Will Anderson
b1867a542d
Snapshot via vault operator raft snapshot save using a least-privilege periodic token. Stored in legion-vault-backup R2 bucket via restic. Retains 30 daily / 12 weekly / 6 monthly snapshots. Runs at 3am, offset from the Gitea backup at 2am.
95 lines
2.9 KiB
YAML
95 lines
2.9 KiB
YAML
---
|
|
# Nightly Vault backup — raft snapshot → Cloudflare R2 via restic
|
|
# Schedule: 3am daily (offset from Gitea backup at 2am).
|
|
# Retains 30 daily / 12 weekly / 6 monthly snapshots.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: vault-backup
|
|
namespace: vault
|
|
spec:
|
|
schedule: "0 3 * * *"
|
|
concurrencyPolicy: Forbid
|
|
failedJobsHistoryLimit: 3
|
|
successfulJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
serviceAccountName: default
|
|
initContainers:
|
|
- name: vault-snapshot
|
|
image: hashicorp/vault:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Taking Vault raft snapshot..."
|
|
VAULT_TOKEN=$VAULT_SNAPSHOT_TOKEN \
|
|
vault operator raft snapshot save /snapshot/vault.snap
|
|
echo "Snapshot complete, size: $(du -sh /snapshot/vault.snap)"
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: "http://vault.vault.svc.cluster.local:8200"
|
|
- name: VAULT_SNAPSHOT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-backup-credentials
|
|
key: VAULT_SNAPSHOT_TOKEN
|
|
volumeMounts:
|
|
- name: snapshot
|
|
mountPath: /snapshot
|
|
resources:
|
|
requests:
|
|
memory: 64Mi
|
|
cpu: 50m
|
|
limits:
|
|
memory: 256Mi
|
|
containers:
|
|
- name: backup
|
|
image: restic/restic:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
# Init repo if first run
|
|
restic snapshots 2>/dev/null || restic init
|
|
|
|
echo "Running restic backup..."
|
|
restic backup \
|
|
/snapshot/vault.snap \
|
|
--tag vault \
|
|
--tag legion \
|
|
--host legion
|
|
|
|
# Prune old snapshots
|
|
restic forget \
|
|
--keep-daily 30 \
|
|
--keep-weekly 12 \
|
|
--keep-monthly 6 \
|
|
--prune
|
|
|
|
echo "Backup complete."
|
|
restic snapshots --latest 3
|
|
envFrom:
|
|
- secretRef:
|
|
name: vault-backup-credentials
|
|
volumeMounts:
|
|
- name: snapshot
|
|
mountPath: /snapshot
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
volumes:
|
|
- name: snapshot
|
|
emptyDir: {}
|