diff --git a/apps/forgejo/forgejo-backup-cronjob.yaml b/apps/forgejo/forgejo-backup-cronjob.yaml index 4979b6a..fa99ae4 100644 --- a/apps/forgejo/forgejo-backup-cronjob.yaml +++ b/apps/forgejo/forgejo-backup-cronjob.yaml @@ -96,7 +96,7 @@ spec: memory: 512Mi containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 + image: harbor.basicstack.de/library/restic:0.19.1 env: - name: AWS_ACCESS_KEY_ID valueFrom: diff --git a/apps/monitoring/README.md b/apps/monitoring/README.md index 8e7215c..d4d16e2 100644 --- a/apps/monitoring/README.md +++ b/apps/monitoring/README.md @@ -2,7 +2,7 @@ Manifests recording the cluster-side monitoring backup CronJobs that were previously applied out-of-band. These files are the authoritative source (`kubectl apply -f apps/monitoring/`). See [DEV-464](/DEV/issues/DEV-464) for the repair context. -- `backup-k8s-resources-cronjob.yaml` — daily dump of cluster-scoped and per-namespace Kubernetes resources, streamed through `restic backup --stdin` to `hetzner-s3:${BUCKET}/restic/k8s-resources`. Uses `serviceAccountName: backup-sa` and no PVC mount (init container `alpine/k8s:1.29.4` writes an emptyDir, main container `restic/restic:0.17.3` reads it on stdin). Rewritten from the local-path tarball per the [DEV-482](/DEV/issues/DEV-482) Option 4 rollout ([DEV-487](/DEV/issues/DEV-487)). +- `backup-k8s-resources-cronjob.yaml` — daily dump of cluster-scoped and per-namespace Kubernetes resources, streamed through `restic backup --stdin` to `hetzner-s3:${BUCKET}/restic/k8s-resources`. Uses `serviceAccountName: backup-sa` and no PVC mount (init container `alpine/k8s:1.29.4` writes an emptyDir, main container `restic/restic:0.19.1` reads it on stdin). Rewritten from the local-path tarball per the [DEV-482](/DEV/issues/DEV-482) Option 4 rollout ([DEV-487](/DEV/issues/DEV-487)). - `backup-loki-restic-cronjob.yaml` — daily restic backup of `loki-storage-encrypted` to `hetzner-s3:${BUCKET}/restic/loki`. Co-schedules with the Loki pod via `podAffinity` (RWO permits additional read-only mounts on the same node). Deployed per the [DEV-482](/DEV/issues/DEV-482) Option 4 rollout ([DEV-485](/DEV/issues/DEV-485)). - `backup-grafana-restic-cronjob.yaml` — daily restic backup of `grafana-storage` to `hetzner-s3:${BUCKET}/restic/grafana`. Pinned to `k3s-worker-2` via `nodeSelector` (the local-path PV anchors the grafana pod there already, no `podAffinity` needed). Schedule `15 3 * * *` — offset from the loki run at `03:00`. Deployed per the [DEV-482](/DEV/issues/DEV-482) Option 4 rollout ([DEV-486](/DEV/issues/DEV-486)). - `prometheus-backup-cronjob.yaml` + `prometheus-backup-sealed.yaml` — daily restic backup of `prometheus-data-encrypted` to `hetzner-s3:${BUCKET}/restic/prometheus`. Co-schedules with the Prometheus pod via `podAffinity` so the RWO PVC attaches on the same node. Schedule `30 3 * * *` — offset from the loki (03:00) and grafana (03:15) runs. Migrated from the DEV-465 `rclone sync` job to restic client-side encryption per [DEV-492](/DEV/issues/DEV-492) / [DEV-482](/DEV/issues/DEV-482) Option 4. **Compaction-race mitigation:** `--exclude wal/*` + `--exclude chunks_head/*` + accept `restic backup` exit code 3 (source file vanished mid-walk) as a warning, not a failure; restore drill re-runs `promtool tsdb analyze` per block. diff --git a/apps/monitoring/backup-grafana-restic-cronjob.yaml b/apps/monitoring/backup-grafana-restic-cronjob.yaml index 242ed62..1fa69d6 100644 --- a/apps/monitoring/backup-grafana-restic-cronjob.yaml +++ b/apps/monitoring/backup-grafana-restic-cronjob.yaml @@ -44,8 +44,8 @@ spec: kubernetes.io/hostname: k3s-worker-2 containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 - # Mirrored from docker.io/restic/restic:0.17.3 (DEV-493) — + image: harbor.basicstack.de/library/restic:0.19.1 + # Mirrored from docker.io/restic/restic:0.19.1 (DEV-493) — # deterministic ingress via Harbor. Retag procedure in # docs/monitoring/restic-restore.md § "Tag-bump procedure". env: diff --git a/apps/monitoring/backup-k8s-resources-cronjob.yaml b/apps/monitoring/backup-k8s-resources-cronjob.yaml index af89fd0..36f064f 100644 --- a/apps/monitoring/backup-k8s-resources-cronjob.yaml +++ b/apps/monitoring/backup-k8s-resources-cronjob.yaml @@ -11,7 +11,7 @@ # 1. `kubectl-dump` init container (`alpine/k8s:1.29.4`) writes # /dump/cluster.yaml into an emptyDir. Uses `serviceAccountName: # backup-sa` (unchanged from the legacy job). -# 2. `restic` main container (`restic/restic:0.17.3`, matches the +# 2. `restic` main container (`restic/restic:0.19.1`, matches the # loki/grafana siblings) reads that file on stdin and streams it # into the restic repo with `--stdin-filename cluster.yaml`. apiVersion: batch/v1 @@ -90,8 +90,8 @@ spec: mountPath: /dump containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 - # Mirrored from docker.io/restic/restic:0.17.3 (DEV-493) — + image: harbor.basicstack.de/library/restic:0.19.1 + # Mirrored from docker.io/restic/restic:0.19.1 (DEV-493) — # deterministic ingress via Harbor. Retag procedure in # docs/monitoring/restic-restore.md § "Tag-bump procedure". env: diff --git a/apps/monitoring/backup-loki-restic-cronjob.yaml b/apps/monitoring/backup-loki-restic-cronjob.yaml index a0b6fdf..0891ffa 100644 --- a/apps/monitoring/backup-loki-restic-cronjob.yaml +++ b/apps/monitoring/backup-loki-restic-cronjob.yaml @@ -53,8 +53,8 @@ spec: topologyKey: kubernetes.io/hostname containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 - # Mirrored from docker.io/restic/restic:0.17.3 (DEV-493) — + image: harbor.basicstack.de/library/restic:0.19.1 + # Mirrored from docker.io/restic/restic:0.19.1 (DEV-493) — # deterministic ingress via Harbor. Retag procedure in # docs/monitoring/restic-restore.md § "Tag-bump procedure". env: diff --git a/apps/monitoring/prometheus-backup-cronjob.yaml b/apps/monitoring/prometheus-backup-cronjob.yaml index 5c3bd7b..17f6ebb 100644 --- a/apps/monitoring/prometheus-backup-cronjob.yaml +++ b/apps/monitoring/prometheus-backup-cronjob.yaml @@ -81,7 +81,7 @@ spec: topologyKey: kubernetes.io/hostname containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 + image: harbor.basicstack.de/library/restic:0.19.1 env: - name: AWS_ACCESS_KEY_ID valueFrom: diff --git a/docs/monitoring/restic-restore.md b/docs/monitoring/restic-restore.md index f185926..3aadfca 100644 --- a/docs/monitoring/restic-restore.md +++ b/docs/monitoring/restic-restore.md @@ -70,7 +70,7 @@ spec: restartPolicy: Never containers: - name: restic - image: harbor.basicstack.de/library/restic:0.17.3 # matches CronJob image (DEV-493) + image: harbor.basicstack.de/library/restic:0.19.1 # matches CronJob image (DEV-493, bumped in DEV-541) command: ["sleep", "3600"] env: - { name: AWS_ACCESS_KEY_ID, valueFrom: { secretKeyRef: { name: monitoring-s3-backup, key: access-key } } } @@ -240,9 +240,9 @@ All three restic CronJobs (`backup-loki-restic`, `backup-grafana-restic`, keep the backup pipeline off the Docker Hub pull path and immune to upstream retagging: -- Manifest reference: `harbor.basicstack.de/library/restic:0.17.3` -- Upstream: `docker.io/restic/restic:0.17.3` -- Ticket: [DEV-493](/DEV/issues/DEV-493) +- Manifest reference: `harbor.basicstack.de/library/restic:0.19.1` +- Upstream: `docker.io/restic/restic:0.19.1` +- Ticket: [DEV-493](/DEV/issues/DEV-493) (bumped to 0.19.1 in [DEV-541](/DEV/issues/DEV-541)) The `library` project is public, so no `imagePullSecret` is required on the CronJob pods.