{"id":13550004,"url":"https://github.com/pantheon-systems/kube-backup","last_synced_at":"2025-04-02T23:31:31.719Z","repository":{"id":136905395,"uuid":"82857658","full_name":"pantheon-systems/kube-backup","owner":"pantheon-systems","description":"[DEPRECATED] automatcally backup a kubernetes cluster to google cloud storage with GPG encryption using keybase.io","archived":true,"fork":false,"pushed_at":"2020-04-10T15:48:23.000Z","size":74,"stargazers_count":2,"open_issues_count":3,"forks_count":4,"subscribers_count":47,"default_branch":"master","last_synced_at":"2024-11-03T19:37:30.049Z","etag":null,"topics":["gce","infrastructure","kubernetes","platfrastructure"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pantheon-systems.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-02-22T22:11:44.000Z","updated_at":"2023-01-28T14:39:17.000Z","dependencies_parsed_at":"2024-01-16T19:04:37.960Z","dependency_job_id":null,"html_url":"https://github.com/pantheon-systems/kube-backup","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pantheon-systems%2Fkube-backup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pantheon-systems%2Fkube-backup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pantheon-systems%2Fkube-backup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pantheon-systems%2Fkube-backup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pantheon-systems","download_url":"https://codeload.github.com/pantheon-systems/kube-backup/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246911020,"owners_count":20853652,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gce","infrastructure","kubernetes","platfrastructure"],"created_at":"2024-08-01T12:01:27.957Z","updated_at":"2025-04-02T23:31:30.938Z","avatar_url":"https://github.com/pantheon-systems.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"\u003e :warning: This repo is retired. There will be no updates. We recommend using https://velero.io/ instead\n\u003e which has far more features and a community to maintain it.\n\nkube-backup\n===========\n\nA utility to backup Kubernetes cluster's resources to a GCS storage bucket in\na GPG-encrypted tarball. GPG keys are fetched from keybase.io.\n\n\u003c!-- toc --\u003e\n\n- [Usage](#usage)\n  * [Configuration](#configuration)\n  * [Auth / Credentials](#auth--credentials)\n    + [Google Service Account (gcloud/gsutil)](#google-service-account-gcloudgsutil)\n    + [Kubernetes Authentiation (Kubectl)](#kubernetes-authentiation-kubectl)\n- [Deployment](#deployment)\n- [Limitations](#limitations)\n- [Development \u0026 Testing](#development--testing)\n\n\u003c!-- tocstop --\u003e\n\nUsage\n-----\n\n### Configuration\n\nConfiguration is handled through environment variables:\n\n- `KEYBASE_USERS`: A space-separated list of keybase.io users whose GPG\n  keys will be used to encrypt the backup.\n- `INTERVAL`: Used by the docker-run.sh wrapper when running as a Kubernetes pod. This\n  setting defines how often the backup.sh script is executed. Default is 4h.\n- `GCS_BUCKET_PATH`: Google Cloud Storage path to store backups under, eg:\n  `gs://pantheon-internal-kube-backups/cluster-01/`\n- `GOOGLE_APPLICATION_CREDENTIALS`: Path to a JSON file containing a service\n  account that has access to upload objects to `GCS_BUCKET_PATH`. Optional. See\n  below for details.\n\n### Auth / Credentials\n\n#### Google Service Account (gcloud/gsutil)\n\nThe script uses `gsutil` from the Google Cloud SDK to upload encrypted tarballs\nto GCS. Authentication for the SDK is defined\nby [Google Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials)\n\nIn many cases you may not need to do anything to configure authentication for\nGCS since it may already be available in your local workstation environment\nor if running on a Google Compute VM (including GKE cluster) whose built-in\nservice account has read/write access to GCS.\n\nAlternatively, you can explicitly set a service-account to use by setting the\n`$GOOGLE_APPLICATION_CREDENTIALS` environment var to a JSON file. The service-account\nneeds the *Storage Object Creator* role.\n\n#### Kubernetes Authentiation (Kubectl)\n\nIt is assumed that kubectl is installed and configured to access the cluster\nyou want to backup. This is usually the case when run locally from your\nworkstation or if run from within the kube-system namespace and the pod has\naccess to the default token.\n\nDeployment\n----------\n\nSee the `deployment-example.yaml` file for an example Deployment.\n\nDeployment to Pantheon's clusters is handled by the [gce-infrastructure](https://github.com/pantheon-systems/gce-infrastructure)\nrepo.\n\nLimitations\n-----------\n\nThe list of resource types to be backed up is currently hard-coded. If a new\nresource type is added by a newer version of Kubernetes or if you have\nThirdPartyResources defined you will need to modify the `ns_objects=` array in\nbackup.sh for namespaced objectds and `cluster_objects=` for cluster-level\nobjects.\n\nDevelopment \u0026 Testing\n---------------------\n\nIt's just a few simple shell scripts. All code should pass shellcheck linting\n(`make test` or `make test-shell`) and follow the\n[Google Shell Style Guide](https://google.github.io/styleguide/shell.xml).\n\n`make build-docker` will build the docker container. `make push` will push\nit to quay.io.\n\nA few methods are available for testing against a real cluster:\n\n- *Local*: Assuming have you `gcloud` and `kubectl` installed and authentication\n  is configured, you can run the backup.sh script directly.\n```\n./backup.sh\n```\n\n- *Interactive pod within a Kubernetes Cluster*:\n```\nmake build-docker push\nkubectl run joe-test --image=quay.io/getpantheon/kube-backup:dev --restart=Never --image-pull-policy=Always -it --command -- /bin/bash\n\nroot@kube-backup-test# ./backup.sh\n# or exec ./docker-run.sh if you want to test the wrapper\n\n# cleanup the pod when done:\nkubectl delete pod kube-backup-test\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpantheon-systems%2Fkube-backup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpantheon-systems%2Fkube-backup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpantheon-systems%2Fkube-backup/lists"}