apiVersion: batch/v1
kind: CronJob
metadata:
  name: restic-backup
spec:
  jobTemplate:
    metadata:
      name: restic-backup
    spec:
      template:
        spec:
          serviceAccountName: vault-auth

          initContainers:
          - name: vault-agent
            image: vault
            args:
            - agent
            - -config=/etc/vault/vault-agent-config.hcl
            - -log-level=debug
            env:
            - name: VAULT_ADDR
              value: http://10.0.10.40:30000
            volumeMounts:
            - mountPath: /etc/vault
              name: config
            - mountPath: /etc/secrets
              name: shared-data

          containers:
          - image: restic/restic
            name: backup
            command:
            - "/bin/sh"
            - "-c"
            - "/usr/bin/restic -H $(MY_NODE_NAME) -o sftp.command='ssh backup@10.0.10.43 -i /mnt/restic-id_ecdsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p 2222 -s sftp' backup /data"
            env:
            - name: MY_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: RESTIC_REPOSITORY
              value: sftp://backup/restic/hashitalks/cl2/nginx
            - name: RESTIC_PASSWORD_FILE
              value: /mnt/nginx-password
            volumeMounts:
            - mountPath: /mnt
              name: shared-data
              readOnly: true
            - mountPath: /data
              name: nginx-data

          volumes:
          - configMap:
              items:
              - key: vault-agent-config.hcl
                path: vault-agent-config.hcl
              name: vault-agent-config-nginx
            name: config
          - emptyDir: {}
            name: shared-data
          - persistentVolumeClaim:
              claimName: nginx-pvc
            name: nginx-data

          nodeName: cl2
          restartPolicy: OnFailure
  schedule: 0/5 * * * *
