ec3e9624b3
- velero/schedules/: cluster-all @ 03:00 (30d TTL, manifests only), per-namespace <ns>-manifests @ 03:15+n min (30 in-scope namespaces, 30d TTL, no fs backup), and per-namespace <ns>-data @ 03:45+n min for the whitelist (pocket-id, vaultwarden, vikunja, passbolt; 14d TTL, defaultVolumesToFsBackup=true). - All schedules exclude velero, kube-system, kube-node-lease, kube-public so the Kopia password Secret never lands in S3. - apps/app-velero-schedules.yaml: sibling Argo app syncing that directory into namespace velero with prune+selfHeal. - opencloud, harbor(registry+trivy): pod-template annotation backup.velero.io/backup-volumes-excludes as a safety net so blob- heavy PVCs are never fs-backed-up even under a manual defaultVolumes run. nextcloud/monitoring workloads are not Argo-tracked yet — they were patched live in the same commit but need a follow-up to source- control them. Co-Authored-By: Paperclip <noreply@paperclip.ing>
23 lines
533 B
YAML
23 lines
533 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: velero-schedules
|
|
namespace: argocd
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
|
|
targetRevision: main
|
|
path: velero/schedules
|
|
directory:
|
|
recurse: false
|
|
include: '*.yaml'
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: velero
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- ServerSideApply=true
|