Nick SzaunigandClaude Opus 5.5
2359970f48
CronJob apicore-db-backup dumps the database to the Storage Box (StorageClass smb-backup, SMB 3.1.1 with seal). Keeps 14 daily and 8 weekly dumps. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
77 lines
2.7 KiB
YAML
77 lines
2.7 KiB
YAML
# Tägliche pg_dump-Sicherung der ApiCore-Datenbank auf die Storage Box.
|
|
# Voraussetzung im Cluster: StorageClass smb-backup (SMB 3.1.1 mit seal),
|
|
# legt pro PVC einen Ordner unter Server/Backups/<namespace>/ an.
|
|
# Aufbewahrung: 14 Tage täglich, 8 Wochen sonntags.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: apicore-db-backup
|
|
spec:
|
|
accessModes: [ReadWriteMany]
|
|
storageClassName: smb-backup
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: apicore-db-backup
|
|
spec:
|
|
schedule: "5 2 * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 1
|
|
activeDeadlineSeconds: 1800
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: apicore-db-backup
|
|
db-client: "true"
|
|
spec:
|
|
restartPolicy: Never
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsUser: 70
|
|
runAsGroup: 70
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: backup
|
|
image: postgres:18.6-alpine
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
- |
|
|
stamp=$(date +%Y-%m-%d)
|
|
kind=daily; [ "$(date +%u)" = "7" ] && kind=weekly
|
|
mkdir -p /backups/daily /backups/weekly
|
|
pg_dump -h apicore-postgres -Fc -f /backups/$kind/apicore-$stamp.dump.tmp
|
|
mv /backups/$kind/apicore-$stamp.dump.tmp /backups/$kind/apicore-$stamp.dump
|
|
find /backups/daily -name '*.dump' -mtime +14 -delete
|
|
find /backups/weekly -name '*.dump' -mtime +56 -delete
|
|
ls -l /backups/$kind | tail -3
|
|
env:
|
|
- name: PGUSER
|
|
valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_USER}}
|
|
- name: PGPASSWORD
|
|
valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_PASSWORD}}
|
|
- name: PGDATABASE
|
|
valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_DB}}
|
|
resources:
|
|
requests: {cpu: "0", memory: "0"}
|
|
limits: {memory: 512Mi}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: [ALL]}
|
|
volumeMounts:
|
|
- {name: backups, mountPath: /backups}
|
|
volumes:
|
|
- name: backups
|
|
persistentVolumeClaim: {claimName: apicore-db-backup}
|