60cc931d6b
- velero-plugin-for-aws v1.14.3 is not published on docker.io (only rc.1/rc.2). Downgrade to the latest GA tag v1.14.2 — still compatible with Velero 1.18.x. - Drop node-agent memory request 256Mi -> 64Mi so the daemonset schedules on worker-1/2/3 (they sit at ~95% memory-request already). Co-Authored-By: Paperclip <noreply@paperclip.ing>
105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
velero:
|
|
# Pinned chart version 12.1.0 (Velero appVersion 1.18.1).
|
|
# AWS plugin follows Velero minor version: v1.14.x for Velero 1.18.x.
|
|
image:
|
|
repository: velero/velero
|
|
tag: v1.18.1
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Bring the AWS object-storage plugin in as an initContainer that copies
|
|
# the binary into /plugins so the Velero server can load it.
|
|
initContainers:
|
|
- name: velero-plugin-for-aws
|
|
image: velero/velero-plugin-for-aws:v1.14.2
|
|
imagePullPolicy: IfNotPresent
|
|
volumeMounts:
|
|
- mountPath: /target
|
|
name: plugins
|
|
|
|
# Kopia file-system backup requires the node-agent daemonset on every
|
|
# node whose PVC data we back up.
|
|
deployNodeAgent: true
|
|
|
|
# BackupStorageLocation credentials come from the SealedSecret
|
|
# apps/velero/velero-s3-credentials-sealed.yaml (key: cloud, INI format
|
|
# with aws_access_key_id / aws_secret_access_key for the dedicated
|
|
# `velero-prod` Hetzner OS credential from DEV-570).
|
|
credentials:
|
|
useSecret: true
|
|
existingSecret: velero-s3-credentials
|
|
|
|
# Kopia backup-repository password (velero-repo-credentials Secret,
|
|
# key `repository-password`) is auto-discovered by Velero — this is a
|
|
# hard-coded constant in the Velero server (see pkg/repository/keys),
|
|
# so no extra wiring is needed. SealedSecret lives at
|
|
# apps/velero/velero-repo-credentials-sealed.yaml.
|
|
|
|
# Turn OFF volume-snapshot CRDs — Hetzner Cloud Volumes have no CSI
|
|
# snapshot support, so filesystem backup via Kopia is the only path.
|
|
snapshotsEnabled: false
|
|
backupsEnabled: true
|
|
|
|
configuration:
|
|
# Kopia uploader (unified repo). This is the Velero server default in
|
|
# 1.18 but we set it explicitly so any future default change does not
|
|
# silently rewrite our repos to restic.
|
|
uploaderType: kopia
|
|
|
|
# No CSI feature flag — see snapshotsEnabled comment above.
|
|
features: ""
|
|
|
|
backupStorageLocation:
|
|
- name: default
|
|
provider: aws
|
|
bucket: basicstack-velero
|
|
default: true
|
|
credential:
|
|
name: velero-s3-credentials
|
|
key: cloud
|
|
config:
|
|
# Hetzner Object Storage in Helsinki (hel1). Region is used by
|
|
# the AWS SDK signer; endpoint overrides the AWS endpoint URL.
|
|
region: hel1
|
|
s3ForcePathStyle: "false"
|
|
s3Url: https://hel1.your-objectstorage.com
|
|
# publicUrl left unset — this backend is not user-facing.
|
|
|
|
# No volumeSnapshotLocation entries — snapshotsEnabled: false above
|
|
# already suppresses the default snapshot location CRD.
|
|
|
|
# Small resource footprint until we know real backup sizing (DEV-573).
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
# Small memory request so node-agent fits on the tight 4 GiB CX22 workers
|
|
# (worker-1/2/3 sit around 95 % memory-request already). Actual peak usage
|
|
# during Kopia backup lands under 300 MiB per node in practice; limit is
|
|
# generous so a spike does not OOM-kill mid-backup.
|
|
nodeAgent:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
|
|
# Do not install the bundled `velero` CLI kubectl image — we run the
|
|
# CLI from cp-1.
|
|
kubectl:
|
|
image:
|
|
repository: bitnami/kubectl
|
|
resources: {}
|
|
|
|
# No schedules here — those live in DEV-573.
|
|
schedules: {}
|