jakman85andClaude Opus 4.8
ac32f01f7b
Stand up a single-node/single-drive MinIO S3 endpoint on the Proxmox host as the off-cluster backup target for Velero (R-STATE-03) and CloudNativePG (R-IDP-05). Ansible (author + executed): - roles/minio_backup_target + playbooks/backup-minio.yml — idempotent, additive only: ZFS dataset Storage/k3s-backups (zstd, quota=100G, /mnt/Storage/k3s-backups, no sharenfs); minio system user; pinned+checksummed MinIO/mc binaries (fetched on the controller since the host has no WAN, copied to host); hardened systemd unit bound to the host's cluster-reachable LAN IP (auto-discovered) on :9000; velero + cnpg buckets; a non-root access key scoped by IAM policy to only those two buckets. - inventory: new [proxmox_hosts] group ([email protected].2.102); overrides the cluster-wide ansible_user. Does not disturb existing k3s node entries. - group_vars/proxmox_hosts/vault.yml (ansible-vault): root + scoped MinIO creds. GitOps hand-off: - platform/backup/minio-credentials.sops.yaml (+ .example) — SOPS/age-encrypted endpoint + scoped key/secret for the Velero/CNPG wiring (WS-STORAGE/WS-SEC). Not yet wired into a kustomization (left for the consuming agents). Verified live: dataset props correct; minio active+enabled bound to 192.168.1.9:9000; S3 endpoint http://192.168.1.9:9000/minio/health/ready returns 200 from an in-cluster pod; buckets velero+cnpg present; scoped key created+policy attached; re-run is idempotent. Co-Authored-By: Claude Opus 4.8 <[email protected]>
42 lines
3.6 KiB
YAML
42 lines
3.6 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: minio-backup-credentials
|
|
namespace: backup
|
|
type: Opaque
|
|
stringData:
|
|
#ENC[AES256_GCM,data:V1G4ViUPhrnkiRLFNZyYbSaEPFVLsZ74gB4zo1Y7AM2QP7R5lWVEvDO9VgLVatRZwt7cbeObMAYXeI873tZ9hOi2JNSvYuuXrscC3q8nMuJGswvIMvkM,iv:sGb4E/j5mhtkwY05YP/U7lCa9UHV/35dGCziymGUJHo=,tag:S5KnPKRaxJuGCMwPZkIFBw==,type:comment]
|
|
S3_ENDPOINT: ENC[AES256_GCM,data:UwzKnjDVv3HoEeAPxlzkhUifL6hmebM=,iv:IWmiCYrvuIBez2i3qyDs6Yu4mQ0YuNYv46Rn3+ksm/k=,tag:dlefmBsY3TuLZPAPmaWs/g==,type:str]
|
|
S3_REGION: ENC[AES256_GCM,data:GvGIw6qxx9M4,iv:uArcS3uwHKwjif00ICIc0Og0OF98OL10ArhT6teJzh4=,tag:2tn4XykslMtwYk7C4m8ndw==,type:str]
|
|
S3_FORCE_PATH_STYLE: ENC[AES256_GCM,data:5cEjjA==,iv:k5R7iszw/kxYLSH8aqIAHmq8ePdL7xYYPQcutHloN7s=,tag:DJPE0500UP5ECYuBJM9nBg==,type:str]
|
|
VELERO_BUCKET: ENC[AES256_GCM,data:Q1Oo4Amz,iv:XnAT/Nn8C9BmnE5e0d1LI0I0BVSUL7C+mI+s31FrMYI=,tag:oWDHC2jjKYpKNXA98wYqpQ==,type:str]
|
|
CNPG_BUCKET: ENC[AES256_GCM,data:P3BUXg==,iv:BPuFgI9iL9lWZhQZ0k3skrBwyp1UDLyz0aIyq6/V7nI=,tag:R4n30UxwcCY1k+X/bu7pxw==,type:str]
|
|
#ENC[AES256_GCM,data:A6h/rEzdn5Sp1BLDnxoHrYdEwiB9Eb/5NAxCMZRXvoVcnTfOvLHVA0ntno+9GwMueIhwN9WgG7fnCHhG7A==,iv:1+VfHF59PppwpLiYW4gUTwgGcvXMEzAnvowVvE/awFU=,tag:skLHPchOW2PZzjqqaJ2TSQ==,type:comment]
|
|
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:wNnfGYBspJDyYw==,iv:d9fK8E5ujPu9vXV1yRR5AgO3+j69EWfbWEoMt7Lq06w=,tag:0uuRSadwtodLol2Sw2ih9Q==,type:str]
|
|
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:IywofASX3m8sznW3StMf/SvCPBcvxCUlT4cIQvu4gF9RglHlFCujwi8amnm7ASfc,iv:JnyMBQQ7oLg8TAVx7RveZHYDo6a/bl3t1IEPRxZufI8=,tag:5rUUqd6ZByuLIlZxQV1dPQ==,type:str]
|
|
#ENC[AES256_GCM,data:J5fQZE/UbhqpWo5OXzvGxCNTb5f6r+sh55wUHf3M0H4oRU2dyna7nJqFQzP1EQXfJTlxjZOpBkzZyppn,iv:bDGljEMmMiieCvfmVO8uhfw/O1rUslNvNAY6LfFFA4E=,tag:D9Gw78gtCigsWJnlmFzMdA==,type:comment]
|
|
ACCESS_KEY_ID: ENC[AES256_GCM,data:TYn3AVIkjU4QhA==,iv:09W2JkJywD5aadOr+XkbZlR2sSz3glT+yknI4Z46C9o=,tag:QGwIp3seKuemzi4jysDRcg==,type:str]
|
|
ACCESS_SECRET_KEY: ENC[AES256_GCM,data:lZ9fAqwPGwiKbTJYyvNGMOS9L37IB3/GcfpuZH3G2s0of3YII6vyPlAKZeGI6i2P,iv:Y0p8EDzZS3uUZ+BBHjjBgDmkyphwZ43X7VfZJboGS1s=,tag:rQ0EyRBEPNG41PGrqHKkhw==,type:str]
|
|
#ENC[AES256_GCM,data:EbjHG+jG6OnhZzWUAamIomBYYa5jwogBWlAgOPyIdFivuNZGDSbkyZ0dsUNJJ8yhl7lkIjvi1VvGA/B2QXdCw0pP4xxCs84uLSgpHDWB9v4G5cjF+kThANvaMomKoQ==,iv:1JpFJPSTXVxKVkLBkaYZAYzRHCmqSAgNYGmcW4ajZxo=,tag:9vWPXJ3COQC4m2AHCWPOlg==,type:comment]
|
|
cloud: ENC[AES256_GCM,data:RmDGXXK5ct97WO18YAYIUF3zPE7nb1zkuJV8pBZPkNEHV6y1Iup/RXAMg+l1rXcI7xdPSiMfSJ6FMudfxOzCzAJPRGxoHMWhzO5N9H+O30KOhHwYpeud2mL4xNZPzOvQgpszqJQzk82D5tnjGeE=,iv:wz16XKNzAWrOZv+Rx68MArqRJHZmRVX/613w7/3WXH4=,tag:5cxblz07Mepy9xOZ3pko2w==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Z1hkZTlrWmpsdzBuODlM
|
|
NXQvTXhmb00rMWNqY1l4Ly8yVjVrNXFSMXdRCmxMNXlBTEJyVncrcHVrWXFoZHBI
|
|
L3JLM3lLVHBJNFVHY3k0MVBjYk5USTgKLS0tIFJ4WWxFL0Flc2J5V3ZSU1JhSVE1
|
|
TDFyWmhqQUdCOTUyZGVnRDQ4d2lSRnMKPBexDlO9fZK6K6Rpcs2RzYE4drYtivwk
|
|
QsnSigjEPY35ixsPTMHTdTP0Almxc4U6lhT4gsIEqk3hqmJ3fcmzzA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-29T03:09:53Z"
|
|
mac: ENC[AES256_GCM,data:y1Uxrj9yAuZCryfCviU0pPplcQ0ccxcJSuNov4CvZKwnIimHVIsr7sU1mw3ZqHV/arQ2SjXkfDHxAEhvL6WSAjEjnDNaCMm++mPrfKXoGZhDU3gjaeyI7W6Iexo/bfc/oR6hALRjp6g7nTK6Yqdi6UMRoZZ+1YGSkFkRJjygLF4=,iv:9scdNtJQk6TkB/SN2yeFdhmiVCtGd2qRsD3N+wv0L5o=,tag:dYFy6oKEUIr7BLstFrhsEA==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|