Thore CimbalandClaude Sonnet 5
bccd265302
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Live testing showed pg_dump got "Connection refused" immediately at job start, but a manual pg_isready/psql from an identically-labeled pod a few seconds later succeeded fine every time. The cluster's NetworkPolicy controller needs a brief moment to program a brand-new pod's IP into the target's allowed ingress rules; a job that starts dumping instantly can race that window. backup.sh now waits for pg_isready before each pg_dump (up to 15 tries / ~30s) instead of assuming connectivity is ready at container start. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
86 lines
2.9 KiB
YAML
86 lines
2.9 KiB
YAML
# Nightly Borg backup of the authentik Postgres database to a Hetzner Storage Box
|
|
# (issues #6 + #15). See apps/authentik/authentik-backup-secret.yaml for the SSH key +
|
|
# Borg repo passphrase, and apps/production/synapse-backup.yaml for the matrix-side job
|
|
# (same Storage Box, separate repo/passphrase, offset schedule).
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-backup-known-hosts
|
|
namespace: authentik
|
|
data:
|
|
known_hosts: |
|
|
[u641795.your-storagebox.de]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: authentik-backup
|
|
namespace: authentik
|
|
spec:
|
|
schedule: "15 3 * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: authentik-backup
|
|
app.kubernetes.io/component: backup
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: backup
|
|
image: rohana.axion1337.de/sorb/axion-backup:v2
|
|
env:
|
|
- name: BORG_REPO
|
|
value: "ssh://u641795@u641795.your-storagebox.de:23/./authentik-backup"
|
|
- name: BORG_PASSPHRASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-backup-credentials
|
|
key: borg-passphrase
|
|
- name: SSH_PRIVATE_KEY_FILE
|
|
value: /secrets/ssh/ssh-private-key
|
|
- name: SSH_KNOWN_HOSTS_FILE
|
|
value: /secrets/known-hosts/known_hosts
|
|
- name: DB_HOSTS
|
|
value: "authentik:authentik-postgresql"
|
|
- name: PGUSER
|
|
value: authentik
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: pg-password
|
|
volumeMounts:
|
|
- name: ssh-key
|
|
mountPath: /secrets/ssh
|
|
readOnly: true
|
|
- name: known-hosts
|
|
mountPath: /secrets/known-hosts
|
|
readOnly: true
|
|
- name: scratch
|
|
mountPath: /scratch
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
volumes:
|
|
- name: ssh-key
|
|
secret:
|
|
secretName: authentik-backup-credentials
|
|
items:
|
|
- key: ssh-private-key
|
|
path: ssh-private-key
|
|
mode: 0400
|
|
- name: known-hosts
|
|
configMap:
|
|
name: authentik-backup-known-hosts
|
|
- name: scratch
|
|
emptyDir: {}
|