jakman85andClaude Opus 4.8
cbc2301b30
Text-only cleanup after the upgrade campaign. Updates stale version strings, prose, and comments to the verified current facts; no Kubernetes behavior or version pins changed except the kubectl toolchain bump (below). Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie, Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB, dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18, Grafana 13.2.0. - Version strings across infra/ and platform/ READMEs + comments - kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew) - Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh) - COMPLETED/historical banners on the three executed plan docs - Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges - Appended dated DECISIONS-LOG entry (2026-08-30) superseding the 2026-08-26 LIVE STATE line Left as revalidation items (not blind-edited): external-snapshotter v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1, conformance ImageVolume feature-gate assertions under 1.36. Co-Authored-By: Claude Opus 4.8 <[email protected]>
53 lines
2.8 KiB
Markdown
53 lines
2.8 KiB
Markdown
# platform/velero
|
|
|
|
**Velero** — off-cluster backup and DR of Kubernetes resource state + PVC data.
|
|
|
|
- **Governing ADR:** [ADR-0003 — Longhorn (+ bulk tier + Velero)](../../../home-network-k3s/decisions/adr-0003-storage-longhorn.md)
|
|
- **Spec:** [docs/04 — Storage & State](../../../home-network-k3s/docs/04-storage-and-state.md)
|
|
- **Serves:** R-STATE-03
|
|
- **Owner:** WS-STORAGE
|
|
|
|
## What this is (LIVE)
|
|
|
|
Flux `HelmRelease` (Velero chart 12.x / Velero 1.18.x) wired to the on-Proxmox **MinIO** S3 target:
|
|
|
|
- **Endpoint:** `http://192.168.1.9:9000` (plain HTTP, **path-style**, region `us-east-1` placeholder)
|
|
- **BucketStorageLocation `default`:** provider `aws`, bucket `velero`, `s3ForcePathStyle=true`.
|
|
- **AWS plugin** (`velero/velero-plugin-for-aws`) loaded as an init container.
|
|
- **File System Backup (kopia):** `deployNodeAgent=true`, `uploaderType=kopia`, `snapshotsEnabled=false`
|
|
— storage-agnostic PVC backup, **no** CSI snapshot / data-mover.
|
|
- **Credentials:** `velero-cloud-credentials` — a SOPS Secret (`velero-cloud.sops.yaml`) holding the
|
|
`cloud` INI key, the **scoped** MinIO key limited to the `velero`+`cnpg` buckets. Kept in sync with
|
|
the staging source of truth `platform/backup/minio-credentials.sops.yaml` and the Proxmox host
|
|
ansible-vault.
|
|
|
|
Reconciled by its **own non-gating** Flux Kustomization `clusters/base/backup.yaml`
|
|
(`dependsOn: platform-config`, `wait:false`) — a backup controller must never gate the platform graph.
|
|
|
|
## Backup scope (what's included vs excluded)
|
|
|
|
Two daily `Schedule`s (cadence `${VELERO_BACKUP_SCHEDULE}`, retention `${VELERO_RETENTION}`):
|
|
|
|
| Schedule | Namespaces | Volumes (kopia FSB) |
|
|
|---|---|---|
|
|
| `daily` | ALL **except** `monitoring`, `unifi` | **all** PVC data (`defaultVolumesToFsBackup:true`, opt-out) |
|
|
| `daily-resources-only` | `monitoring`, `unifi` | **none** (`defaultVolumesToFsBackup:false`) — resources only |
|
|
|
|
**Excluded volume data (reconstructable, per the sizing decision):**
|
|
- `monitoring` — Prometheus TSDB PVC (ephemeral) + Loki 72h-log PVC. Grafana/Alertmanager are
|
|
`emptyDir` (no PVC); Grafana dashboards are GitOps-provisioned.
|
|
- `unifi` — the ~7.4 GiB KubeVirt VM disk (huge; UniFi is protected by its own config export).
|
|
|
|
Their **Kubernetes resources** are still captured (by `daily-resources-only`) to aid DR.
|
|
|
|
**Included (the irreplaceable ~6 GiB):** every other namespace's PVC data via kopia — Nextcloud data,
|
|
Gitea, Plex/*arr config, PiHole, and the CNPG Postgres PVCs. (CNPG DBs additionally have native Barman
|
|
PITR to the `cnpg` bucket — see the DB manifests.)
|
|
|
|
## Post-deploy (PM)
|
|
|
|
- `velero backup-location get` → `default` Available.
|
|
- `velero backup create --from-schedule daily` → objects land under `s3://velero/`.
|
|
- DR drill (R-STATE-03, Phase-4 gate): `velero restore create --from-backup <name>` into a scratch
|
|
namespace and verify PVC data restores via the node-agent.
|