kubernetes.io/part-of: user-engine
|
|
ports: [{protocol: TCP, port: 5432}]
|