postgres-gcs-backup

This project aims to provide a simple way to perform a PostgreSQL server/db backup using pg_dump and to upload it to Google Cloud Storage. It also provides the ability to send Slack alerts in case of failure.

We provide a kubernetes support thanks to the helm chart located in the chart folder of this repository.

Docker image

You can pull the public image from Docker Hub:

docker pull diogopms/postgres-gcs-backup:latest

Or pull the public image from Github Registry:

 docker pull ghcr.io/diogopms/postgres-gcs-backup:latest

Configuration

The following table lists the configurable parameters you can set up.

Environment Variable	Required	Default	Description
JOB_NAME	No	default-name	Job name
BACKUP_DIR	No	/tmp	The path where the pg_dump result will be temporarily stored.
BOTO_CONFIG_PATH	No	/root/.boto	The path where gsutil will search for the boto configuration file.
GCS_BUCKET	Yes		The bucket you want to upload the backup archive to.
GCS_KEY_FILE_PATH	Yes		The location where the GCS serviceaccount key file will be mounted.
POSTGRES_HOST	No	localhost	The PostgreSQL server host.
POSTGRES_PORT	No	5432	The PostgreSQL port.
POSTGRES_DB	No		The database to backup. By default, a backup of all the databases will be performed.
POSTGRES_USER	No		The PostgreSQL user if any.
POSTGRES_PASSWORD	No		The PostgreSQL password if any.
SLACK_AUTHOR_NAME	No	postgres-gcs-backup	true slack author name.
SLACK_ALERTS	No		true if you want to send Slack alerts in case of failure.
SLACK_WEBHOOK_URL	No		The Incoming WebHook URL to use to send the alerts.
SLACK_CHANNEL	No		The channel to send Slack messages to.
SLACK_USERNAME	No		The user to send Slack messages as.
SLACK_ICON	No		The Slack icon to associate to the user/message.

You can set all of these variables within your values.yaml file under the env dict key.

Usage

Run locally

You can run the script locally:

cd /path/to/postgres-gcs-backup
chmod +x backup.sh
GCS_BUCKET=<gs://bucket_name> \
./backup.sh

Please note that you can set any environment variable described in the previous section! As an example, to enable the Slack alerts on failure:

SLACK_ALERTS=true \
SLACK_WEBHOOK_URL=<webhook_url> \
SLACK_CHANNEL=<slack_channel> \
SLACK_USERNAME=<slack_username> \
SLACK_ICON=<slack_icon> \
GCS_BUCKET=<gs://bucket_name> \
./backup.sh

Run within Kubernetes

Installing the Chart

To install the chart with the release name my-release within you Kubernetes cluster:

$ helm install --name my-release chart/postgres-gcs-backup

The command deploys the chart on the Kubernetes cluster in the default namespace. The configuration section lists the parameters that can be configured during installation.

Uninstalling the Chart

To uninstall/delete the my-release deployment:

$ helm delete my-release

The command removes all the Kubernetes components associated with the chart and deletes the release.

Authenticate with GCS

Using the gcloud CLI

If you are running the script locally, the easiest solution is to sign in to the google account associated with your Google Cloud Storage data:

gcloud init --console-only

More information on how to setup gsutil locally here.

Using a service account within Kubernetes

You can create a service account with the required roles to write to GCS attached.

To use the resulting JSON key file within Kubernetes you can create a secret from it by running the following command:

  kubectl create secret generic postgres-gcs-backup \
  --from-file=credentials.json=/path/to/your/key.json

Then you will need to specify this secret name via the --set secretName=<your_secret_name> argument to the helm install command or by specifying it directly in your values.yaml file (by default, the secret name is set to postgres-gcs-backup). The key file will be mounted by default under /secrets/gcp/credentials.json and the GCS_KEY_FILE_PATH variable should point to it.