ec3e9624b3
- velero/schedules/: cluster-all @ 03:00 (30d TTL, manifests only), per-namespace <ns>-manifests @ 03:15+n min (30 in-scope namespaces, 30d TTL, no fs backup), and per-namespace <ns>-data @ 03:45+n min for the whitelist (pocket-id, vaultwarden, vikunja, passbolt; 14d TTL, defaultVolumesToFsBackup=true). - All schedules exclude velero, kube-system, kube-node-lease, kube-public so the Kopia password Secret never lands in S3. - apps/app-velero-schedules.yaml: sibling Argo app syncing that directory into namespace velero with prune+selfHeal. - opencloud, harbor(registry+trivy): pod-template annotation backup.velero.io/backup-volumes-excludes as a safety net so blob- heavy PVCs are never fs-backed-up even under a manual defaultVolumes run. nextcloud/monitoring workloads are not Argo-tracked yet — they were patched live in the same commit but need a follow-up to source- control them. Co-Authored-By: Paperclip <noreply@paperclip.ing>
24 lines
527 B
YAML
24 lines
527 B
YAML
apiVersion: velero.io/v1
|
|
kind: Schedule
|
|
metadata:
|
|
name: cluster-all
|
|
namespace: velero
|
|
labels:
|
|
app.kubernetes.io/part-of: velero-schedules
|
|
tier: cluster
|
|
spec:
|
|
schedule: "0 3 * * *"
|
|
useOwnerReferencesInBackup: false
|
|
template:
|
|
ttl: 720h0m0s
|
|
includedNamespaces:
|
|
- '*'
|
|
excludedNamespaces:
|
|
- velero
|
|
- kube-system
|
|
- kube-node-lease
|
|
- kube-public
|
|
includeClusterResources: true
|
|
snapshotVolumes: false
|
|
defaultVolumesToFsBackup: false
|
|
storageLocation: default
|