Skip to content

Commit 29828d4

Browse files
aabarisaabaris
committed
Add backup deployment to nerc-shift-1
1 parent 0d78eec commit 29828d4

11 files changed

Lines changed: 246 additions & 0 deletions

‎k8s/base/openstack-api-backup-cron.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,21 @@ spec:
1616
runAsUser: 1001
1717
runAsGroup: 1001
1818
fsGroup: 1001
19+
runAsNonRoot: true
20+
seccompProfileProfile:
21+
type: RuntimeDefault
1922
containers:
2023
- name: openstack-api-backup
2124
image: ghcr.io/nerc-project/openstack-api-backup:main
2225
imagePullPolicy: Always
26+
securityContext:
27+
allowPrivilegeEscalation: false
28+
runAsNonRoot: true
29+
capabilities:
30+
drop:
31+
- ALL
32+
seccompProfile:
33+
type: RuntimeDefault
2334
env:
2435
- name: HOME
2536
value: '/tmp'

‎k8s/overlays/nerc-shift-1/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
namespace: default
3+
resources:
4+
- ../../base
5+
- secrets
6+
- pvc.yaml
7+
8+
patchesStrategicMerge:
9+
- patches/patch-openstack-api-backup-cron.yaml

‎k8s/overlays/nerc-shift-1/patches/patch-openstack-api-backup-cron.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: openstack-api-backup
6+
namespace: openstack-api-backup
7+
spec:
8+
schedule: 4 * * * *
9+
jobTemplate:
10+
spec:
11+
template:
12+
spec:
13+
containers:
14+
- name: openstack-api-backup
15+
env:
16+
- name: S3_ENDPOINT
17+
valueFrom:
18+
$patch: replace
19+
secretKeyRef:
20+
name: openstack-api-backup
21+
key: s3_endpoint
22+
- name: S3_BUCKET_URI
23+
valueFrom:
24+
$patch: replace
25+
secretKeyRef:
26+
name: openstack-api-backup
27+
key: s3_bucket_uri
28+
- name: BACKUP_ROTATE
29+
valueFrom:
30+
$patch: replace
31+
secretKeyRef:
32+
name: openstack-api-backup
33+
key: backup_rotate
34+
- name: OS_AUTH_TYPE
35+
value: v3applicationcredential
36+
- name: OS_AUTH_URL
37+
valueFrom:
38+
$patch: replace
39+
secretKeyRef:
40+
name: openstack-api-backup
41+
key: os_auth_url
42+
- name: OS_APPLICATION_CREDENTIAL_ID
43+
valueFrom:
44+
$patch: replace
45+
secretKeyRef:
46+
name: openstack-api-backup
47+
key: os_application_credential_id
48+
- name: OS_APPLICATION_CREDENTIAL_SECRET
49+
valueFrom:
50+
$path: replace
51+
secretKeyRef:
52+
name: openstack-api-backup
53+
key: os_application_credential_secret

‎k8s/overlays/nerc-shift-1/pvc.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: openstack-api-backup
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
resources:
10+
requests:
11+
storage: 2Gi

‎k8s/overlays/nerc-shift-1/secrets/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
resources:
3+
- openstack-api-backup.yaml

‎k8s/overlays/nerc-shift-1/secrets/openstack-api-backup.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
apiVersion: external-secrets.io/v1alpha1
3+
kind: ExternalSecret
4+
metadata:
5+
name: openstack-api-backup
6+
namespace: openstack-api-backup
7+
spec:
8+
refreshInterval: "15s"
9+
secretStoreRef:
10+
name: vault-backend
11+
kind: ClusterSecretStore
12+
target:
13+
name: openstack-api-backup
14+
data:
15+
- secretKey: aws_credentials
16+
remoteRef:
17+
key: accounts/holecs
18+
property: awscli_credentials
19+
- secretKey: backup_rotate
20+
remoteRef:
21+
key: openstack-api-backup/config
22+
property: backup_rotate
23+
- secretKey: s3_endpoint
24+
remoteRef:
25+
key: openstack-api-backup/config
26+
property: s3_endpoint
27+
- secretKey: s3_bucket_uri
28+
remoteRef:
29+
key: openstack-api-backup/config
30+
property: s3_bucket_uri
31+
- secretKey: os_auth_url
32+
remoteRef:
33+
key: openstack-api-backup/config
34+
property: os_auth_url
35+
- secretKey: os_application_credential_id
36+
remoteRef:
37+
key: openstack-api-backup/config
38+
property: os_application_credential_id
39+
- secretKey: os_application_credential_secret
40+
remoteRef:
41+
key: openstack-api-backup/config
42+
property: os_application_credential_secret

‎k8s/overlays/ocp-aa-test/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
namespace: openstack-api-backup
3+
resources:
4+
- ../../base
5+
- secrets
6+
- pvc.yaml
7+
8+
patchesStrategicMerge:
9+
- patches/patch-openstack-api-backup-cron.yaml

‎k8s/overlays/ocp-aa-test/patches/patch-openstack-api-backup-cron.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: openstack-api-backup
6+
namespace: openstack-api-backup
7+
spec:
8+
jobTemplate:
9+
spec:
10+
template:
11+
spec:
12+
containers:
13+
- name: openstack-api-backup
14+
env:
15+
- name: S3_ENDPOINT
16+
valueFrom:
17+
$patch: replace
18+
secretKeyRef:
19+
name: openstack-api-backup
20+
key: s3_endpoint
21+
- name: S3_BUCKET_URI
22+
valueFrom:
23+
$patch: replace
24+
secretKeyRef:
25+
name: openstack-api-backup
26+
key: s3_bucket_uri
27+
- name: BACKUP_ROTATE
28+
valueFrom:
29+
$patch: replace
30+
secretKeyRef:
31+
name: openstack-api-backup
32+
key: backup_rotate
33+
- name: OS_AUTH_TYPE
34+
value: v3applicationcredential
35+
- name: OS_AUTH_URL
36+
valueFrom:
37+
$patch: replace
38+
secretKeyRef:
39+
name: openstack-api-backup
40+
key: os_auth_url
41+
- name: OS_APPLICATION_CREDENTIAL_ID
42+
valueFrom:
43+
$patch: replace
44+
secretKeyRef:
45+
name: openstack-api-backup
46+
key: os_application_credential_id
47+
- name: OS_APPLICATION_CREDENTIAL_SECRET
48+
valueFrom:
49+
$path: replace
50+
secretKeyRef:
51+
name: openstack-api-backup
52+
key: os_application_credential_secret

‎k8s/overlays/ocp-aa-test/pvc.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: openstack-api-backup
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
resources:
10+
requests:
11+
storage: 2Gi

‎k8s/overlays/ocp-aa-test/secrets/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
resources:
3+
- openstack-api-backup.yaml

0 commit comments

Comments
 (0)