98 lines
3.1 KiB
YAML
98 lines
3.1 KiB
YAML
|
apiVersion: batch/v1
|
||
|
|
kind: CronJob
|
||
|
|
metadata:
|
||
|
|
name: velero-restore-drill
|
||
|
|
namespace: velero
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
||
|
|
spec:
|
||
|
|
# Monthly at 04:00 UTC on the 1st (per DEV-575 acceptance).
|
||
|
|
schedule: "0 4 1 * *"
|
||
|
|
timeZone: "UTC"
|
||
|
|
concurrencyPolicy: Forbid
|
||
|
|
successfulJobsHistoryLimit: 3
|
||
|
|
failedJobsHistoryLimit: 3
|
||
|
|
startingDeadlineSeconds: 3600
|
||
|
|
jobTemplate:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
||
|
|
spec:
|
||
|
|
backoffLimit: 0
|
||
|
|
activeDeadlineSeconds: 3600
|
||
|
|
ttlSecondsAfterFinished: 604800 # keep completed jobs for 7d for debug
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
||
|
|
spec:
|
||
|
|
restartPolicy: Never
|
||
|
|
serviceAccountName: restore-drill
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
containers:
|
||
|
|
- name: drill
|
||
|
|
image: alpine/k8s:1.30.5
|
||
|
|
imagePullPolicy: IfNotPresent
|
||
|
|
command: ["/bin/bash", "/scripts/drill.sh"]
|
||
|
|
env:
|
||
|
|
- name: DRILL_SOURCE_NS
|
||
|
|
value: "openwebui"
|
||
|
|
- name: DRILL_SCHEDULE_NAME
|
||
|
|
value: "openwebui-manifests"
|
||
|
|
- name: DRILL_RESULT_NS
|
||
|
|
value: "velero"
|
||
|
|
- name: DRILL_RESULT_CM
|
||
|
|
value: "velero-restore-drill-last-result"
|
||
|
|
- name: DRILL_RESTORE_TIMEOUT
|
||
|
|
value: "1800"
|
||
|
|
- name: DRILL_NS_DELETE_TIMEOUT
|
||
|
|
value: "600"
|
||
|
|
# Optional Paperclip webhook (mounted from SealedSecret if wired).
|
||
|
|
- name: PAPERCLIP_WEBHOOK_URL
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: velero-restore-drill-webhook
|
||
|
|
key: webhookUrl
|
||
|
|
optional: true
|
||
|
|
- name: PAPERCLIP_WEBHOOK_SECRET
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: velero-restore-drill-webhook
|
||
|
|
key: webhookSecret
|
||
|
|
optional: true
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 50m
|
||
|
|
memory: 128Mi
|
||
|
|
limits:
|
||
|
|
cpu: 500m
|
||
|
|
memory: 512Mi
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
capabilities:
|
||
|
|
drop: ["ALL"]
|
||
|
|
volumeMounts:
|
||
|
|
- name: script
|
||
|
|
mountPath: /scripts
|
||
|
|
readOnly: true
|
||
|
|
- name: tmp
|
||
|
|
mountPath: /tmp
|
||
|
|
- name: kube
|
||
|
|
mountPath: /.kube
|
||
|
|
volumes:
|
||
|
|
- name: script
|
||
|
|
configMap:
|
||
|
|
name: restore-drill-script
|
||
|
|
defaultMode: 0555
|
||
|
|
- name: tmp
|
||
|
|
emptyDir: {}
|
||
|
|
- name: kube
|
||
|
|
emptyDir: {}
|