commit a3b80bc03c52c9300d2f2b2e749f9bbb98ab4406
parent 4072bea69faa13f4ab6209a8ad393fa83d2d5f10
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 28 Feb 2026 11:33:46 +0100
more backups!
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
8 files changed, 178 insertions(+), 0 deletions(-)
diff --git a/infrastructure_talos/controllers/kustomization.yaml b/infrastructure_talos/controllers/kustomization.yaml
@@ -8,3 +8,4 @@ resources:
- cert-manager.yaml
- cilium.yaml
- longhorn.yaml
+ - ./velero
diff --git a/infrastructure_talos/controllers/velero/kustomization.yaml b/infrastructure_talos/controllers/velero/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+ - namespace.yaml
+ - repository.yaml
+ - secret.yaml
+ - release.yaml
+ - snapshot-class.yaml
+ - schedules.yaml
diff --git a/infrastructure_talos/controllers/velero/namespace.yaml b/infrastructure_talos/controllers/velero/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: velero
diff --git a/infrastructure_talos/controllers/velero/release.yaml b/infrastructure_talos/controllers/velero/release.yaml
@@ -0,0 +1,61 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: velero
+ namespace: velero
+spec:
+ interval: 30m
+ chart:
+ spec:
+ chart: velero
+ version: "11.4.0"
+ sourceRef:
+ kind: HelmRepository
+ name: vmware-tanzu
+ namespace: velero
+ interval: 24h
+ install:
+ crds: CreateReplace
+ remediation:
+ retries: 3
+ upgrade:
+ crds: CreateReplace
+ remediation:
+ retries: 3
+ values:
+ # Kopia node agent DaemonSet — required for file-system backup of hcloud-volumes
+ # (hcloud CSI driver does not support VolumeSnapshots)
+ deployNodeAgent: true
+
+ configuration:
+ # EnableCSI: built-in since v1.14, enables CSI snapshots for Longhorn volumes
+ features: EnableCSI
+ # Use Kopia file-system backup for all volumes by default.
+ # CSI snapshots (for Longhorn) run additionally when a VolumeSnapshotClass
+ # labelled velero.io/csi-volumesnapshot-class=true exists.
+ defaultVolumesToFsBackup: true
+ backupStorageLocation:
+ - name: default
+ provider: aws
+ bucket: mtrnord-talos-velero
+ config:
+ s3Url: https://hel1.your-objectstorage.com
+ region: hel1
+ s3ForcePathStyle: "true"
+ volumeSnapshotLocation:
+ - name: default
+ provider: aws
+ config:
+ region: hel1
+
+ credentials:
+ useSecret: true
+ existingSecret: velero-s3-credentials
+
+ initContainers:
+ - name: velero-plugin-for-aws
+ image: velero/velero-plugin-for-aws:v1.13.2
+ imagePullPolicy: IfNotPresent
+ volumeMounts:
+ - mountPath: /target
+ name: plugins
diff --git a/infrastructure_talos/controllers/velero/repository.yaml b/infrastructure_talos/controllers/velero/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+ name: vmware-tanzu
+ namespace: velero
+spec:
+ interval: 24h
+ url: https://vmware-tanzu.github.io/helm-charts
diff --git a/infrastructure_talos/controllers/velero/schedules.yaml b/infrastructure_talos/controllers/velero/schedules.yaml
@@ -0,0 +1,59 @@
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+ name: cluster-backup-0000
+ namespace: velero
+spec:
+ schedule: "0 0 * * *"
+ template:
+ includedNamespaces:
+ - "*"
+ storageLocation: default
+ volumeSnapshotLocations:
+ - default
+ ttl: 336h
+---
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+ name: cluster-backup-0600
+ namespace: velero
+spec:
+ schedule: "0 6 * * *"
+ template:
+ includedNamespaces:
+ - "*"
+ storageLocation: default
+ volumeSnapshotLocations:
+ - default
+ ttl: 336h
+---
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+ name: cluster-backup-1200
+ namespace: velero
+spec:
+ schedule: "0 12 * * *"
+ template:
+ includedNamespaces:
+ - "*"
+ storageLocation: default
+ volumeSnapshotLocations:
+ - default
+ ttl: 336h
+---
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+ name: cluster-backup-1800
+ namespace: velero
+spec:
+ schedule: "0 18 * * *"
+ template:
+ includedNamespaces:
+ - "*"
+ storageLocation: default
+ volumeSnapshotLocations:
+ - default
+ ttl: 336h
diff --git a/infrastructure_talos/controllers/velero/secret.yaml b/infrastructure_talos/controllers/velero/secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: velero-s3-credentials
+ namespace: velero
+type: Opaque
+stringData:
+ cloud: ENC[AES256_GCM,data:C1m6BHCUuuPE0ndCnhNpou7BLtm2DqZ2xMLB0uHF5FzGUNVxNntHJ1IQKChZp8PEhJiPM3kRsHa5ZxGIm7rUoQnObVYv1FTsMSFr6ky6ZKJZ+GsRzf75YzdybA+KvH4gawRWtOPEWLDXqMzzb3cKHDimZkk=,iv:5bJKijIeDJNlsY+ixPOoo8dKgzki1zgkljym3WCXtoA=,tag:btr2R2HtFmlYsG/T/xw8ug==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTaVZMYnJGVmpZQllWbkJV
+ VEozUitTVEVueUI3RWg5NkpGUVRvZGg3OXpBClVZd2hXMUhkcUdYTnluZmlCZWx5
+ RXVLbDd3bm91WEo0V2JtdnFjNVJkVDAKLS0tIHdJTVN0RUtMNjE3b0swMmd6VU5H
+ b1dHaGNHeVBoNEtWYkRFM3gyQzlXSlEKwfnJYRAjeNcRkZzaltdEp0JWSH8LOz6+
+ W3wh+xcYmEJKZ3frzm0VGlLeUy7Np5sdUpq7ZprtRNYuv37sJsdp8g==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-02-28T10:33:20Z"
+ mac: ENC[AES256_GCM,data:EC1Dv5gIm3oCtW+MBZOWUdMqgZg1R4k8mwZpOoKQXVCuGnoiwvIxO0UHbO6YqzusVO+YmMuIJUThvpzZBAICsC080MyWCHwR7cz5v+xuhWPZ1kr8cWXJtSMysX+f/IE8uwVQBTXwlysMn2XiTBNJ4C9Zj4cmVr94dQBqJ/3GTgA=,iv:CR8YsmGfZ97mbjvMe70rog1qe2t5/WHAPNY6YcwhK/8=,tag:7kQA3DHWsIOlyx2s0oC98g==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/infrastructure_talos/controllers/velero/snapshot-class.yaml b/infrastructure_talos/controllers/velero/snapshot-class.yaml
@@ -0,0 +1,8 @@
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+ name: longhorn-velero-vsc
+ labels:
+ velero.io/csi-volumesnapshot-class: "true"
+driver: driver.longhorn.io
+deletionPolicy: Delete
