Will Anderson
b1867a542d
Snapshot via vault operator raft snapshot save using a least-privilege periodic token. Stored in legion-vault-backup R2 bucket via restic. Retains 30 daily / 12 weekly / 6 monthly snapshots. Runs at 3am, offset from the Gitea backup at 2am.
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
---
|
|
# vault-backup-credentials — R2 keys + restic password + Vault snapshot token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: vault-backup-credentials
|
|
namespace: vault
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: vault-backup-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
VAULT_SNAPSHOT_TOKEN: "{{ .snapshot_token }}"
|
|
RESTIC_PASSWORD: "vault-restic-2026"
|
|
AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
|
|
RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-vault-backup"
|
|
data:
|
|
- secretKey: snapshot_token
|
|
remoteRef:
|
|
key: secret/data/vault/snapshot-token
|
|
property: token
|
|
- secretKey: r2_access_key_id
|
|
remoteRef:
|
|
key: secret/data/r2
|
|
property: access_key_id
|
|
- secretKey: r2_secret_access_key
|
|
remoteRef:
|
|
key: secret/data/r2
|
|
property: secret_access_key
|