feat: backups for data pipeline (#340)

kubernetes/apps/pipelines/data/victoria-metrics/app/helmrelease.yaml

@@ -46,6 +46,8 @@ spec:
       enabled: false
     coreDns:
       enabled: false
+    kubeApiServer:
+      enabled: false
     kubeControllerManager:
       enabled: false
     kubeScheduler:

kubernetes/apps/pipelines/data/victoria-metrics/backup-secrets/backup-bucket.yaml

@@ -0,0 +1,7 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: data-pipeline-vmetrics-backup-bucket
+  namespace: flux-system
+spec:
+  itemPath: "vaults/Kubernetes/items/mich-cloudflare-r2-data-pipeline-vmetrics-backup-bucket"

kubernetes/apps/pipelines/data/victoria-metrics/backup-secrets/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./backup-bucket.yaml

kubernetes/apps/pipelines/data/victoria-metrics/backup/backup.yaml

@@ -0,0 +1,19 @@
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: data-pipeline-vmetrics-backup
+  namespace: data
+spec:
+  sourcePVC: vmsingle-vmetrics-data
+  trigger:
+    schedule: 0 18 * * *
+  restic:
+    pruneIntervalDays: 14
+    repository: data-pipeline-vmetrics-backup-secret
+    retain:
+      daily: 5
+      weekly: 1
+      monthly: 2
+    copyMethod: Direct
+    cacheStorageClassName: zfs
+    cacheAccessModes: ["ReadWriteOnce"]

kubernetes/apps/pipelines/data/victoria-metrics/backup/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.yaml
+  - ./backup.yaml

kubernetes/apps/pipelines/data/victoria-metrics/backup/secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: data-pipeline-vmetrics-backup-secret
+  namespace: data
+type: Opaque
+stringData:
+  RESTIC_REPOSITORY: "s3:${api_endpoint}/${bucket_name}"
+  RESTIC_PASSWORD: "${restic_secret}"
+  AWS_ACCESS_KEY_ID: "${id}"
+  AWS_SECRET_ACCESS_KEY: "${secret}"

kubernetes/apps/pipelines/data/victoria-metrics/ks.yaml

@@ -39,3 +39,53 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: data-pipeline-vmetrics-backup-secrets
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-vmetrics-backup-secrets
+  dependsOn:
+    - name: data-pipeline-vmetrics
+  path: ./kubernetes/apps/pipelines/data/victoria-metrics/backup-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: data-pipeline-vmetrics-backup
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-vmetrics-backup
+  dependsOn:
+    - name: vmetrics-backup-secrets
+    - name: data-pipeline-vmetrics-backup-secrets
+  path: ./kubernetes/apps/pipelines/data/victoria-metrics/backup
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: data-pipeline-vmetrics-backup-bucket
+      - kind: Secret
+        name: victoriametrics-backup-secret
+

tf/deployment/modules/cloudflare/account/1password.tf

@@ -61,6 +61,40 @@ resource "onepassword_item" "mich_cloudflare_r2_victoriametrics_backups_bucket"
   }
 }
 
+resource "random_password" "data_pipeline_vmetrics_backups_restic_secret" {
+  length           = 40
+  special          = true
+  override_special = "!@#$%^&*()_+"
+}
+
+
+resource "onepassword_item" "mich_cloudflare_r2_data_pipeline_vmetrics_backups_bucket" {
+  vault    = data.onepassword_vault.kubernetes.uuid
+  title    = "mich-cloudflare-r2-data-pipeline-vmetrics-backup-bucket"
+  category = "secure_note"
+  section {
+    label = "Cloudflare R2 Token"
+
+    field {
+      label = "bucket_name"
+      type  = "STRING"
+      value = cloudflare_r2_bucket.data_pipeline_vmetrics_backups.name
+    }
+
+    field {
+      label = "api_endpoint"
+      type  = "STRING"
+      value = "https://${cloudflare_r2_bucket.data_pipeline_vmetrics_backups.account_id}.r2.cloudflarestorage.com"
+    }
+
+    field {
+      label = "restic_secret"
+      type  = "CONCEALED"
+      value = random_password.data_pipeline_vmetrics_backups_restic_secret.result
+    }
+  }
+}
+
 resource "random_password" "outline_backups_restic_secret" {
   length           = 40
   special          = true

tf/deployment/modules/cloudflare/account/r2.tf

@@ -10,6 +10,12 @@ resource "cloudflare_r2_bucket" "victoriametrics_backups" {
   location   = "WEUR"
 }
 
+resource "cloudflare_r2_bucket" "data_pipeline_vmetrics_backups" {
+  account_id = var.cloudflare_account_id
+  name       = "data-pipeline-vmetrics-backups"
+  location   = "WEUR"
+}
+
 resource "cloudflare_r2_bucket" "outline_database_backups" {
   account_id = var.cloudflare_account_id
   name       = "outline-database-backups"