ac9f36b1e7
- CronJob at 0 4 1 * * restores the latest openwebui-manifests backup into a transient restore-test-<ts> namespace, diffs core resource-kind counts against the live openwebui namespace, and deletes the target namespace. - ServiceAccount + ClusterRole scoped to velero.io + namespace + configmap ops. Script enforces the 'restore-test-' name prefix before deleting a namespace. Cluster-wide 'view' bound for the diff. - Failure surfaces via kube_job_status_failed (DEV-574 alert stack) and via ConfigMap velero-restore-drill-last-result written on every run. - Optional Paperclip webhook Secret is sealed but unreachable from Hetzner right now (home Paperclip is LAN-only); wired as optional secretKeyRef so the drill runs regardless. Connectivity is a follow-up. - Argo Application velero-restore-drill points at velero/restore-drill/. Co-Authored-By: Paperclip <noreply@paperclip.ing>
97 lines
3.1 KiB
YAML
97 lines
3.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: velero-restore-drill
|
|
namespace: velero
|
|
labels:
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
|
spec:
|
|
# Monthly at 04:00 UTC on the 1st (per DEV-575 acceptance).
|
|
schedule: "0 4 1 * *"
|
|
timeZone: "UTC"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
startingDeadlineSeconds: 3600
|
|
jobTemplate:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
|
spec:
|
|
backoffLimit: 0
|
|
activeDeadlineSeconds: 3600
|
|
ttlSecondsAfterFinished: 604800 # keep completed jobs for 7d for debug
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/part-of: velero-restore-drill
|
|
spec:
|
|
restartPolicy: Never
|
|
serviceAccountName: restore-drill
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: drill
|
|
image: alpine/k8s:1.30.5
|
|
imagePullPolicy: IfNotPresent
|
|
command: ["/bin/bash", "/scripts/drill.sh"]
|
|
env:
|
|
- name: DRILL_SOURCE_NS
|
|
value: "openwebui"
|
|
- name: DRILL_SCHEDULE_NAME
|
|
value: "openwebui-manifests"
|
|
- name: DRILL_RESULT_NS
|
|
value: "velero"
|
|
- name: DRILL_RESULT_CM
|
|
value: "velero-restore-drill-last-result"
|
|
- name: DRILL_RESTORE_TIMEOUT
|
|
value: "1800"
|
|
- name: DRILL_NS_DELETE_TIMEOUT
|
|
value: "600"
|
|
# Optional Paperclip webhook (mounted from SealedSecret if wired).
|
|
- name: PAPERCLIP_WEBHOOK_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: velero-restore-drill-webhook
|
|
key: webhookUrl
|
|
optional: true
|
|
- name: PAPERCLIP_WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: velero-restore-drill-webhook
|
|
key: webhookSecret
|
|
optional: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumeMounts:
|
|
- name: script
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: kube
|
|
mountPath: /.kube
|
|
volumes:
|
|
- name: script
|
|
configMap:
|
|
name: restore-drill-script
|
|
defaultMode: 0555
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: kube
|
|
emptyDir: {}
|