--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.4 name: restoresyncs.retour.thebackup.company spec: group: retour.thebackup.company names: kind: RestoreSync listKind: RestoreSyncList plural: restoresyncs singular: restoresync scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.storageBackendRef name: Backend type: string - jsonPath: .spec.mode name: Mode type: string - jsonPath: .spec.suspend name: Suspended type: boolean - jsonPath: .status.lastPolledAt name: Last Polled type: date - jsonPath: .status.restoresCreated name: Restores type: integer - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1 schema: openAPIV3Schema: description: |- RestoreSync is the Schema for the restoresyncs API: a warm-standby DR import policy that watches a shared storage backend and creates Restore CRs for backups written by another cluster. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- RestoreSyncSpec defines a warm-standby import policy: watch a shared storage backend for backups written by another cluster and create Restore CRs for them automatically. properties: allowSameNamespace: description: |- AllowSameNamespace acknowledges that restores land in the ORIGINAL source namespaces. Required in BOTH modes when the template has no namespaceMapping: on a standby cluster identity mapping is the normal DR posture, but the same CR applied to the PRIMARY would restore backups over the live namespaces they were just taken from — every new backup in Continuous mode, the newest one (once per backup) in Latest mode. The explicit acknowledgment keeps that a decision, not an accident. type: boolean mode: default: Latest description: |- Mode selects what gets restored each poll: Latest (default) restores only the newest qualifying backup; Continuous restores every new one. enum: - Latest - Continuous type: string pollInterval: description: |- PollInterval is how often the backend is listed for new backups. Defaults to 15m; values under 1m are raised to 1m (every poll runs a carrier job against the backend). type: string restoreTemplate: description: |- RestoreTemplate is the Restore spec each created Restore executes with. The sync fills in the backup reference (backupPath + backupJobUUID) and the storage backend; everything else — namespaceMapping, storageClassMapping, existingResourcePolicy, resourceModifiers and the rest — is copied verbatim. The template must not name a backup source (backupName/backupJobUUID/backupPath/storageBackend/veleroImport) or be a template reference itself. It is validated with the same checks the Restore reconcile applies; an invalid template flips the Degraded condition and creates nothing. properties: backupJobUUID: description: UUID of the backup job to restore from type: string backupName: description: Name of the backup to restore from type: string backupPath: description: External backup path on the storage backend (used when backup CRD/DB records do not exist in this cluster) type: string dryRun: description: |- DryRun renders what the restore would create into status.plannedObjects without applying anything. type: boolean existingResourcePolicy: description: |- ExistingResourcePolicy decides what the restore does with an object it recreates that already exists in the cluster. Keep (default) leaves the live object untouched. Update overwrites the live object with the backed-up one, carrying over what the API server requires an update to repeat; an immutable-field conflict is reported per resource in status.existingResources instead of failing the restore. Replace deletes the live object (bounded wait, finalizers report instead of hang) and recreates it from the backup. Volume data is out of scope for every policy: PVCs are restored by the data flow and an existing bound claim is NEVER deleted or overwritten implicitly — use spec.targetPVC to restore data into an existing claim. enum: - Keep - Update - Replace type: string hooks: description: |- Hooks are commands executed in the restored application pods after resources are applied and volume data is restored (e.g. reindex, invalidate caches, re-register with a coordinator). The worker waits, bounded, for pods matching each hook's selector to be Running before executing; outcomes land in status.hookStatuses. Cannot be combined with scaleWorkloadsToZero — workloads restored stopped never start the pods the hooks would exec in. properties: post: description: Post hooks run after resources and volume data are restored items: description: |- BackupHook is one command executed inside application containers around the snapshot phase of a backup (e.g. freeze/thaw a database). properties: command: description: Command to execute items: type: string type: array container: description: Container to exec in; defaults to the pod's first container type: string name: description: Name identifies the hook in status and logs type: string namespace: description: Namespace holds the pods to execute in type: string onError: description: |- OnError decides what a failed exec does: Fail (default) aborts the stage, Continue records the failure and proceeds enum: - Fail - Continue type: string podSelector: additionalProperties: type: string description: |- PodSelector matches pods by label; the hook runs in every matching Running pod type: object timeoutSeconds: description: TimeoutSeconds bounds one exec; default 30 format: int32 maximum: 3600 minimum: 1 type: integer required: - command - name - namespace - podSelector type: object type: array type: object imageRewrites: description: |- ImageRewrites rewrite container image prefixes in restored workloads (first matching rule wins). items: description: |- ImageRewrite replaces a container image prefix on restore (registry migration): an image starting with Old gets that prefix replaced with New. properties: new: description: New is the replacement prefix type: string old: description: Old is the image prefix to match (e.g. "registry.example.com/") type: string required: - new - old type: object type: array isTemplate: description: Marks this restore resource as a template. Templates are stored as CRDs but are not executed. type: boolean name: description: 'Name of the restore operation. Deprecated: use Restore.metadata.name instead.' type: string namespaceMapping: additionalProperties: type: string description: |- NamespaceMapping restores resources backed up from namespace into namespace (target namespaces are created as needed). type: object pathFilters: description: |- PathFilters selects individual files/directories to restore instead of whole volumes (rclone filter dialect: bare patterns include, "- pattern"/"! pattern" exclude; includes imply everything else is excluded). Setting pathFilters makes the restore DATA-ONLY: no workload manifests are recreated. Supported for both engines: a kopia-written operation has its snapshot listed and the selected paths restored individually, and rclone decides what the rules select in both cases, so they mean the same thing either way. items: type: string type: array preserveNamespaceUIDRange: description: |- PreserveNamespaceUIDRange keeps the source namespace's cluster-allocated SCC annotations (openshift.io/sa.scc.uid-range, .supplemental-groups, .mcs) on namespaces this restore creates. The default (false) drops them so the target cluster allocates its own ranges — the correct behavior when restoring into a different cluster, where the source ranges are meaningless and leave restored files unreadable by the pods that own them. Set true when restoring back onto the cluster that allocated the range. type: boolean resourceModifiers: description: |- ResourceModifiers patch restored manifests: each entry selects objects by groupKind (e.g. "deployments.apps"), optionally narrowed by namespaces, labelSelector and resourceNameRegex, and applies either an RFC 6902 JSON patch (patches) or an RFC 7386 merge patch (mergePatch). Modifiers run AFTER the built-in transforms (namespaceMapping, storageClassMapping, imageRewrites) and BEFORE objects are created; a dry run reports them in status.plannedObjects. Malformed modifiers fail the Restore before any worker pod is spawned. PVCs created by the data flow are not manifests and are never patched. items: description: |- ResourceModifier pairs a selector with exactly one patch flavor: an RFC 6902 JSON patch (patches) or an RFC 7386 JSON merge patch (mergePatch). properties: mergePatch: description: |- MergePatch is an RFC 7386 JSON merge patch document, as a JSON string (e.g. `{"metadata":{"labels":{"restored":"true"}}}`; null values delete fields). Mutually exclusive with patches. type: string patches: description: |- Patches is the RFC 6902 JSON patch, applied in order. Mutually exclusive with mergePatch. items: description: |- JSONPatchOperation is one RFC 6902 operation. Value is carried as a string: it is used verbatim when it parses as JSON (`3`, `true`, `{"a":1}`), and treated as a JSON string otherwise — so `"3"` sets the string "3" while `3` sets the number 3. properties: from: description: From is the source JSON pointer for move and copy operations. type: string op: description: Op is the RFC 6902 operation. enum: - add - remove - replace - move - copy - test type: string path: description: |- Path is the JSON pointer the operation targets (e.g. "/spec/template/spec/containers/0/image"). type: string value: description: |- Value for add, replace and test operations (see the type comment for how the string is interpreted). type: string required: - op - path type: object type: array selector: description: Selector picks the restored objects this modifier applies to. properties: groupKind: description: |- GroupKind selects the resource type, spelled resource.group as in "deployments.apps"; core-group resources use the bare resource name ("configmaps"). Singular spellings and the worker's usual aliases ("deploy") are accepted; matching is case-insensitive. type: string labelSelector: description: LabelSelector matches against the backed-up object's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces limits the modifier to objects restored into these namespaces (evaluated after spec.namespaceMapping). Empty matches every namespace; cluster-scoped objects match only when this is empty. items: type: string type: array resourceNameRegex: description: |- ResourceNameRegex is an RE2 regular expression matched (unanchored) against the object name. type: string required: - groupKind type: object required: - selector type: object type: array resourcesToRestore: description: Resources to restore items: description: ResourceReference defines the resource type, name, and namespace. properties: kind: type: string name: type: string namespace: type: string required: - kind - name - namespace type: object type: array scaleWorkloadsToZero: description: |- ScaleWorkloadsToZero recreates Deployments, StatefulSets and the like with zero replicas (and CronJobs suspended), so the restored application does not start and cannot write to the volumes that were just restored. Restore drills set it: a check that reads a path the restored workload also writes proves nothing about the backup — the pod rewrites the file before the check looks at it. Useful for any restore meant to be inspected before it is brought up. type: boolean secrets: description: |- Secrets opts this restore into applying the backup's encrypted Secrets stream. mode: Exclude (default) never decrypts it. mode: Restore requires the operator's admin gate (operator.allowSecretsBackup) AND the same dedicated secretsPassword on the crypt backend that wrote the stream; restored Secrets pass back through the type filter (service-account and bootstrap tokens are never recreated) and follow existingResourcePolicy Keep/Update — Replace is refused for Secrets. properties: mode: description: |- Mode selects whether the backup's Secrets stream is restored. Exclude (default, and what an absent spec.secrets means) never decrypts it. Restore decrypts the stream with the backend's dedicated secretsPassword and recreates the Secrets, passing every object back through the type filter (service-account and bootstrap tokens are never recreated). existingResourcePolicy Keep/Update applies; Replace is refused for Secrets. enum: - Exclude - Restore type: string type: object skipVerification: description: |- SkipVerification disables the post-restore verification pass (rclone check of the restored volume against the backup it came from, using the same filters the restore copied with). Verification is on by default; a verification failure fails the restore instead of reporting Completed over incomplete data. Kopia-written operations are verified by the engine itself and are unaffected. type: boolean storageBackend: description: Storage backend to restore from type: string storageClassMapping: additionalProperties: type: string description: |- StorageClassMapping rewrites PVC storage classes on restore: a claim backed up with class is restored with class . type: object targetPVC: description: |- TargetPVC restores the selected files into an EXISTING claim instead of creating claim-restore-* PVCs. Requires the restore to resolve to exactly one data operation (single-PVC backups, or pathFilters that narrow it). Implies data-only. properties: claimName: description: ClaimName of the existing PVC to restore into. type: string namespace: description: Namespace holding the claim. type: string required: - claimName - namespace type: object templateRef: description: Reference to another Restore resource with isTemplate=true to use as the source template. type: string veleroImport: description: |- VeleroImport restores Kubernetes MANIFESTS out of an existing Velero backup living in object storage — a migration path that keeps old Velero restore points usable after Velero is decommissioned. Mutually exclusive with backupName/backupJobUUID/backupPath/storageBackend, and with pathFilters/targetPVC/secrets (there is no Retour data or Secrets stream to draw from). Velero volume data is NOT imported: PVCs come back as fresh empty claims (see status.veleroImport). Because no Backup CR exists to derive RBAC scope from, provide namespaceMapping (identity mappings are fine) or resourcesToRestore so the operator knows the target namespaces. properties: backendRef: description: |- BackendRef names an existing StorageBackend (type s3, azureblob, or gcs) whose bucket holds the Velero backup. Velero stores backups in object storage the same way Retour reaches its own backends, so the ordinary backend rendering and credentials apply. minLength: 1 type: string path: description: |- Path is the prefix inside the backend where ONE Velero backup lives (e.g. "backups/my-velero-backup" — the directory holding .tar.gz and velero-backup.json). minLength: 1 type: string volumeData: description: |- VolumeData opts the import into restoring PVC VOLUME DATA out of the Velero backup's kopia repositories (kopia-uploader file-system backups and built-in data-mover backups; restic is NOT supported and is reported per PVC). The repositories are opened READ-ONLY — an import can never mutate the Velero repository. Requires repoPassword. properties: enabled: description: |- Enabled turns the volume-data restore on. False behaves exactly like an absent volumeData: manifests only, claims recreated empty. type: boolean repoPassword: description: |- RepoPassword references the Secret holding the Velero repository password under the key "repo-password". The Secret must live in the Restore's OWN namespace (namespace, when set, must match it). Copy the value from the `velero-repo-credentials` Secret in the velero namespace ON THE SOURCE CLUSTER — Velero's default install uses a static value there, but it is never assumed or defaulted here: without this Secret the volume-data restore refuses to run. properties: keys: description: Keys in the secret that contain the required data properties: accessKeyID: description: Key for access key ID (for S3 backends) type: string accountKey: description: Key for the Azure storage account shared key (for azureblob backends) type: string endpoint: description: Key for endpoint URL (if stored in secret) type: string kopiaPassword: description: |- Key for the kopia repository password (engine: kopia). The password encrypts the repository; losing it makes every kopia backup in the repository unrestorable. type: string password: description: Key for encryption password (for crypt backends) type: string region: description: Key for region (if stored in secret) type: string sasToken: description: |- Key for the Azure SAS URL (for azureblob backends). The value must be the full SAS URL for the container or account (rclone's sas_url), not the bare token. type: string secretAccessKey: description: Key for secret access key (for S3 backends) type: string secretsPassword: description: |- Key for the DEDICATED Secrets-stream passphrase (crypt backends only). Required before any Backup may set spec.secrets.mode: EncryptedOptIn. The value must be rclone-obscured (like the main password) and MUST differ from it: the separation is what keeps backend operators and normal-restore credentials unable to decrypt the Secrets stream. type: string serviceAccountKey: description: |- Key for the Google Cloud service-account JSON key (for gcs backends). The value is the JSON document itself, not a path. type: string type: object name: description: Name of the secret type: string namespace: description: Namespace of the secret (defaults to the same namespace as the StorageBackend) type: string required: - name type: object required: - enabled type: object required: - backendRef - path type: object type: object x-kubernetes-validations: - message: 'hooks cannot be combined with scaleWorkloadsToZero: workloads restored at zero replicas never start the pods post-restore hooks exec in' rule: '!has(self.hooks) || !has(self.scaleWorkloadsToZero) || !self.scaleWorkloadsToZero' - message: veleroImport is mutually exclusive with backupName/backupJobUUID/backupPath/storageBackend (the imported backup is named by veleroImport.backendRef + veleroImport.path) rule: '!has(self.veleroImport) || (!has(self.backupName) && !has(self.backupJobUUID) && !has(self.backupPath) && !has(self.storageBackend))' selector: description: 'Selector narrows which discovered backups qualify. Absent: all of them.' properties: namePrefix: description: |- NamePrefix qualifies backups whose recorded name (the Backup CR name on the cluster that wrote them) starts with this prefix. type: string namespaces: description: |- Namespaces qualifies a backup when at least one of its recorded source namespaces is in this list. Empty matches any namespace. items: type: string type: array scheduleName: description: |- ScheduleName qualifies backups created by the named BackupSchedule on the source cluster. The backup metadata records no schedule label, so this matches through the schedule's naming convention: backups named "-". type: string type: object storageBackendRef: description: |- StorageBackendRef names the StorageBackend (in the operator's namespace) to watch — typically the same bucket the primary cluster's backups land in. minLength: 1 type: string suspend: description: Suspend pauses polling. Already-created Restores are untouched. type: boolean required: - restoreTemplate - storageBackendRef type: object status: description: RestoreSyncStatus is the observed state of a RestoreSync. properties: conditions: description: |- Conditions: Ready (polling works) and Degraded (backend unreachable, template invalid, or the latest synced restore failed). items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array lastPolledAt: description: LastPolledAt is when the backend listing last completed. format: date-time type: string lastSyncedBackup: description: |- LastSyncedBackup is the newest backup a Restore has been created for. Its completedAt is the watermark: backups older than it are never re-synced, even after the recent list below has rotated them out. properties: backupName: description: BackupName is the backup's name on the cluster that wrote it. type: string completedAt: description: |- CompletedAt is when the backup was written (from the metadata documents' timestamps). format: date-time type: string jobUUID: description: JobUUID is the backup job's UUID as recorded in its metadata. type: string restoreName: description: RestoreName is the Restore CR the sync created for it. type: string syncedAt: description: SyncedAt is when the Restore was created. format: date-time type: string required: - jobUUID type: object recentRestores: description: |- RecentRestores lists the most recently created Restores, newest first, capped. items: description: SyncedBackup identifies one backup a RestoreSync created a Restore for. properties: backupName: description: BackupName is the backup's name on the cluster that wrote it. type: string completedAt: description: |- CompletedAt is when the backup was written (from the metadata documents' timestamps). format: date-time type: string jobUUID: description: JobUUID is the backup job's UUID as recorded in its metadata. type: string restoreName: description: RestoreName is the Restore CR the sync created for it. type: string syncedAt: description: SyncedAt is when the Restore was created. format: date-time type: string required: - jobUUID type: object type: array restoresCreated: description: RestoresCreated counts every Restore this sync has created. format: int32 type: integer type: object type: object served: true storage: true subresources: status: {}