defaults.yml

parameters:
  backup_k8up:
    =_metadata:
      multi_tenant: true

    charts:
      k8up:
        source: https://k8up-io.github.io/k8up
        version: 4.8.6

    images:
      k8up:
        registry: ghcr.io
        repository: k8up-io/k8up
        tag: v2.13.1
        pullPolicy: IfNotPresent

    helmReleaseName: k8up

    namespace: syn-backup-k8up
    priorityClass: system-cluster-critical

    helmValues:
      replicaCount: 1
      image: ${backup_k8up:images:k8up}
      priorityClassName: ${backup_k8up:priorityClass}
      k8up:
        enableLeaderElection: true
        timezone: "Etc/UTC"

        backupImage:
          repository: ${backup_k8up:images:k8up:registry}/${backup_k8up:images:k8up:repository}
          tag: ${backup_k8up:images:k8up:tag}

        skipWithoutAnnotation: ${backup_k8up:global_backup_config:skip_without_annotation}

        envVars:
          - name: BACKUP_PROMURL
            value: '${backup_k8up:prometheus_push_gateway}'
          - name: BACKUP_GLOBALACCESSKEYID
            valueFrom:
              secretKeyRef:
                name: '${backup_k8up:global_backup_config:s3_credentials:secretname}'
                key: '${backup_k8up:global_backup_config:s3_credentials:accesskeyname}'
          - name: BACKUP_GLOBALSECRETACCESSKEY
            valueFrom:
              secretKeyRef:
                name: '${backup_k8up:global_backup_config:s3_credentials:secretname}'
                key: '${backup_k8up:global_backup_config:s3_credentials:secretkeyname}'
          - name: BACKUP_GLOBALREPOPASSWORD
            valueFrom:
              secretKeyRef:
                name: '${backup_k8up:global_backup_config:backup_secret:name}'
                key: password
          - name: BACKUP_GLOBALRESTORES3ACCESSKEYID
            valueFrom:
              secretKeyRef:
                name: '${backup_k8up:global_backup_config:s3restore_credentials:secretname}'
                key: '${backup_k8up:global_backup_config:s3restore_credentials:accesskeyname}'
          - name: BACKUP_GLOBALRESTORES3SECRETACCESSKEY
            valueFrom:
              secretKeyRef:
                name: '${backup_k8up:global_backup_config:s3restore_credentials:secretname}'
                key: '${backup_k8up:global_backup_config:s3restore_credentials:secretkeyname}'
          - name: BACKUP_ANNOTATION
            value: '${backup_k8up:annotation}'
          - name: BACKUP_BACKUPCOMMANDANNOTATION
            value: '${backup_k8up:backupcommandannotation}'
          - name: BACKUP_GLOBALKEEPJOBS
            value: '${backup_k8up:global_backup_config:keepjobs}'
          - name: BACKUP_GLOBAL_SUCCESSFUL_JOBS_HISTORY_LIMIT
            value: '${backup_k8up:global_backup_config:successful_jobs_history_limit}'
          - name: BACKUP_GLOBAL_FAILED_JOBS_HISTORY_LIMIT
            value: '${backup_k8up:global_backup_config:failed_jobs_history_limit}'
          - name: BACKUP_GLOBALS3ENDPOINT
            value: '${backup_k8up:global_backup_config:s3_endpoint}'
          - name: BACKUP_GLOBALSTATSURL
            value: '${backup_k8up:global_backup_config:stats_url}'
          - name: BACKUP_BACKOFFLIMIT
            value: '${backup_k8up:backofflimit}'
          - name: BACKUP_GLOBALRESTORES3BUCKET
            value: '${backup_k8up:global_backup_config:restore_bucket}'
          - name: BACKUP_GLOBALRESTORES3ENDPOINT
            value: '${backup_k8up:global_backup_config:restore_s3endpoint}'

    global_backup_config:
      enabled: true
      default_backup_bucket: '${cluster:name}-k8up-backups'
      s3_credentials:
        accesskey: ''
        secretkey: ''
        secretname: global-bucket-credentials
        accesskeyname: username
        secretkeyname: password
      backup_secret:
        name: global-backup-password
        password: '?{vaultkv:${cluster:tenant}/${cluster:name}/global-backup/password}'
      s3restore_credentials:
        accesskey: ''
        secretkey: ''
        secretname: global-restore-credentials
        accesskeyname: username
        secretkeyname: password
      restore_s3endpoint: null
      restore_bucket: null
      keepjobs: '3'
      successful_jobs_history_limit: null
      failed_jobs_history_limit: null
      stats_url: null
      s3_endpoint: null
      skip_without_annotation: false
    backofflimit: '2'
    annotation: k8up.io/backup
    backupcommandannotation: k8up.io/backupcommand
    alert_rule_filters:
      namespace: namespace=~"syn.*"
    prometheus_push_gateway: 'http://platform-prometheus-pushgateway.syn-synsights.svc:9091'
    prometheus_name: main
    monitoring_enabled: true

    # This parameter is deprecated since K8up v2 support
    monitoring_kube_state_metrics_job_name_label: "job_name" # Use "job" for kube-state-metrics < v1.5.0 (e.g. OpenShift 3.11):

    alert_thresholds:
      k8up_slow_backup_job_duration_seconds: 1200
    # Create JobFailed alert rules for the following types of jobs.
    # Valid keys are: ["archive", "backup", "check", "prune", "restore"].
    # `enabled: false` removes the alert rule.
    # Overrides can override all fields from the `job_failed_alert_template`. The fields are overridden before interpolating %(type)s.
    job_failed_alerts_for:
      archive:
        enabled: true
        overrides: {}
      backup:
        enabled: true
        overrides: {}
      check:
        enabled: true
        overrides: {}
      prune:
        enabled: true
        overrides: {}
      restore:
        enabled: true
        overrides: {}
    # The template for the JobFailed alert rules.
    # %(type)s in `alert` and `expr` is replaced by the types defined in `job_failed_alerts_for`.
    job_failed_alert_template:
      alert: K8up%(type)sFailed
      annotations:
        summary: Job in {{ $labels.namespace }} of type {{ $labels.label_k8up_syn_tools_type }} failed
      expr: (sum(kube_job_status_failed) by(${backup_k8up:monitoring_kube_state_metrics_job_name_label}, namespace) * on(${backup_k8up:monitoring_kube_state_metrics_job_name_label}, namespace) group_right() kube_job_labels{label_k8up_syn_tools_type="%(type)s"}) > 0
      for: 1m
      labels:
        severity: critical
    monitoring_alerts:
      k8up_last_errors:
        annotations:
          message: Last backup for PVC {{ $labels.pvc }} in namespace {{ $labels.instance }} had {{ $value }} errors
        expr: k8up_backup_restic_last_errors{${backup_k8up:alert_rule_filters:namespace}} > 0
        for: 1m
        labels:
          severity: critical
      K8upBackupNotRunning:
        annotations:
          message: No K8up jobs were run in {{ $labels.namespace }} within the last 24 hours. Check the operator, there might be a deadlock
        expr: sum by (namespace) (rate(k8up_jobs_total[25h])) == 0 and on(namespace) k8up_schedules_gauge > 0
        for: 1m
        labels:
          severity: critical
      K8upJobStuck:
        annotations:
          message: Queued K8up jobs in {{ $labels.namespace }} for the last hour.
        expr: k8up_jobs_queued_gauge{jobType="backup"} > 0 and on(namespace) k8up_schedules_gauge > 0
        for: 1h
        labels:
          severity: critical
      K8upSlowBackup:
        annotations:
          message: Backup job {{ $labels.job_name }} in {{ $labels.namespace }} took {{ $value|humanizeDuration }} to complete
        expr: (kube_job_status_completion_time{job_name=~"^backupjob-.*$"} - kube_job_status_start_time) > ${backup_k8up:alert_thresholds:k8up_slow_backup_job_duration_seconds}
        for: 1m
        labels:
          severity: warning