b3d98bf902
- apps/app-velero.yaml: Argo Application, path apps/velero, ns velero, CreateNamespace + ServerSideApply (chart uses long CRDs). - apps/velero/Chart.yaml: pinned vmware-tanzu velero chart 12.1.0 (appVersion 1.18.1). - apps/velero/values.yaml: Kopia uploader, no CSI, node-agent enabled, AWS S3 provider -> https://hel1.your-objectstorage.com, dedicated bucket basicstack-velero (per DEV-570), BSL credential velero-s3-credentials/cloud, Kopia repo password auto-picked from velero-repo-credentials/repository-password. Co-Authored-By: Paperclip <noreply@paperclip.ing>
101 lines
3.1 KiB
YAML
101 lines
3.1 KiB
YAML
velero:
|
|
# Pinned chart version 12.1.0 (Velero appVersion 1.18.1).
|
|
# AWS plugin follows Velero minor version: v1.14.x for Velero 1.18.x.
|
|
image:
|
|
repository: velero/velero
|
|
tag: v1.18.1
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Bring the AWS object-storage plugin in as an initContainer that copies
|
|
# the binary into /plugins so the Velero server can load it.
|
|
initContainers:
|
|
- name: velero-plugin-for-aws
|
|
image: velero/velero-plugin-for-aws:v1.14.3
|
|
imagePullPolicy: IfNotPresent
|
|
volumeMounts:
|
|
- mountPath: /target
|
|
name: plugins
|
|
|
|
# Kopia file-system backup requires the node-agent daemonset on every
|
|
# node whose PVC data we back up.
|
|
deployNodeAgent: true
|
|
|
|
# BackupStorageLocation credentials come from the SealedSecret
|
|
# apps/velero/velero-s3-credentials-sealed.yaml (key: cloud, INI format
|
|
# with aws_access_key_id / aws_secret_access_key for the dedicated
|
|
# `velero-prod` Hetzner OS credential from DEV-570).
|
|
credentials:
|
|
useSecret: true
|
|
existingSecret: velero-s3-credentials
|
|
|
|
# Kopia backup-repository password (velero-repo-credentials Secret,
|
|
# key `repository-password`) is auto-discovered by Velero — this is a
|
|
# hard-coded constant in the Velero server (see pkg/repository/keys),
|
|
# so no extra wiring is needed. SealedSecret lives at
|
|
# apps/velero/velero-repo-credentials-sealed.yaml.
|
|
|
|
# Turn OFF volume-snapshot CRDs — Hetzner Cloud Volumes have no CSI
|
|
# snapshot support, so filesystem backup via Kopia is the only path.
|
|
snapshotsEnabled: false
|
|
backupsEnabled: true
|
|
|
|
configuration:
|
|
# Kopia uploader (unified repo). This is the Velero server default in
|
|
# 1.18 but we set it explicitly so any future default change does not
|
|
# silently rewrite our repos to restic.
|
|
uploaderType: kopia
|
|
|
|
# No CSI feature flag — see snapshotsEnabled comment above.
|
|
features: ""
|
|
|
|
backupStorageLocation:
|
|
- name: default
|
|
provider: aws
|
|
bucket: basicstack-velero
|
|
default: true
|
|
credential:
|
|
name: velero-s3-credentials
|
|
key: cloud
|
|
config:
|
|
# Hetzner Object Storage in Helsinki (hel1). Region is used by
|
|
# the AWS SDK signer; endpoint overrides the AWS endpoint URL.
|
|
region: hel1
|
|
s3ForcePathStyle: "false"
|
|
s3Url: https://hel1.your-objectstorage.com
|
|
# publicUrl left unset — this backend is not user-facing.
|
|
|
|
# No volumeSnapshotLocation entries — snapshotsEnabled: false above
|
|
# already suppresses the default snapshot location CRD.
|
|
|
|
# Small resource footprint until we know real backup sizing (DEV-573).
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
nodeAgent:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
|
|
# Do not install the bundled `velero` CLI kubectl image — we run the
|
|
# CLI from cp-1.
|
|
kubectl:
|
|
image:
|
|
repository: bitnami/kubectl
|
|
resources: {}
|
|
|
|
# No schedules here — those live in DEV-573.
|
|
schedules: {}
|