longhorn backup schedule

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: longhorn-backup-target-secret
     namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:yDQ9Q3jZ6HaB0azDQUE+kZR7Few=,iv:SgVc9x1GBKQKUdIcjvS6kpu2Q7ixLLoDuFw0EofqJe0=,tag:RKRMen5I2Mi0DwvRszek0g==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:WZb0BjR4oAZ9YYUpYDb46eBOvw9bW7bJpTxJWuipqOYKFSR/oQKAdA==,iv:nFmLxVMkGYA/dyCbIBoNISFaCJj2HPlqU2pghRmJHW0=,tag:hamnF4hkAl189/RkSzhFPw==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:c6p9p5map9jKxt8oxKipt1akQH+82gMA2AkD5QDUB5X5kJV6uixBoxxRPTR1dXvrxhP4CgPCoQEycnlyoA==,iv:iVmXDW9V9rPihY0skBPOs2xtsxDk946cyNeaNkoncIg=,tag:Qink/DPtOrfMDT0XscYmVQ==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:JKRw1p7kDka2BYyYRPWOCfqwA8U=,iv:DMxtarWyflV8gThuussfALdLRYUPnwXjPXHvP00PntI=,tag:MwEXN3KW5u/gEj+iS2M+RA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Un/qCjyWo5mK5+Pn+8gpBEiwzk3Z05gUoi7NvCWVAXdIRqHzV0JUkg==,iv:a9P5C1XEAe/7CR0+854vqS0WiWXz7JdHZy42BazCaAY=,tag:Qr13X+raweRD8iuKtW6UpQ==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:cQg0jHu/B4o+2MLE0t+EDPQ/NJ2D5WQivG8jCEkQS6NWUNXRdgDo4bvTv8B0L9iSH7mJ4Xs95j+YLMtIRw==,iv:WfryWcemYbtcww8NGpjJYXE0uVoTQyqB67nBxA+5mK4=,tag:qH6WdOiMSjN++dX5DJ8Ewg==,type:str]
 sops:
     age:
         - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dExVem9aaWQxS0NCL1dp
-            M3FETmIzUkRCWmlNblpRdmdBVDZiU3RnajNvCk1SK3V2ai9BLzJaTVk3Q0RURkZQ
-            dlZqUEVxWGRNbkkvSW9PRnFnTlRSWHcKLS0tIGtZWHpROHgvR24va0s1NjNlcjQ0
-            SkZxQldIZDRycGpQRHIreEN3VW1FTE0KlB8vKXkR/LJ8Y9qG39+QgfRyMNXRTRa0
-            mwRY8VHXA7CE1dNXg0hWc2r2iX7TJT+fgRNnHh/rZa8EeyanIjnIUw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXY0ptSnJOVXRaQ2Vvc2JO
+            RUlOUy90eTBJczZ0ekRRSU11d0ZjOTZyZFdrCjQwcmFTanJmSVlkY1lld0NLYXBU
+            M1VJQjgyRUxxNHlld0FZbmZoTkhiekkKLS0tIEd4dHo0dzNjbURSTHpzQmpxSlR5
+            eUhoOElWZFMrd1JjUjR5Z25PdWhDWHMK8jbhaMeJPal1TI99MITIAW9ciUVi7mOq
+            Nhdm+VJuh+QGOVz8WmTAiPM9P5zbOaVMYy28p4olos6yI8NuXNHOyw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:59Z"
-    mac: ENC[AES256_GCM,data:1A4nTc0wsplfhgeMPzrExp7sX0Z9jc9z1yBJgUiOpxlGKm3Pc7+wMjNcm444pNj0xhVDqoHFg1KJ/gkDANIODT9Sl45amdNJqIs5LT9OkSFefMmmteWfqjTrmAim36W3l3/NkDwvpiDtFG4AcYNsKegRExhU9cJImq//Lujv5as=,iv:D039dx9pmBZvRwzIQV9+KxehTT6jkaSAp0DS2QF2kF8=,tag:a2tS1+/SYb/QUKxoQGAZqw==,type:str]
+    lastmodified: "2026-08-26T10:25:07Z"
+    mac: ENC[AES256_GCM,data:76i+/BjcI1SsNX3LDNDGBmctUskLWQlsyWTET2DmxzDKiSI9PqpjLZ1PrpIY2ymethzth7oBaTNEET7t0DyTmy7tKhQVYnVK9Duk9ar/933sMrFXGUd90kHSaGRB5y66YyaM67SHDfc3UdtTy0NvMZgI3IQpkxoSu7r+IBVxPjI=,iv:ZYhe0bR+OG/B9cZgLZui03CBRBGOte58O3I5Nr+kOAY=,tag:7GtpxRXG6M20E6NgpD9l8w==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/recurring-jobs/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurringjob-backup.yaml

clusters/base/infra/longhorn/recurring-jobs/recurringjob-backup.yaml

@@ -0,0 +1,21 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  task: "backup"
+  cron: "0 3 * * *"
+  retain: 7
+  concurrency: 2
+  # "default" is a special group name: Longhorn auto-applies it to every
+  # volume that has NO recurring-job label at all - i.e. opt-out. To
+  # exclude a specific volume, give it any other (job-less) group label,
+  # e.g.:
+  #   recurring-job-group.longhorn.io/no-backup: enabled
+  # (having *any* recurring-job label disqualifies it from "default" -
+  # there's no dedicated "disabled" flag, this placeholder-group is the
+  # documented workaround)
+  groups:
+    - default
+  labels: {}

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:dJXspq3MBXkAxeT0DK4Vauc4rnY=,iv:xD+sLIIU6Pap5L6qqF5cKmy7qyz/8kt0ti5EeYEDSRg=,tag:VHJvwaEnZ46Atsm1AA2ljA==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:RysGKo8arL+dFLmCrVv8i+F/D+TRLYh+Zd7WdxsnFed0WND/dEADEQ==,iv:R7vcI949dzLveMiTNgZtBLMq65k0NFpjjnXGFeAhvxs=,tag:OkPDGIe0f4byKVX7+5XQyA==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:8VtJAYkMomOqnfT7U3I7IStQl7HeJN8xyd++6sd+Vn6htBFQACNx0fdgPw==,iv:Z/U8+lZl38Z1dMz6DfvvU1J/z7A1GS0P3VfWqGxEqNo=,tag:bxe7Sjtxlc5JsdDjHaCQ9A==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:2kDAw+aecLfuk3bUKvEiBNPS192F5YUwW9bu4PDMd+mITcJaI5KfCWHbjg==,iv:asC6pLZRfGI+MinA4u9HJVYN/nb3tpRqo1Ht3dESYtg=,tag:3WbSUFZy/sSvvtV577R0TQ==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:96w6AzDLiVzdE1YBS2p6pXvkcMY=,iv:+hdZtlRjDeaAm/CRTAAKqjYFe7eWDEIAEWQ7RUsY+sU=,tag:+ZtkMP0OeNlW+5RjEKW0tw==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:WXEgDBxWjHb8M1NTEvTxkNjxCrXAoJxoDhZLjZhtPUgFkNJqt+4pEA==,iv:9mEqNSQu3kIjF3wHzNbFKcaZxp/DqtlJTQD7U/95HnA=,tag:7d6H9iHU6bvT2OlthMRfPg==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:2Je7qL/G4afIEv86yo/pzcVb3Qg=,iv:v5Q9iZheolivEDN/d0QA27d55YNG418PSFb0cvp7XAY=,tag:eSN0F8Kuhh/U395lk634Vw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:l/lmIpBeNfpb3ub1KKIf1lsRzCyHODZdLKJQADychRSUbD0KHQvemw==,iv:nXZcQGe8K2Vmabdr6yo/U8CUlI+Jz/xNkaVD52aLzTQ=,tag:xGwcE+1AUaO+jW7j0prrAQ==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:KOdwZ7AsG/3ZxM6iJJyP80CzQy0JA+qQmqpZM8p0XCr0IwYNO2s9dbY89g==,iv:PIoyhQCMtVICoYjrlz/I4Daq+JlAjNOxCWUSHiwMaiI=,tag:gNTofr0ZbHPZUotRK4s0EA==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:P+DI1dOJ0Rjh5DRO2dwzepmwEJT4Syj2uggRPMXm2HD8LI6EfY1j2Bit9w==,iv:iVBEyEy5FwBTswKWQEEFsZYNt1D+7BUuROcrpwWIQdc=,tag:qK4AO2UKFcJlbHVFozXebg==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:w0KvGRa/KSrGs3hemxRswPmGaaI=,iv:IbQYR9QmRmH157kzlSKAhWuOoxucjlEek6CpRef1dnI=,tag:hTafBxldhK62IgnVd/7sQw==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:gsDVC+Y9BZNslDx/4+dLu2cdibRYDCvzFQJv3n12BJhLSVpz48GrgQ==,iv:yXcWmcWVcRe9hrc2RQ3q90UMERuse4RmtWZ/ZeHBf44=,tag:Eq7YlItEIwkNWnZ7n5e9kQ==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwamZmTEYvRnlsR3VrR1Q2
-            bnk1VlpHZDVSSGU3ZGNsVUV1QTEwS1czSXlRClJzZnBrcTEwRGdsWCtRYUZkRXBx
-            VFUwYzh4NFQxVXllNkZOZldxNXVHeUEKLS0tIHlHZ2VubkNQUDhDdU8rdnZ3c2VD
-            VHlVRlpQcGQ1OForQmVRczkyYjRXMHcKxFi4zoGxbb8goV9LWHdTZFc+5xRXjRhH
-            ijmpLkrZRmfC3o4V2gva14mCpxXjG0s+ftRtv1tj8fs4TR9aUJT/7w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMk9idjNYNXlTajZpVm1G
+            dTZYS2pOZURYUWQyY1Q2TFI3WkY2T3NLOEZVClJPMlNONS9hMHNIK1BsNkpQN0Zt
+            T0FMVzhLbjkySXZQWVBPVUUwdmpWY0kKLS0tIFB5cm1IY20vbUloZGJUYkRQcFJu
+            REMwU2FyeXJ0eE9Id21peXN0dGI3OXMKUHTUkMOoq1YK2967Zr1c3EeNjC9/NZsh
+            QcOQxnbybro97MaoJ29CS8ILEfFa/tShxP9S4n4zmoj6IXj+x2TuCg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:25:00Z"
-    mac: ENC[AES256_GCM,data:HgDTiZyTJbI+U9nm05BJoNxDFpJQ3Ua4gafvjZZpckJTMuysEiMyyj38Rh/dCmvw1bIIZ0svJSl0XrY6jwkXQZEuHY45SW23ImzwsUpw7BEX2mq/9ejwzvU1Byju2fzuskqUD7zUzFYwJBTXLGxfZFjQS0WT4R3Qbwu5O2C0gIA=,iv:aV1XKtAAYaoF9eE6oyek404XuinMEHSuxzzxWaO5eeU=,tag:vSYWGULp998eI77IuU1/Ag==,type:str]
+    lastmodified: "2026-08-26T10:25:08Z"
+    mac: ENC[AES256_GCM,data:E2diUkOxL2PHnED9kqhnBCYCYdPgdeXguAxhMqwKhtK5ugVnVoyTYEldJ5tBZJQtm8sOUXaj84DIFeF6kPQk1FE8rgtLPbDWpyav54WpG14sj5wIFLjDpNJh71/YT6hWJKcHp2AScYNcrSMnlFTx4pNZbNlQUtDN1cF43oKlw68=,iv:i7lp+ZN7s2YNAeYb8t2NeLGPDZky7ODNNK1W9Jmgcfg=,tag:RY5TPzRGHuSMUyAe/Hmeig==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0