up

Author: mitchross

docs/backup-restore.md

@@ -49,7 +49,7 @@ The system automatically backs up PVCs to NFS storage on TrueNAS using **Kopia**
 - **Path:** `/mnt/BigTank/k8s/volsync-kopia-nfs`
 - **Encryption:** Kopia encrypts all data with KOPIA_PASSWORD
 
-### 2. MutatingAdmissionPolicy
+### 2. Kyverno NFS Injection Policy
 - Automatically injects NFS mount into all VolSync mover jobs
 - Mounts `/repository` from TrueNAS NFS share
 - No per-app configuration needed
@@ -214,8 +214,8 @@ The following namespaces are excluded from automatic backup:
 
 | File | Purpose |
 |------|---------|
-| `infrastructure/storage/volsync/` | VolSync Helm chart + MutatingAdmissionPolicy |
-| `infrastructure/storage/volsync/mutatingadmissionpolicy.yaml` | Injects NFS mount into mover pods |
+| `infrastructure/storage/volsync/` | VolSync Helm chart |
+| `infrastructure/controllers/kyverno/policies/volsync-nfs-inject.yaml` | Injects NFS mount into mover pods |
 | `infrastructure/storage/kopia-ui/` | Kopia web UI for browsing backups |
 | `infrastructure/controllers/kyverno/policies/volsync-pvc-backup-restore.yaml` | Kyverno policy |
 | `monitoring/prometheus-stack/volsync-alerts.yaml` | Prometheus alerting rules |

infrastructure/controllers/kyverno/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
 - namespace.yaml
 - rbac-patch.yaml
 - policies/volsync-pvc-backup-restore.yaml
+- policies/volsync-nfs-inject.yaml
 helmCharts:
 - name: kyverno
   repo: https://kyverno.github.io/kyverno

infrastructure/controllers/kyverno/policies/volsync-nfs-inject.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: volsync-nfs-inject
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+    policies.kyverno.io/title: VolSync NFS Mount Injection
+    policies.kyverno.io/description: >-
+      Injects NFS volume mount into VolSync mover jobs so Kopia can
+      access the shared repository on TrueNAS.
+spec:
+  rules:
+    - name: inject-nfs-volume
+      match:
+        any:
+          - resources:
+              kinds:
+                - Job
+              selector:
+                matchLabels:
+                  app.kubernetes.io/created-by: volsync
+      mutate:
+        patchStrategicMerge:
+          spec:
+            template:
+              spec:
+                volumes:
+                  - name: repository
+                    nfs:
+                      server: "192.168.10.133"
+                      path: "/mnt/BigTank/k8s/volsync-kopia-nfs"
+        foreach:
+          - list: "request.object.spec.template.spec.containers"
+            patchesJson6902: |-
+              - op: add
+                path: /spec/template/spec/containers/{{@index}}/volumeMounts/-
+                value:
+                  name: repository
+                  mountPath: /repository

infrastructure/storage/volsync/kustomization.yaml

@@ -4,7 +4,6 @@ namespace: volsync-system
 resources:
   - namespace.yaml
   - volumesnapshotclass.yaml
-  - mutatingadmissionpolicy.yaml
 helmCharts:
   - name: volsync
     repo: https://perfectra1n.github.io/volsync/charts