feat(resources): BuildRestoreInitContainer (returns nil when no restore needed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: stubbi

internal/resources/restore_init.go

@@ -0,0 +1,75 @@
+package resources
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+
+	hermesv1 "github.com/stubbi/hermes-operator/api/v1"
+)
+
+// BuildRestoreInitContainer returns the init container that restores a snapshot
+// into the PVC. Returns nil when no restore is requested or one already finished.
+func BuildRestoreInitContainer(inst *hermesv1.HermesInstance) *corev1.Container {
+	if inst.Spec.RestoreFrom == "" {
+		return nil
+	}
+	if inst.Status.RestoredFrom == inst.Spec.RestoreFrom {
+		return nil
+	}
+	if inst.Spec.Backup.S3 == nil {
+		return nil
+	}
+
+	image := inst.Spec.Backup.Image
+	if image == "" {
+		image = ResticImage
+	}
+	region := inst.Spec.Backup.S3.Region
+
+	args := []string{
+		"-c",
+		fmt.Sprintf(
+			`set -euo pipefail
+SNAPSHOT_KEY=%q
+DEST=/home/hermes/.hermes
+if [ -n "$(ls -A "$DEST" 2>/dev/null)" ] && [ -z "${HERMES_RESTORE_FORCE:-}" ]; then
+  echo "ERROR: restore destination $DEST is not empty; refusing to overwrite. Set HERMES_RESTORE_FORCE=1 to override." >&2
+  exit 1
+fi
+restic --repo "$RESTIC_REPOSITORY" --no-cache dump latest "$SNAPSHOT_KEY" \
+  | zstd -d \
+  | tar -xf - -C "$DEST"
+echo "restore complete: $SNAPSHOT_KEY -> $DEST" >&2
+`,
+			inst.Spec.RestoreFrom,
+		),
+	}
+
+	return &corev1.Container{
+		Name:                     "init-restore",
+		Image:                    image,
+		ImagePullPolicy:          corev1.PullIfNotPresent,
+		Command:                  []string{"/bin/sh"},
+		Args:                     args,
+		TerminationMessagePath:   "/dev/termination-log",
+		TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+		Env: []corev1.EnvVar{
+			{Name: "RESTIC_REPOSITORY", Value: resticRepo(inst.Spec.Backup.S3)},
+			{Name: "AWS_DEFAULT_REGION", Value: region},
+		},
+		EnvFrom: []corev1.EnvFromSource{{
+			SecretRef: &corev1.SecretEnvSource{
+				LocalObjectReference: corev1.LocalObjectReference{Name: s3CredsSecretName(inst)},
+			},
+		}},
+		VolumeMounts: []corev1.VolumeMount{
+			{Name: "data", MountPath: "/home/hermes/.hermes"},
+		},
+		SecurityContext: &corev1.SecurityContext{
+			AllowPrivilegeEscalation: Ptr(false),
+			ReadOnlyRootFilesystem:   Ptr(true),
+			Capabilities:             &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
+		},
+	}
+}

internal/resources/restore_init_test.go

@@ -0,0 +1,79 @@
+package resources
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	hermesv1 "github.com/stubbi/hermes-operator/api/v1"
+)
+
+func restoreInstance() *hermesv1.HermesInstance {
+	return &hermesv1.HermesInstance{
+		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "agents"},
+		Spec: hermesv1.HermesInstanceSpec{
+			RestoreFrom: "prod/agents/demo/2026-05-10T03-00-00Z.tar.zst",
+			Backup: hermesv1.BackupSpec{
+				S3: &hermesv1.BackupS3Spec{
+					Bucket:               "hermes-backups",
+					Endpoint:             "s3.amazonaws.com",
+					Region:               "us-east-1",
+					CredentialsSecretRef: hermesv1.LocalObjectReference{Name: "hermes-s3-creds"},
+				},
+			},
+		},
+	}
+}
+
+func TestBuildRestoreInitContainer_NameAndImage(t *testing.T) {
+	c := BuildRestoreInitContainer(restoreInstance())
+	require.NotNil(t, c)
+	assert.Equal(t, "init-restore", c.Name)
+	assert.Equal(t, "restic/restic:0.16.4", c.Image)
+}
+
+func TestBuildRestoreInitContainer_EmbedsSnapshotKey(t *testing.T) {
+	c := BuildRestoreInitContainer(restoreInstance())
+	joined := strings.Join(c.Args, " ")
+	assert.Contains(t, joined, "prod/agents/demo/2026-05-10T03-00-00Z.tar.zst")
+	assert.Contains(t, joined, "/home/hermes/.hermes")
+}
+
+func TestBuildRestoreInitContainer_SecurityContext(t *testing.T) {
+	c := BuildRestoreInitContainer(restoreInstance())
+	require.NotNil(t, c.SecurityContext)
+	require.NotNil(t, c.SecurityContext.AllowPrivilegeEscalation)
+	assert.False(t, *c.SecurityContext.AllowPrivilegeEscalation)
+	require.NotNil(t, c.SecurityContext.ReadOnlyRootFilesystem)
+	assert.True(t, *c.SecurityContext.ReadOnlyRootFilesystem)
+}
+
+func TestBuildRestoreInitContainer_S3CredsViaEnvFromSecret(t *testing.T) {
+	c := BuildRestoreInitContainer(restoreInstance())
+	require.Len(t, c.EnvFrom, 1)
+	require.NotNil(t, c.EnvFrom[0].SecretRef)
+	assert.Equal(t, "hermes-s3-creds", c.EnvFrom[0].SecretRef.Name)
+}
+
+func TestBuildRestoreInitContainer_VolumeMount(t *testing.T) {
+	c := BuildRestoreInitContainer(restoreInstance())
+	require.Len(t, c.VolumeMounts, 1)
+	vm := c.VolumeMounts[0]
+	assert.Equal(t, "data", vm.Name)
+	assert.Equal(t, "/home/hermes/.hermes", vm.MountPath)
+}
+
+func TestBuildRestoreInitContainer_NilWhenNoRestore(t *testing.T) {
+	inst := restoreInstance()
+	inst.Spec.RestoreFrom = ""
+	assert.Nil(t, BuildRestoreInitContainer(inst))
+}
+
+func TestBuildRestoreInitContainer_NilWhenAlreadyRestored(t *testing.T) {
+	inst := restoreInstance()
+	inst.Status.RestoredFrom = inst.Spec.RestoreFrom
+	assert.Nil(t, BuildRestoreInitContainer(inst))
+}