first commit

.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: rustic
+description: fast, encrypted and deduplicated backups
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v0.6.1"

README.md

@@ -0,0 +1,51 @@
+# Rustic
+
+[Rustic](https://rustic.cli.rs/) is a backup tool that provides fast, encrypted and deduplicated backups.
+
+It reads and writes the [restic](https://github.com/restic/restic) repo format described in the [design document](https://github.com/restic/restic/blob/master/doc/design.rst) and can be used as a restic replacement in most cases.
+
+## Introduction
+
+This chart will set up rustic as a Kubernetes CronJob
+
+## Installing
+
+### Prerequisites
+
+1. Kubernetes >=1.29 or 1.28 (with featureGate `SidecarContainers` enabled)
+2. Helm v3 (Tested with v3.11.2)
+3. Rustic's chart repository: `helm repo add rustic https://rustic`
+
+
+Bare minimum `values.yml`:
+```
+hostname: <myHost>
+
+rustic:
+  encryption_secret: "***"
+  backup_volume:
+    hostPath:
+      path: /path/to/backupfolder
+
+s3:
+  repo:
+    endpoint: s3.fr-par.scw.cloud
+    access_key_id: <myS3AccessKeyID>
+    secret_access_key: <mySecretS3AccessKey>
+    region: fr-par
+    bucket: k8s-data-cold
+```
+
+### Deploying rustic
+
+```
+helm install rustic rustic/rustic --set rustic.init=true -f values.yml
+```
+
+If there is already an initialized restic repository in the Bucket omit `--set rustic.init=true`:
+
+```
+helm install rustic rustic/rustic -f values.yml
+```
+
+### Examples

templates/_helpers.tpl

@@ -0,0 +1,51 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "rustic.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "rustic.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rustic.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "rustic.labels" -}}
+helm.sh/chart: {{ include "rustic.chart" . }}
+{{ include "rustic.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "rustic.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "rustic.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

templates/cronjob.yaml

@@ -0,0 +1,140 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "rustic.fullname" . }}
+  labels:
+    {{- include "rustic.labels" . | nindent 4 }}
+spec:
+  schedule: "{{ .Values.cronjob.schedule }}"
+  failedJobsHistoryLimit: {{ .Values.cronjob.failedJobsHistoryLimit }}
+  successfulJobsHistoryLimit: {{ .Values.cronjob.successfulJobsHistoryLimit }}
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            {{- include "rustic.labels" . | nindent 12 }}
+        spec:
+          automountServiceAccountToken: false
+          hostname: {{ .Values.hostname }}
+          restartPolicy: {{ .Values.cronjob.restartPolicy }}
+          initContainers:
+            - name: rclone
+              image: "{{ .Values.rclone.image.repository }}:{{ .Values.rclone.image.tag }}"
+              imagePullPolicy: {{ .Values.rclone.image.pullPolicy }}
+              restartPolicy: Always
+              args:
+                - serve
+                - restic
+                - -v
+                - --addr
+                - :8080
+                - repo:{{ .Values.s3.repo.bucket }}
+              volumeMounts:
+                - mountPath: /config/rclone
+                  name: rclone-config
+              startupProbe:
+                httpGet:
+                  path: /
+                  port: 8080
+                  httpHeaders:
+                    - name: Accept
+                      value: application/vnd.x.restic.rest.v2
+                failureThreshold: 30
+                periodSeconds: 1
+              resources:
+                {{- toYaml .Values.rclone.resources | nindent 16 }}
+              securityContext:
+                {{- toYaml .Values.rclone.securityContext | nindent 16 }}
+            {{- if .Values.s3.repo_hot }}
+            - name: rclone-hot
+              image: "{{ .Values.rclone.image.repository }}:{{ .Values.rclone.image.tag }}"
+              imagePullPolicy: {{ .Values.rclone.image.pullPolicy }}
+              restartPolicy: Always 
+              args:
+                - serve
+                - restic
+                - -v
+                - --addr
+                - :8081
+                - repo-hot:{{ .Values.s3.repo_hot.bucket }}
+              volumeMounts:
+                - mountPath: /config/rclone
+                  name: rclone-hot-config
+              startupProbe:
+                httpGet:
+                  path: /
+                  port: 8081
+                  httpHeaders:
+                    - name: Accept
+                      value: application/vnd.x.restic.rest.v2
+                failureThreshold: 30
+                periodSeconds: 1
+              resources:
+                {{- toYaml .Values.rclone.resources | nindent 16 }}
+              securityContext:
+                {{- toYaml .Values.rclone.securityContext | nindent 16 }}
+            {{- end }}
+          containers:
+            - name: {{ .Chart.Name }}
+              image: "{{ .Values.rustic.image.repository }}:{{ .Values.rustic.image.tag  | default .Chart.AppVersion }}"
+              imagePullPolicy: {{ .Values.rustic.image.pullPolicy }}
+              args:
+                - backup
+                - --password-file
+                - "/etc/rustic/.rustic"
+                - --repository
+                - rest:http://localhost:8080/
+                {{- if .Values.s3.repo_hot }}
+                - --repo-hot
+                - rest:http://localhost:8081/
+                {{- end }}
+                {{- if .Values.persistence }}
+                - --cache-dir
+                - /cache
+                {{- end }}
+                - "/backup"
+              volumeMounts:
+                - mountPath: /backup
+                  name: backup-folder
+                  readOnly: true
+                - mountPath: /etc/rustic
+                  name: rustic-encryption-secret
+                {{- if .Values.persistence }}
+                - name: cache
+                  mountPath: /cache
+                {{- end }}
+              resources:
+                {{- toYaml .Values.rustic.resources | nindent 16 }}
+              securityContext:
+                {{- toYaml .Values.rustic.securityContext | nindent 16 }}
+          volumes:
+            - name: backup-folder
+              {{- toYaml .Values.rustic.backup_volume | nindent 14 }}
+            - name: rustic-encryption-secret
+              secret:
+                secretName: {{ include "rustic.fullname" . }}-encryption-secret
+            {{- with .Values.persistence }}
+            - name: cache
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+            - name: rclone-config
+              secret:
+                secretName: {{ include "rustic.fullname" . }}-rclone
+            {{- if .Values.s3.repo_hot }}
+            - name: rclone-hot-config
+              secret:
+                secretName: {{ include "rustic.fullname" . }}-rclone-hot
+            {{- end }}
+          {{- with .Values.nodeSelector }}
+          nodeSelector:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.affinity }}
+          affinity:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.tolerations }}
+          tolerations:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}