97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
# Backups live outside the cluster so a Longhorn or cluster-wide failure does
|
|
# not remove both PostgreSQL and its recovery data. Credentials are produced by
|
|
# the encrypted SopsSecret in this chart.
|
|
apiVersion: barmancloud.cnpg.io/v1
|
|
kind: ObjectStore
|
|
metadata:
|
|
name: authentik-backups
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
retentionPolicy: 30d
|
|
configuration:
|
|
destinationPath: s3://ahmza-talos-cnpg-backups/authentik/
|
|
endpointURL: https://s3.eu-central-003.backblazeb2.com
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: backblaze-b2-credentials
|
|
key: ACCESS_KEY_ID
|
|
secretAccessKey:
|
|
name: backblaze-b2-credentials
|
|
key: ACCESS_SECRET_KEY
|
|
region:
|
|
name: backblaze-b2-credentials
|
|
key: AWS_REGION
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
data:
|
|
compression: gzip
|
|
jobs: 2
|
|
# Backblaze implements the S3 API but does not require every optional AWS
|
|
# checksum behavior. These settings avoid incompatible optional checksums.
|
|
instanceSidecarConfiguration:
|
|
env:
|
|
- name: AWS_REQUEST_CHECKSUM_CALCULATION
|
|
value: when_required
|
|
- name: AWS_RESPONSE_CHECKSUM_VALIDATION
|
|
value: when_required
|
|
---
|
|
# One PostgreSQL instance is enough initially: Longhorn replicates its volume
|
|
# across workers and can reattach it after a node failure. A second database
|
|
# instance can be added later if shorter failover time justifies another full
|
|
# copy of the data and WAL.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: authentik-postgres
|
|
namespace: {{ .Release.Namespace }}
|
|
annotations:
|
|
# Argo CD may update this database but must never delete it automatically
|
|
# merely because a manifest or parent Application was removed from Git.
|
|
argocd.argoproj.io/sync-options: Prune=false
|
|
spec:
|
|
instances: 1
|
|
imageName: >-
|
|
ghcr.io/cloudnative-pg/postgresql:16.13-202603020816-standard-trixie
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: authentik
|
|
owner: authentik
|
|
|
|
storage:
|
|
# The default StorageClass is Longhorn. Omitting storageClass here keeps the
|
|
# database on that established replicated storage path.
|
|
size: 10Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
|
|
plugins:
|
|
- name: barman-cloud.cloudnative-pg.io
|
|
isWALArchiver: true
|
|
parameters:
|
|
barmanObjectName: authentik-backups
|
|
---
|
|
# CloudNativePG cron expressions have six fields; the leading zero is seconds.
|
|
# WAL is archived continuously, while this creates a full base backup nightly.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: ScheduledBackup
|
|
metadata:
|
|
name: authentik-postgres-daily
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
schedule: "0 0 2 * * *"
|
|
immediate: false
|
|
backupOwnerReference: self
|
|
cluster:
|
|
name: authentik-postgres
|
|
method: plugin
|
|
pluginConfiguration:
|
|
name: barman-cloud.cloudnative-pg.io
|