Skip to content

Use separate Restic repositories for each Kubernetes namespace #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
remram44 merged 3 commits into from
Feb 27, 2026
Merged

Use separate Restic repositories for each Kubernetes namespace #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3317f29
Set RESTIC_HOST instead of using --host
remram44 Feb 20, 2026
b9c82ea
Have backup jobs run `restic init`
remram44 Feb 20, 2026
bc871f6
Use a separate repository per namespace
remram44 Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 12 additions & 10 deletions ceph_backup/backup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -471,10 +471,11 @@ def backup_rbd_fs(api, vol, now, max_backup_duration):

# Create a job to do the backup
script = (
'printf -- \'backing up filesystem %s/%s \\n\' ' + vol['namespace'] + ' ' + vol['name'] + ' >&2\n'
'export RESTIC_REPOSITORY=$RESTIC_REPOSITORY_BASE/' + vol['namespace'] + '\n'
+ 'printf -- \'backing up filesystem %s/%s \\n\' ' + vol['namespace'] + ' ' + vol['name'] + ' >&2\n'
+ 'if restic init >/dev/null 2>&1; then printf -- \'created new repository\\n\' >&2; fi\n'
+ 'stdbuf -o L -e L'
+ ' restic'
+ ' --host $(HOST)'
+ ' --exclude lost+found'
+ ' backup /data'
)
Expand Down Expand Up @@ -502,10 +503,10 @@ def backup_rbd_fs(api, vol, now, max_backup_duration):
image_pull_policy=BACKUP_IMAGE_PULL_POLICY,
args=['sh', '-c', script],
env=format_env(
RESTIC_REPOSITORY=(
'secret', RESTIC_SECRET_NAME, 'url',
RESTIC_REPOSITORY_BASE=(
'secret', RESTIC_SECRET_NAME, 'base-url',
),
HOST='rbd-fs-%s-nspvc-%s' % (
RESTIC_HOST='rbd-fs-%s-nspvc-%s' % (
vol['namespace'],
vol['name'],
),
Expand Down Expand Up @@ -651,12 +652,13 @@ def backup_rbd_block(api, vol, now, max_backup_duration):

# Create a job to do the backup
script = (
'printf -- \'backing up block %s/%s \\n\' ' + vol['namespace'] + ' ' + vol['name'] + ' >&2\n'
'export RESTIC_REPOSITORY=$RESTIC_REPOSITORY_BASE/' + vol['namespace'] + '\n'
+ 'printf -- \'backing up block %s/%s \\n\' ' + vol['namespace'] + ' ' + vol['name'] + ' >&2\n'
+ 'if restic init >/dev/null 2>&1; then printf -- \'created new repository\\n\' >&2; fi\n'
+ 'rbd diff --whole-object --format=json ' + rbd_fq_image
+ ' > /tmp/layout.json'
+ ' && streaming-qcow2-writer /disk /tmp/layout.json'
+ ' | stdbuf -o L -e L restic'
+ ' --host $(HOST)'
+ ' backup --stdin --stdin-filename disk.qcow2'
)
with tracer.start_as_current_span('create-job'):
Expand All @@ -683,10 +685,10 @@ def backup_rbd_block(api, vol, now, max_backup_duration):
image_pull_policy=BACKUP_IMAGE_PULL_POLICY,
args=['sh', '-c', script],
env=format_env(
RESTIC_REPOSITORY=(
'secret', RESTIC_SECRET_NAME, 'url',
RESTIC_REPOSITORY_BASE=(
'secret', RESTIC_SECRET_NAME, 'base-url',
),
HOST='rbd-block-%s-nspvc-%s' % (
RESTIC_HOST='rbd-block-%s-nspvc-%s' % (
vol['namespace'],
vol['name'],
),
Expand Down
5 changes: 4 additions & 1 deletion helm/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,14 @@ cephSecretName: ceph
# userKey: KP1BWrhRO2eTwG/tDf24N8SH5GCS1A5eIRfeNQ==
cephKeySecretName: ceph-key

# Secret containing 'url', the repository URL, and 'password', the repository password
# Secret containing 'base-url', the base repository URL, and 'password', the
# repository password
# Example:
# stringData:
# url: rest:http://k8s-ceph:accesspassword@restic.example.com/k8s-ceph
# password: encryptpassword
# This will create repositories for each namespace like:
# http://restic.example.com/k8s-ceph/some-namespace
resticSecretName: restic

# Every hour at 48 minutes past the hour
Expand Down