-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(): Add support for s3 storage in Kubernetes etcd backup job (#25)
* feat(): add S3 Environment variables * feat(): create backup and push to s3 * fix(): user permssion * fix(): use double quotes * fix(): use double quotes * feat(): update CA Certificates and fix typos
- Loading branch information
1 parent
37f305d
commit bf33474
Showing
4 changed files
with
93 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ | |
| # backup.sh General etcd backup script | ||
| ################################################################################ | ||
| # | ||
| # Copyright (C) 2023 Adfinis AG | ||
| # Copyright (C) 2024 Adfinis AG | ||
| # https://adfinis.com | ||
| # [email protected] | ||
| # | ||
|
|
@@ -32,50 +32,77 @@ | |
|
|
||
| set -xeuo pipefail | ||
|
|
||
| # set proper umask | ||
| umask "${ETCD_BACKUP_UMASK}" | ||
| # check storage type | ||
| if [ "${ETCD_BACKUP_S3}" = "true" ]; then | ||
| # prepare & push backup to S3 | ||
|
|
||
| # validate expire type | ||
| case "${ETCD_BACKUP_EXPIRE_TYPE}" in | ||
| days|count|never) ;; | ||
| *) echo "backup.expiretype needs to be one of: days,count,never"; exit 1 ;; | ||
| esac | ||
| # update CA trust | ||
| update-ca-trust | ||
|
|
||
| # validate expire numbers | ||
| if [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "days" ]; then | ||
| case "${ETCD_BACKUP_KEEP_DAYS}" in | ||
| ''|*[!0-9]*) echo "backup.expiredays needs to be a valid number"; exit 1 ;; | ||
| *) ;; | ||
| esac | ||
| elif [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "count" ]; then | ||
| case "${ETCD_BACKUP_KEEP_COUNT}" in | ||
| ''|*[!0-9]*) echo "backup.expirecount needs to be a valid number"; exit 1 ;; | ||
| *) ;; | ||
| # configure mcli assuming the bucket already exists | ||
| bash +o history | ||
| mcli alias set "${ETCD_BACKUP_S3_NAME}" "${ETCD_BACKUP_S3_HOST}" "${ETCD_BACKUP_S3_ACCESS_KEY}" "${ETCD_BACKUP_S3_SECRET_KEY}" | ||
| bash -o history | ||
|
|
||
| # make dirname | ||
| BACKUP_FOLDER="$( date "${ETCD_BACKUP_DIRNAME}")" || { echo "Invalid backup.dirname" && exit 1; } | ||
|
|
||
| # make necessary directory | ||
| mkdir -p "/tmp/etcd-backup/${BACKUP_FOLDER}" | ||
|
|
||
| # create backup to temporary location | ||
| ETCDCTL_API=3 etcdctl --endpoints "${ENDPOINT}:2379" --cacert="/etc/kubernetes/pki/etcd-ca/ca.crt" --cert="/etc/kubernetes/pki/etcd-peer/tls.crt" --key="/etc/kubernetes/pki/etcd-peer/tls.key" snapshot save "/tmp/etcd-backup/${BACKUP_FOLDER}/snapshot.db" | ||
| ETCDCTL_API=3 etcdutl --write-out=table snapshot status "/tmp/etcd-backup/${BACKUP_FOLDER}/snapshot.db" | ||
|
|
||
| # move files to S3 and delete temporary files | ||
| mcli mv -r /tmp/etcd-backup/* "${ETCD_BACKUP_S3_NAME}"/"${ETCD_BACKUP_S3_BUCKET}" | ||
| rm -rv /tmp/etcd-backup | ||
| else | ||
| # set proper umask | ||
| umask "${ETCD_BACKUP_UMASK}" | ||
|
|
||
| # validate expire type | ||
| case "${ETCD_BACKUP_EXPIRE_TYPE}" in | ||
| days|count|never) ;; | ||
| *) echo "backup.expiretype needs to be one of: days,count,never"; exit 1 ;; | ||
| esac | ||
| fi | ||
|
|
||
| # make dirname and cleanup paths | ||
| BACKUP_FOLDER="$( date "${ETCD_BACKUP_DIRNAME}")" || { echo "Invalid backup.dirname" && exit 1; } | ||
| BACKUP_PATH="$( realpath -m "${ETCD_BACKUP_SUBDIR}/${BACKUP_FOLDER}" )" | ||
| BACKUP_PATH_POD="$( realpath -m "/backup/${BACKUP_PATH}" )" | ||
| BACKUP_ROOTPATH="$( realpath -m "/backup/${ETCD_BACKUP_SUBDIR}" )" | ||
|
|
||
| # make nescesary directorys | ||
| mkdir -p "/tmp/etcd-backup" | ||
| mkdir -p "${BACKUP_PATH_POD}" | ||
|
|
||
| # create backup to temporary location | ||
| ETCDCTL_API=3 etcdctl --endpoints "${ENDPOINT}:2379" --cacert='/etc/kubernetes/pki/etcd-ca/ca.crt' --cert='/etc/kubernetes/pki/etcd-peer/tls.crt' --key='/etc/kubernetes/pki/etcd-peer/tls.key' snapshot save /tmp/etcd-backup/snapshot.db | ||
| ETCDCTL_API=3 etcdutl --write-out=table snapshot status /tmp/etcd-backup/snapshot.db | ||
|
|
||
| # move files to pvc and delete temporary files | ||
| mv /tmp/etcd-backup/* "${BACKUP_PATH_POD}" | ||
| rm -rv /tmp/etcd-backup | ||
|
|
||
| # expire backup | ||
| if [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "days" ]; then | ||
| find "${BACKUP_ROOTPATH}" -mindepth 1 -maxdepth 1 -type d -mtime "+${ETCD_BACKUP_KEEP_DAYS}" -exec rm -rv {} + | ||
| elif [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "count" ]; then | ||
| # shellcheck disable=SC3040,SC2012 | ||
| ls -1tp "${BACKUP_ROOTPATH}" | awk "NR>${ETCD_BACKUP_KEEP_COUNT}" | xargs -I{} rm -rv "${BACKUP_ROOTPATH}/{}" | ||
| # validate expire numbers | ||
| if [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "days" ]; then | ||
| case "${ETCD_BACKUP_KEEP_DAYS}" in | ||
| ''|*[!0-9]*) echo "backup.expiredays needs to be a valid number"; exit 1 ;; | ||
| *) ;; | ||
| esac | ||
| elif [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "count" ]; then | ||
| case "${ETCD_BACKUP_KEEP_COUNT}" in | ||
| ''|*[!0-9]*) echo "backup.expirecount needs to be a valid number"; exit 1 ;; | ||
| *) ;; | ||
| esac | ||
| fi | ||
|
|
||
| # make dirname and cleanup paths | ||
| BACKUP_FOLDER="$( date "${ETCD_BACKUP_DIRNAME}")" || { echo "Invalid backup.dirname" && exit 1; } | ||
| BACKUP_PATH="$( realpath -m "${ETCD_BACKUP_SUBDIR}/${BACKUP_FOLDER}" )" | ||
| BACKUP_PATH_POD="$( realpath -m "/backup/${BACKUP_PATH}" )" | ||
| BACKUP_ROOTPATH="$( realpath -m "/backup/${ETCD_BACKUP_SUBDIR}" )" | ||
|
|
||
| # make nescesary directorys | ||
| mkdir -p "/tmp/etcd-backup" | ||
| mkdir -p "${BACKUP_PATH_POD}" | ||
|
|
||
| # create backup to temporary location | ||
| ETCDCTL_API=3 etcdctl --endpoints "${ENDPOINT}:2379" --cacert='/etc/kubernetes/pki/etcd-ca/ca.crt' --cert='/etc/kubernetes/pki/etcd-peer/tls.crt' --key='/etc/kubernetes/pki/etcd-peer/tls.key' snapshot save /tmp/etcd-backup/snapshot.db | ||
| ETCDCTL_API=3 etcdutl --write-out=table snapshot status /tmp/etcd-backup/snapshot.db | ||
|
|
||
| # move files to pvc and delete temporary files | ||
| mv /tmp/etcd-backup/* "${BACKUP_PATH_POD}" | ||
| rm -rv /tmp/etcd-backup | ||
|
|
||
| # expire backup | ||
| if [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "days" ]; then | ||
| find "${BACKUP_ROOTPATH}" -mindepth 1 -maxdepth 1 -type d -mtime "+${ETCD_BACKUP_KEEP_DAYS}" -exec rm -rv {} + | ||
| elif [ "${ETCD_BACKUP_EXPIRE_TYPE}" = "count" ]; then | ||
| # shellcheck disable=SC3040,SC2012 | ||
| ls -1tp "${BACKUP_ROOTPATH}" | awk "NR>${ETCD_BACKUP_KEEP_COUNT}" | xargs -I{} rm -rv "${BACKUP_ROOTPATH}/{}" | ||
| fi | ||
| fi | ||