mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Andrey Kolkov
bf69eff7a5
## What this PR does Adds optional scheduled S3 backups for the `keycloak-db` CloudNativePG cluster. When `backup.enabled=true` with a `backup.destinationPath`, the Cluster gets `spec.backup.barmanObjectStore` (gzip-compressed data + WAL streams, a configurable `retentionPolicy`) and a `ScheduledBackup` drives recurring base backups. S3 credentials are either inlined into a rendered `keycloak-db-backup-s3-creds` Secret, or referenced via `backup.existingSecretName` (a Secret carrying `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`). Disabled by default — no change to existing deployments; the object store coordinates and credentials are supplied per-environment by the operator. This is the Keycloak/Postgres half of backing up a Cozystack portal control plane. The portal-side etcd backups (system Talos etcd + api-server etcd) live in the companion downstream PR aenix-org/cozyportal#1008. ### Release note ```release-note feat(keycloak): add optional S3 backups (CNPG Barman) for the Keycloak database, configurable via `backup.*` values and disabled by default. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added configurable scheduled backups for the Keycloak CNPG database to an S3-compatible object store, including destination prefix, optional endpoint URL, retention policy, and cron schedule. * Backups and scheduled backup resources are only created when all required backup settings are provided, avoiding incomplete configuration. * Supports backup credentials via inline values (creates the needed Secret automatically) or via an existing Secret reference. * **Documentation** * Added guidance on the cron schedule format required for the scheduler. <!-- end of auto-generated comment: release notes by coderabbit.ai -->