longhorn backup target

2026-08-11 22:17:47 +03:00
parent be53f040c7
commit 555a84fa28
12 changed files with 112 additions and 79 deletions
@@ -29,8 +29,12 @@ spec:
      defaultDataPath: /var/lib/longhorn
      guaranteedEngineManagerCPU: 12
      guaranteedReplicaManagerCPU: 12
-      # если backup target ещё не настроен — оставь пустым, донастроишь позже через UI/CR
-      backupTarget: ""
+      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
+      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
+      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
+      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
+      backupTarget: "s3://longhorn-backups@us-east-1/"
+      backupTargetCredentialSecret: longhorn-backup-target-secret
      # чтобы не разъезжались реплики при 3 нодах
      replicaSoftAntiAffinity: false
    persistence:
@@ -44,4 +48,4 @@ spec:
      resizerReplicaCount: 3
      snapshotterReplicaCount: 3
    ingress:
-      enabled: false             # у тебя уже есть Caddy/Traefik, заведёшь свой Ingress/IngressRoute отдельно
+      enabled: false # exposed via Traefik explicitly
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - helmrepository.yaml
+  - secret.enc.yaml
  - helmrelease.yaml
  - ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: longhorn-backup-target-secret
+    namespace: longhorn-system
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:vli6H1YZQviV4ygwEKOhUltZ+5o=,iv:P6xcqbIVME4xMEOiWtXGm1z6S8ceF+uoTHDI6sqG1y8=,tag:IAnsJBEndhf6AVhXN6E1Vg==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:8UXxo+WALaBj1TCC8YfAyq/sJhShIKkfEtI0wHGTuyt1aMdMdqXQRw==,iv:9Gqy3LnX988o+eMwhMxvWw+u9yZ1QDh7pPMX0qs6yL4=,tag:VTWbe2A5vRu5bLeQt2KE6Q==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:Co4mTd6AY+woOmd71Uo/6wmniWIG6Wa6q54UL6XLIsto/6Z79N+gKvV5AaaQ5mXdWi78zaJYJT7lbi2AOg==,iv:DaDMi/CUBcRyoBiau03PXBzdoO4UVV05puhKvHibDFg=,tag:WSMC+QDIn2rFj9lcVc5uLQ==,type:str]
+sops:
+    age:
+        - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbW1GRUJad1B1cUJtZXp1
+            TGxsaytYMW9hcE1hR1BlcnVoTjIrdWQ2YmdNCkhuemIwd3hsL1UrWGxRaFo1NHRQ
+            ZVBzR2pFeUlYQ0dTN3E3RG5taitXWGsKLS0tIFNIRDJhZUpwYjV6UXpDcmZUS09n
+            VzhUZkQ1KzdTUnlLRlp6TzJWb2lGdjQK34QBtclIRUTO4dyNHFmPJ0EO9a4fLuXm
+            jQ7DOac/g5S3wByq3xmV65PwalJum1Mty4i+HqphvDsGupyNY6xX+Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:24:50Z"
+    mac: ENC[AES256_GCM,data:6Kn5AD4MuU6+JhtYyOXsEKzmFKRxfMAA83LChO0MeZbhGwI/J7EBeSYMYtZMetua9pmjvZakBQoPlE6Hdjq5cwBG8K3v7K54ZDKb/NK6dfEZMY2hZ5GMe+4NWNDLWPRphu6V7wLNwvhZNrh/J9+LDpnIVdMls2WPzhncmI/pENg=,iv:OLYZWQ0Dl28tUCHkt9XInP67OajX3IaqsGpmE5XNpGQ=,tag:XQzBoYNKZC7yRdhOUUoIqA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0