feat(k8s): taegliche pg_dump-Sicherung der Datenbank

CronJob artista-db-backup schreibt per pg_dump auf die Storage Box (StorageClass smb-backup, SMB 3.1.1 mit seal). 14 Tage taeglich, 8 Wochen sonntags. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-10-12 02:04:24 +02:00
1 parent d3a7f8b824
commit b725aa230c
@@ -0,0 +1,76 @@
+# Taegliche pg_dump-Sicherung der Modelcamp-Datenbank auf die Storage Box.
+# Voraussetzung im Cluster: StorageClass smb-backup (SMB 3.1.1 mit seal),
+# legt pro PVC einen Ordner unter Server/Backups/<namespace>/ an.
+# Aufbewahrung: 14 Tage taeglich, 8 Wochen sonntags.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: artista-db-backup
+  namespace: artista
+spec:
+  accessModes: [ReadWriteMany]
+  storageClassName: smb-backup
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: artista-db-backup
+  namespace: artista
+spec:
+  schedule: "25 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: artista-db-backup
+            db-client: "true"
+        spec:
+          restartPolicy: Never
+          automountServiceAccountToken: false
+          securityContext:
+            runAsUser: 70
+            runAsGroup: 70
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: backup
+              image: postgres:18.6-alpine
+              command:
+                - /bin/sh
+                - -ec
+                - |
+                  stamp=$(date +%Y-%m-%d)
+                  kind=daily; [ "$(date +%u)" = "7" ] && kind=weekly
+                  mkdir -p /backups/daily /backups/weekly
+                  pg_dump -h artista-modelcamp-postgres -Fc -f /backups/$kind/artista-$stamp.dump.tmp
+                  mv /backups/$kind/artista-$stamp.dump.tmp /backups/$kind/artista-$stamp.dump
+                  find /backups/daily -name '*.dump' -mtime +14 -delete
+                  find /backups/weekly -name '*.dump' -mtime +56 -delete
+                  ls -l /backups/$kind | tail -3
+              env:
+                - {name: PGUSER, value: artista}
+                - {name: PGDATABASE, value: artista}
+                - name: PGPASSWORD
+                  valueFrom: {secretKeyRef: {name: artista-modelcamp-secrets, key: DB_PASSWORD}}
+              resources:
+                requests: {cpu: "0", memory: "0"}
+                limits: {memory: 512Mi}
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities: {drop: [ALL]}
+              volumeMounts:
+                - {name: backups, mountPath: /backups}
+          volumes:
+            - name: backups
+              persistentVolumeClaim: {claimName: artista-db-backup}