db-backup-rclone/examples/postgresql-to-azure-sas.yaml at main · GateNLP/db-backup-rclone · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# This is an example CronJob that backs up a postgresql database to
# Azure Blob Storage, using a SAS token from a secret for authentication.
# It also shows how to encrypt the files before upload using an SSH key,
# and how to use a custom file name pattern to split the backups into
# folders by month.

apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    k8s-app: postgresql-to-azure
  name: daily-backup-to-azure
spec:
  # Run at 01:13 AM each day
  schedule: 13 01 * * *
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            k8s-app: postgresql-to-azure
        spec:
          containers:
          - name: backup
            image: ghcr.io/gatenlp/postgresql-backup-rclone:latest
            imagePullPolicy: Always
            env:
            # Postgresql connection parameters
            - name: PGHOST
              value: example-postgresql
            - name: PGUSER
              value: dbuser
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: postgres-credentials
            # Name of the database or databases that we want to back up
            - name: BACKUP_DATABASES
              value: example_db
            # Split up the backup files into folders by month - this will
            # create files named e.g.
            # 2025/08/example_db_2025-08-12T01:13:04.sql.gz.age
            - name: BACKUP_FILE_NAME
              value: "%Y/%m/${DB}_%Y-%m-%dT%H-%M-%S"

            # The public key file to use for encryption
            - name: ENCRYPT_RECIPIENTS_FILE
              value: /encryption/id_ed25519.pub

            # Data store type is Azure Blob Storage
            - name: RCLONE_CONFIG_STORE_TYPE
              value: azureblob
            # Use a SAS token for authentication
            - name: RCLONE_CONFIG_STORE_SAS_URL
              valueFrom:
                secretKeyRef:
                  key: sas-url
                  name: azure-backup-credentials
            # Upload the backups to the "dbbackup" container - this MUST
            # match the container that is named in the SAS URL.
            - name: UPLOAD_PREFIX
              value: dbbackup

            volumeMounts:
            - mountPath: /encryption
              name: encryption-key

          volumes:
          - name: encryption-key
            secret:
              secretName: backup-public-key
          restartPolicy: Never
          terminationGracePeriodSeconds: 30