apiVersion: batch/v1
kind: Job
metadata:
  name: restic-backup
spec:
  template:
    spec:
      serviceAccountName: vault-auth

      initContainers:
      - name: vault-agent
        image: vault
        args:
        - agent
        - -config=/etc/vault/vault-agent-config.hcl
        - -log-level=debug
        env:
        - name: VAULT_ADDR
          value: http://10.0.10.40:30000
        volumeMounts:
        - mountPath: /etc/vault
          name: config
        - mountPath: /etc/secrets
          name: shared-data

      containers:
      - image: restic/restic
        name: backup
        command:
        - "/bin/sh"
        - "-c"
        - "/usr/bin/restic -H $(MY_NODE_NAME) -o sftp.command='ssh backup@10.0.10.43 -i /mnt/restic-id_ecdsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p 2222 -s sftp' backup /data"
        env:
        - name: MY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: RESTIC_REPOSITORY
          value: sftp://backup/restic/hashitalks/cl2/nginx
        - name: RESTIC_PASSWORD_FILE
          value: /mnt/nginx-password
        volumeMounts:
        - mountPath: /mnt
          name: shared-data
          readOnly: true
        - mountPath: /data
          name: nginx-data

      volumes:
      - configMap:
          items:
          - key: vault-agent-config.hcl
            path: vault-agent-config.hcl
          name: vault-agent-config-nginx
        name: config
      - emptyDir: {}
        name: shared-data
      - persistentVolumeClaim:
          claimName: nginx-pvc
        name: nginx-data

      nodeName: cl2
      restartPolicy: OnFailure
