From 3ada46bfe590d4374f2772939c06241afbb8bca2 Mon Sep 17 00:00:00 2001 From: Vadym Moshynskyi Date: Mon, 22 Jun 2026 17:23:12 +0200 Subject: [PATCH 1/2] IEBH-484: Deploy velero in dev --- README.md | 1 + clusters/dev/apps/velero/Chart.yaml | 7 +++++ clusters/dev/apps/velero/application.yaml | 26 ++++++++++++++++ .../velero/templates/external-secret.yaml | 21 +++++++++++++ clusters/dev/apps/velero/values.yaml | 30 +++++++++++++++++++ 5 files changed, 85 insertions(+) create mode 100644 clusters/dev/apps/velero/Chart.yaml create mode 100644 clusters/dev/apps/velero/application.yaml create mode 100644 clusters/dev/apps/velero/templates/external-secret.yaml create mode 100644 clusters/dev/apps/velero/values.yaml diff --git a/README.md b/README.md index afb0079..fc484bc 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,7 @@ This repo uses ArgoCD's app-of-apps pattern: a root Application (`root-app.yaml` | 11 | portal | Frontend UI | | 12 | workspace | Workspace orchestration service | | 13 | guacamole-{project} | Per-project Guacamole stack (ApplicationSet) | +| 14 | velero | Cluster backup | **Note**: `registry-secrets` (wave 3) will show `SecretSyncError` until Vault is unsealed and the ClusterSecretStore can connect to it — expected on first deploy, resolves via `selfHeal: true`. diff --git a/clusters/dev/apps/velero/Chart.yaml b/clusters/dev/apps/velero/Chart.yaml new file mode 100644 index 0000000..ed733fd --- /dev/null +++ b/clusters/dev/apps/velero/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: velero +version: 0.1.0 +dependencies: + - name: velero + version: "12.0.3" + repository: https://vmware-tanzu.github.io/helm-charts diff --git a/clusters/dev/apps/velero/application.yaml b/clusters/dev/apps/velero/application.yaml new file mode 100644 index 0000000..88bf143 --- /dev/null +++ b/clusters/dev/apps/velero/application.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: velero + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "14" +spec: + project: default + source: + repoURL: https://github.com/PilotDataPlatform/pilot-hdc-platform-gitops.git + path: clusters/dev/apps/velero + targetRevision: main + helm: + valueFiles: + - values.yaml + destination: + server: https://kubernetes.default.svc + namespace: velero + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/clusters/dev/apps/velero/templates/external-secret.yaml b/clusters/dev/apps/velero/templates/external-secret.yaml new file mode 100644 index 0000000..68e7fd1 --- /dev/null +++ b/clusters/dev/apps/velero/templates/external-secret.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: velero-bucket-credentials + namespace: {{ .Release.Namespace }} +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + name: velero-bucket-credentials + data: + - secretKey: velero-bucket-access-key + remoteRef: + key: secret/data/velero + property: velero-bucket-access-key + - secretKey: velero-bucket-secret-key + remoteRef: + key: secret/data/velero + property: velero-bucket-secret-key diff --git a/clusters/dev/apps/velero/values.yaml b/clusters/dev/apps/velero/values.yaml new file mode 100644 index 0000000..b9160b5 --- /dev/null +++ b/clusters/dev/apps/velero/values.yaml @@ -0,0 +1,30 @@ +velero: + configuration: + provider: aws + backupStorageLocation: + - name: dev-backup + provider: aws + bucket: pilot-hdc-dev-backup-velero-bucket + config: + region: de + s3Url: https://s3.de.io.cloud.ovh.net + s3ForcePathStyle: "true" + checksumAlgorithm: "" + + initContainers: + - name: velero-plugin-for-aws + image: velero/velero-plugin-for-aws:v1.14.1 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /target + name: plugins + + credentials: + useSecret: true + existingSecret: velero-bucket-credentials + + schedules: + daily-cluster-backup: + schedule: "0 0 * * *" + template: + ttl: "720h" From 9941e4752b1a6d6f23a5725566aede7a216a0967 Mon Sep 17 00:00:00 2001 From: Vadym Moshynskyi Date: Mon, 22 Jun 2026 17:29:26 +0200 Subject: [PATCH 2/2] IEBH-484: Fix secret structure --- .../dev/apps/velero/templates/external-secret.yaml | 11 +++++++++-- docs/vault-secrets.md | 8 ++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/clusters/dev/apps/velero/templates/external-secret.yaml b/clusters/dev/apps/velero/templates/external-secret.yaml index 68e7fd1..c45213d 100644 --- a/clusters/dev/apps/velero/templates/external-secret.yaml +++ b/clusters/dev/apps/velero/templates/external-secret.yaml @@ -10,12 +10,19 @@ spec: name: vault target: name: velero-bucket-credentials + template: + engineVersion: v2 + data: + cloud: | + [dev-backup] + aws_access_key_id={{ .velero_bucket_access_key }} + aws_secret_access_key={{ .velero_bucket_secret_key }} data: - - secretKey: velero-bucket-access-key + - secretKey: velero_bucket_access_key remoteRef: key: secret/data/velero property: velero-bucket-access-key - - secretKey: velero-bucket-secret-key + - secretKey: velero_bucket_secret_key remoteRef: key: secret/data/velero property: velero-bucket-secret-key diff --git a/docs/vault-secrets.md b/docs/vault-secrets.md index 54b7614..87fc074 100644 --- a/docs/vault-secrets.md +++ b/docs/vault-secrets.md @@ -154,6 +154,14 @@ vault kv put secret/atlas \ atlas-password=$(openssl rand -hex 24) ``` +## Velero (`secret/velero`) + +```bash +vault kv put secret/velero \ + velero-bucket-access-key='' \ + velero-bucket-secret-key='' +``` + ## Guacamole (`secret/guacamole`) ```bash