Nik Afiq
d0887ac648
Stage 5 + part of Stage 6/7 of REFACTOR_PLAN.md. This is the highest-risk stage per the plan -- these Applications are NOT to be pushed/synced blindly. Each needs `kubectl diff` against live state one at a time before enabling. New Applications (previously-live resources with zero GitOps coverage): - cert-manager-config.yaml (manifests/cert-manager: both ClusterIssuers + the internal CA Certificate -- every TLS cert in the cluster depends on these, and nothing currently restores them on a cold rebuild). - authentik-config.yaml (manifests/authentik: ingress, proxy outpost, middleware -- raw manifests only, low risk). - authentik.yaml (the Authentik Helm chart itself): sync is deliberately left MANUAL and targetRevision is a REPLACE_ME placeholder -- I don't have a safe way to read the live chart version (`helm list -n authentik`), and guessing wrong risks an unwanted upgrade/downgrade of the SSO IdP gating Argo CD/ Grafana/Gitea logins. Needs your input before this one goes anywhere. - network.yaml: widens coverage to the 4 non-sealed files in manifests/network (ddns-cronjob, glances-debian-ingress, traefik-dashboard-ingress, watch-party-ingress) that were previously invisible to Argo CD; keeps network-secrets.yaml scoped to *-sealed.yaml only. Fixes: - homeassistant.yaml: destination.namespace was "homeassistant" (empty, unused) while the actual resources are hardcoded to "default" -- corrected, dropped CreateNamespace=true. The old empty namespace isn't auto-deleted (prune: false); safe to remove by hand if desired. - gitea-backup.yaml: added the missing Namespace object (nothing created "gitea-backup" before); replaced a cluster-wide ClusterRole/ClusterRoleBinding granting pods/exec everywhere with a Role/RoleBinding scoped to the `gitea` namespace, matching what the backup script actually execs into. NOTE: this is already under active sync via gitea-secrets.yaml (selfHeal: true, prune: false) -- once pushed, the old ClusterRole/ClusterRoleBinding will need manual `kubectl delete` since Argo CD won't prune them. - Added sync-wave "-2" to cert-manager/sealed-secrets Applications so their CRDs land before consumers (matches the existing -1/0 wave pattern). - Normalized targetRevision HEAD -> main on home-services/otel-collector/tempo. - Normalized sync policy per your decision: home-services/otel-collector/tempo prune true -> false; pihole/pihole-debian selfHeal false -> true (repo-wide consistency, per your call on finding #18). Verified: kubeconform valid across all manifests + Argo CD Application objects. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
116 lines
3.0 KiB
YAML
116 lines
3.0 KiB
YAML
# Apply: kubectl apply -f manifests/gitea/gitea-backup.yaml
|
|
# Delete: kubectl delete -f manifests/gitea/gitea-backup.yaml
|
|
# Description: CronJob that backs up Gitea to NFS every 7 days, with RBAC and PV/PVC.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: gitea-backup
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: gitea-backup
|
|
namespace: gitea-backup
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: gitea-backup
|
|
namespace: gitea
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/exec"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: gitea-backup
|
|
namespace: gitea
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gitea-backup
|
|
namespace: gitea-backup
|
|
roleRef:
|
|
kind: Role
|
|
name: gitea-backup
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: gitea-backup
|
|
namespace: gitea-backup
|
|
spec:
|
|
schedule: "0 3 */7 * *"
|
|
successfulJobsHistoryLimit: 1
|
|
failedJobsHistoryLimit: 1
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
serviceAccountName: gitea-backup
|
|
restartPolicy: OnFailure
|
|
nodeSelector:
|
|
node-role: primary
|
|
containers:
|
|
- name: backup
|
|
image: bitnami/kubectl:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Finding Gitea pod..."
|
|
GITEA_POD=$(kubectl get pod -n gitea -l app=gitea -o jsonpath='{.items[0].metadata.name}')
|
|
echo "Running gitea dump in pod $GITEA_POD..."
|
|
kubectl exec -n gitea $GITEA_POD -- rm -f /tmp/gitea-backup.zip
|
|
kubectl exec -n gitea $GITEA_POD -- gitea dump \
|
|
--config /data/gitea/conf/app.ini \
|
|
--file /tmp/gitea-backup.zip \
|
|
--type zip
|
|
echo "Copying backup to NFS..."
|
|
rm -f /backup/gitea-backup.zip
|
|
kubectl cp gitea/$GITEA_POD:/tmp/gitea-backup.zip /backup/gitea-backup.zip
|
|
echo "Cleaning up temp file..."
|
|
kubectl exec -n gitea $GITEA_POD -- rm /tmp/gitea-backup.zip
|
|
echo "Backup complete: /backup/gitea-backup.zip"
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
volumes:
|
|
- name: backup
|
|
persistentVolumeClaim:
|
|
claimName: gitea-backup-pvc
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: gitea-backup-pv
|
|
spec:
|
|
capacity:
|
|
storage: 50Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
nfs:
|
|
server: 192.168.7.183
|
|
path: /home/nik/backups/gitea
|
|
persistentVolumeReclaimPolicy: Retain
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: gitea-backup-pvc
|
|
namespace: gitea-backup
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 50Gi
|
|
volumeName: gitea-backup-pv
|
|
storageClassName: ""
|