IEBH-484: Deploy velero in dev

README.md

@@ -59,6 +59,7 @@ This repo uses ArgoCD's app-of-apps pattern: a root Application (`root-app.yaml`
 | 11 | portal | Frontend UI |
 | 12 | workspace | Workspace orchestration service |
 | 13 | guacamole-{project} | Per-project Guacamole stack (ApplicationSet) |
+| 14 | velero | Cluster backup |
 
 **Note**: `registry-secrets` (wave 3) will show `SecretSyncError` until Vault is unsealed and the ClusterSecretStore can connect to it — expected on first deploy, resolves via `selfHeal: true`.
 

clusters/dev/apps/velero/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: velero
+version: 0.1.0
+dependencies:
+  - name: velero
+    version: "12.0.3"
+    repository: https://vmware-tanzu.github.io/helm-charts

clusters/dev/apps/velero/application.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: velero
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "14"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/PilotDataPlatform/pilot-hdc-platform-gitops.git
+    path: clusters/dev/apps/velero
+    targetRevision: main
+    helm:
+      valueFiles:
+        - values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: velero
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

clusters/dev/apps/velero/templates/external-secret.yaml

@@ -0,0 +1,28 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: velero-bucket-credentials
+  namespace: {{ .Release.Namespace }}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  target:
+    name: velero-bucket-credentials
+    template:
+      engineVersion: v2
+      data:
+        cloud: |
+          [dev-backup]
+          aws_access_key_id={{ .velero_bucket_access_key }}
+          aws_secret_access_key={{ .velero_bucket_secret_key }}
+  data:
+    - secretKey: velero_bucket_access_key
+      remoteRef:
+        key: secret/data/velero
+        property: velero-bucket-access-key
+    - secretKey: velero_bucket_secret_key
+      remoteRef:
+        key: secret/data/velero
+        property: velero-bucket-secret-key

clusters/dev/apps/velero/values.yaml

@@ -0,0 +1,30 @@
+velero:
+  configuration:
+    provider: aws
+    backupStorageLocation:
+      - name: dev-backup
+        provider: aws
+        bucket: pilot-hdc-dev-backup-velero-bucket
+        config:
+          region: de
+          s3Url: https://s3.de.io.cloud.ovh.net
+          s3ForcePathStyle: "true"
+          checksumAlgorithm: ""
+
+  initContainers:
+    - name: velero-plugin-for-aws
+      image: velero/velero-plugin-for-aws:v1.14.1
+      imagePullPolicy: IfNotPresent
+      volumeMounts:
+        - mountPath: /target
+          name: plugins
+
+  credentials:
+    useSecret: true
+    existingSecret: velero-bucket-credentials
+
+  schedules:
+    daily-cluster-backup:
+      schedule: "0 0 * * *"
+      template:
+        ttl: "720h"

docs/vault-secrets.md

@@ -154,6 +154,14 @@ vault kv put secret/atlas \
   atlas-password=$(openssl rand -hex 24)
 ```
 
+## Velero (`secret/velero`)
+
+```bash
+vault kv put secret/velero \
+  velero-bucket-access-key='<s3-access-key>' \
+  velero-bucket-secret-key='<s3-secret-key>'
+```
+
 ## Guacamole (`secret/guacamole`)
 
 ```bash