forgejo-next: incremental backups for v8 #497

Closed

GhostPLACEHOLDER wants to merge 0 commits from refs/pull/62/head3de89061022b17684df7930b34d48854463413d0 into mainb7623d4bc2060d7314b1fa148acb2e859c9894df

GhostPLACEHOLDER commented

2025-05-29 20:27:09 +00:00

First-time contributor

Refs: infrastructure/k8s-cluster#61

Manual test

Created the secret as documented
Created a job (not cron job) copy/pasting the cronjob comment part https://paste.centos.org/view/b8818efa
kubectl apply --server-side -f job.yaml
kubectl logs -n forgejo-next job.batch/backup-v8 https://paste.centos.org/view/1b9b5adb

Refs: infrastructure/k8s-cluster#61 ## Manual test * Created the secret as documented * Created a job (not cron job) copy/pasting the cronjob comment part https://paste.centos.org/view/b8818efa * `kubectl apply --server-side -f job.yaml` * `kubectl logs -n forgejo-next job.batch/backup-v8` https://paste.centos.org/view/1b9b5adb

GhostPLACEHOLDER commented

2025-05-29 20:27:09 +00:00

Author

First-time contributor

TODO:

document
create a SSH key as a secret
use the SSH key in the rsync
select a container image with rsync
mirror the container image to https://code.forgejo.org/oci/-/packages

TODO: - [x] document - [x] create a SSH key as a secret - [x] use the SSH key in the rsync - [x] select a container image with rsync - [ ] mirror the container image to https://code.forgejo.org/oci/-/packages

GhostPLACEHOLDER commented

2025-05-29 20:27:09 +00:00

Author

First-time contributor

https://kubernetes.io/docs/concepts/configuration/secret/#secret-types suggests using kubernetes.io/ssh-auth as a type
https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets has an example which can be translated as a commandline kubectl create secret generic --type=kubernetes.io/ssh-auth backup-ssh-key --from-file=ssh-privatekey=backup --from-file=ssh-publickey=backup.pub

I can't find the documentation explaining how to mount secrets as volumes.

https://kubernetes.io/docs/concepts/storage/volumes/#secret does not explain and refers to https://kubernetes.io/docs/concepts/configuration/secret/#using-a-secret
https://kubernetes.io/docs/concepts/configuration/secret/#using-a-secret does not explain it
https://kubernetes.io/docs/concepts/configuration/secret/#restriction-secret-must-exist has an example that does not explain how to map keys in the secret to files

* https://kubernetes.io/docs/concepts/configuration/secret/#secret-types suggests using kubernetes.io/ssh-auth as a type * https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets has an example which can be translated as a commandline `kubectl create secret generic --type=kubernetes.io/ssh-auth backup-ssh-key --from-file=ssh-privatekey=backup --from-file=ssh-publickey=backup.pub` I can't find the documentation explaining how to mount secrets as volumes. * https://kubernetes.io/docs/concepts/storage/volumes/#secret does not explain and refers to https://kubernetes.io/docs/concepts/configuration/secret/#using-a-secret * https://kubernetes.io/docs/concepts/configuration/secret/#using-a-secret does not explain it * https://kubernetes.io/docs/concepts/configuration/secret/#restriction-secret-must-exist has an example that does not explain how to map keys in the secret to files

root closed this pull request

2025-05-29 20:27:09 +00:00

GhostPLACEHOLDER commented

2025-05-29 20:27:09 +00:00

Author

First-time contributor

Found some documentation

but still not the documentation related to secrets mounted as volumes

Found some documentation * https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#entrypoint * https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 but still not the documentation related to secrets mounted as volumes

GhostPLACEHOLDER commented

2025-05-29 20:27:10 +00:00

Author

First-time contributor

Manually tested it to work using the following job, after creating the readonly PV+PVC.

apiVersion: batch/v1
kind: Job
metadata:
  name: backup-v8
spec:
     template:
        spec:
          containers:

          - name: backup-v8

            image: ghcr.io/visualon/builder

            imagePullPolicy: IfNotPresent

            command: ["/bin/sh"]
            #args: ["-c", "env; find $$HOME; ls -lR $$HOME/.ssh"]
            args: ["-c", "set -x ; rsync -e 'ssh -oStrictHostKeyChecking=no -p23' -zvaHSn --delete --link-dest ../../forgejo-next-v8/backup-day-`date +%d -d yesterday`/  /data/ u432374@u432374.your-storagebox.de:forgejo-next-v8/backup-day-`date +%d -d tomorrow`/"]
            volumeMounts:

            - name: data-volume
              mountPath: /data

            - name: sshdir
              mountPath: /root/.ssh
              readOnly: true

          volumes:

          - name: data-volume
            persistentVolumeClaim:
              claimName: forgejo-next-readonly-v8

          - name: sshdir
            secret:
              secretName: backup-ssh-key
              defaultMode: 0400
              items:
                - key: ssh-privatekey
                  path: id_ed25519

          restartPolicy: Never

Manually tested it to work using the following job, after creating the readonly PV+PVC. <details> ```yaml apiVersion: batch/v1 kind: Job metadata: name: backup-v8 spec: template: spec: containers: - name: backup-v8 image: ghcr.io/visualon/builder imagePullPolicy: IfNotPresent command: ["/bin/sh"] #args: ["-c", "env; find $$HOME; ls -lR $$HOME/.ssh"] args: ["-c", "set -x ; rsync -e 'ssh -oStrictHostKeyChecking=no -p23' -zvaHSn --delete --link-dest ../../forgejo-next-v8/backup-day-`date +%d -d yesterday`/ /data/ u432374@u432374.your-storagebox.de:forgejo-next-v8/backup-day-`date +%d -d tomorrow`/"] volumeMounts: - name: data-volume mountPath: /data - name: sshdir mountPath: /root/.ssh readOnly: true volumes: - name: data-volume persistentVolumeClaim: claimName: forgejo-next-readonly-v8 - name: sshdir secret: secretName: backup-ssh-key defaultMode: 0400 items: - key: ssh-privatekey path: id_ed25519 restartPolicy: Never ``` </details>