tegwick
a689270f18
Document OpenBao/warden paths for the offsite backup lane and flag the sealed Vault blocker. Point production Makefile targets at CoulombCore, auto-discover CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and record Core Hub Helm cutover findings (live gitea image, adopt required).
82 lines
No EOL
3 KiB
Bash
Executable file
82 lines
No EOL
3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
namespace="${CNPG_NAMESPACE:-databases}"
|
|
|
|
if ! kubectl get ns "$namespace" >/dev/null 2>&1; then
|
|
echo "ERROR: namespace $namespace is not reachable from the current kubeconfig" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "CNPG backup posture in namespace ${namespace}"
|
|
context="$(kubectl config current-context 2>/dev/null || echo unknown)"
|
|
server="$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}' 2>/dev/null || echo unknown)"
|
|
echo "kube-context: ${context}"
|
|
echo "api-server: ${server}"
|
|
echo
|
|
|
|
mapfile -t clusters < <(
|
|
kubectl get cluster -n "$namespace" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null \
|
|
| sort
|
|
)
|
|
if ((${#clusters[@]} == 0)); then
|
|
echo "ERROR: no CNPG Cluster resources in ${namespace}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
missing=0
|
|
logical_backup_note=0
|
|
|
|
for cluster in "${clusters[@]}"; do
|
|
if ! kubectl get cluster "$cluster" -n "$namespace" >/dev/null 2>&1; then
|
|
echo "${cluster}: MISSING (Cluster CR not found)"
|
|
missing=$((missing + 1))
|
|
echo
|
|
continue
|
|
fi
|
|
|
|
backup_spec="$(kubectl get cluster "$cluster" -n "$namespace" \
|
|
-o jsonpath='{.spec.backup}' 2>/dev/null || true)"
|
|
if [[ -z "$backup_spec" || "$backup_spec" == "null" ]]; then
|
|
echo "${cluster}: backup spec = null"
|
|
else
|
|
echo "${cluster}: backup spec configured"
|
|
fi
|
|
|
|
scheduled="$(kubectl get scheduledbackup -n "$namespace" \
|
|
-o jsonpath="{range .items[?(@.spec.cluster.name=='${cluster}')]}{.metadata.name}{' '}{end}" 2>/dev/null || true)"
|
|
scheduled="${scheduled%" "}"
|
|
if [[ -z "$scheduled" ]]; then
|
|
echo "${cluster}: ScheduledBackup = none"
|
|
missing=$((missing + 1))
|
|
if [[ "$cluster" == "apps-pg" || "$cluster" == "gitea-db" || "$cluster" == "forgejo-db" ]]; then
|
|
echo "${cluster}: Phase 1 fallback = logical pg_dump (see make apps-pg-backup-dry-run or platform forgejo-backup)"
|
|
logical_backup_note=1
|
|
fi
|
|
else
|
|
echo "${cluster}: ScheduledBackup = ${scheduled}"
|
|
fi
|
|
|
|
if command -v kubectl >/dev/null 2>&1 && kubectl cnpg status "$cluster" -n "$namespace" >/dev/null 2>&1; then
|
|
echo "${cluster}: kubectl cnpg status available"
|
|
kubectl cnpg status "$cluster" -n "$namespace" | sed -n '1,8p'
|
|
else
|
|
phase="$(kubectl get cluster "$cluster" -n "$namespace" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
|
|
instances="$(kubectl get cluster "$cluster" -n "$namespace" -o jsonpath='{.status.instances}' 2>/dev/null || true)"
|
|
echo "${cluster}: phase=${phase:-unknown} instances=${instances:-unknown}"
|
|
fi
|
|
|
|
echo
|
|
done
|
|
|
|
if (( missing > 0 )); then
|
|
echo "RESULT: degraded — ${missing} cluster(s) lack ScheduledBackup coverage"
|
|
echo "See docs/app-data-backup-restore-handoff.md and manifests/cnpg-backup-readiness.yaml"
|
|
if (( logical_backup_note )); then
|
|
echo "Phase 1: logical pg_dump lane may still run when OpenBao offsite-lane is reachable"
|
|
echo "See docs/credential-routing-railiance-apps.md"
|
|
fi
|
|
exit 1
|
|
fi
|
|
|
|
echo "RESULT: ok — all tracked clusters have ScheduledBackup resources" |