Squashed commit of the following:

commit 1e7871c Merge: d996d16 0f1228f Author: Bigli <[email protected]> Date: Tue May 28 13:17:19 2024 +0200 Merge pull request k8up-io#974 from k8up-io/gh/pr_template_co_sign Adjust the PR template to include signing off the commits commit 0f1228f Author: Nicolas Bigler <[email protected]> Date: Tue May 28 12:44:20 2024 +0200 Adjust the PR template to include signing off the commits Signed-off-by: Nicolas Bigler <[email protected]> commit d996d16 Merge: 0b29883 c0efc71 Author: Bigli <[email protected]> Date: Tue May 28 12:41:08 2024 +0200 Merge pull request k8up-io#967 from SchoolGuy/add-grafana-dashboard feat: Helm - Grafana Dashboard commit c0efc71 Author: Enno Gotthold <[email protected]> Date: Thu May 9 12:35:41 2024 +0200 [ADD] Helm - Grafana Dashboard Signed-off-by: Enno Gotthold <[email protected]> Signed-off-by: Nicolas Bigler <[email protected]> commit 0b29883 Merge: 60e75b6 f6648dd Author: Bigli <[email protected]> Date: Tue May 28 10:18:14 2024 +0200 Merge pull request k8up-io#971 from k8up-io/tutorial/update_crd_version Update the tutorial to the latest k8up version commit f6648dd Author: Nicolas Bigler <[email protected]> Date: Mon May 27 15:31:27 2024 +0200 Update the tutorial to the latest k8up version Signed-off-by: Nicolas Bigler <[email protected]> commit 60e75b6 Merge: 212a033 162e16b Author: Kidswiss <[email protected]> Date: Wed May 15 10:20:29 2024 +0200 Merge pull request k8up-io#969 from k8up-io/bump_chart Bump K8up version commit 162e16b Author: Simon Beck <[email protected]> Date: Wed May 15 09:45:16 2024 +0200 Bump K8up version Signed-off-by: Simon Beck <[email protected]> commit 212a033 Merge: 2ddb6ee c8e9202 Author: Kidswiss <[email protected]> Date: Wed May 15 09:36:03 2024 +0200 Merge pull request k8up-io#968 from k8up-io/add/pod_spec Add full podSpec to all job types commit c8e9202 Author: Simon Beck <[email protected]> Date: Wed May 15 09:04:58 2024 +0200 Remove unnecessary RBAC Signed-off-by: Simon Beck <[email protected]> commit d21f019 Author: Simon Beck <[email protected]> Date: Tue May 14 16:01:26 2024 +0200 Correctly flag test for integration Signed-off-by: Simon Beck <[email protected]> commit edea9f6 Author: Simon Beck <[email protected]> Date: Tue May 14 15:29:02 2024 +0200 Add make test to actions Signed-off-by: Simon Beck <[email protected]> commit 21494ca Author: Simon Beck <[email protected]> Date: Mon May 13 13:26:56 2024 +0200 Add docs Signed-off-by: Simon Beck <[email protected]> commit 2666a12 Author: Simon Beck <[email protected]> Date: Mon May 13 12:50:07 2024 +0200 Fix using the index to delay execution It did not actually do a staggered delay for each instance. Signed-off-by: Simon Beck <[email protected]> commit dd9f657 Author: Simon Beck <[email protected]> Date: Mon May 13 12:49:52 2024 +0200 Add full podSpec to all job types With this commit it's now possible to specify a full podSpec for each job type available. Signed-off-by: Simon Beck <[email protected]> commit 2ddb6ee Merge: 5ab0be4 15f78ac Author: Kidswiss <[email protected]> Date: Tue Apr 30 15:34:54 2024 +0200 Merge pull request k8up-io#963 from k8up-io/bump-chart Bump versions in the chart commit 15f78ac Author: Simon Beck <[email protected]> Date: Tue Apr 30 15:10:27 2024 +0200 Bump versions in the chart Signed-off-by: Simon Beck <[email protected]> commit 5ab0be4 Merge: 5d67b16 51b7fd7 Author: Kidswiss <[email protected]> Date: Tue Apr 30 14:47:07 2024 +0200 Merge pull request k8up-io#962 from amghazanfari/master bug: Add operator as mandatory argument commit 51b7fd7 Author: Amir M. Ghazanfari <[email protected]> Date: Sun Apr 28 12:37:15 2024 +0330 Add operator as mandatory argument Signed-off-by: amghazanfari <[email protected]> Signed-off-by: Amir Ghazanfari <[email protected]> commit 5d67b16 Merge: 2971c49 ccd6bce Author: Kidswiss <[email protected]> Date: Fri Apr 12 11:12:03 2024 +0200 Merge pull request k8up-io#954 from M0NsTeRRR/master [enhancement] add support for dual stack clusters commit 2971c49 Merge: 1088118 80b2ddd Author: Kidswiss <[email protected]> Date: Fri Apr 12 10:22:25 2024 +0200 Merge pull request k8up-io#949 from poyaz/feature/custom-tls [enhancement] Adding new feature for supporting self-signed certificate commit 80b2ddd Author: poyaz <[email protected]> Date: Thu Apr 11 17:33:31 2024 +0330 [ADD] Add integration test for TLS and Mutual TLS options Signed-off-by: poyaz <[email protected]> commit ad78959 Author: poyaz <[email protected]> Date: Thu Apr 11 17:32:40 2024 +0330 [FIX] Fix execute ps for alpine and BusyBox Signed-off-by: poyaz <[email protected]> commit 1fc3b16 Author: poyaz <[email protected]> Date: Thu Apr 11 17:32:05 2024 +0330 [UPDATE] Rename argument "--varDir" to "-varDir" Signed-off-by: poyaz <[email protected]> commit df889cb Author: poyaz <[email protected]> Date: Thu Apr 11 17:14:02 2024 +0330 [UPDATE] Add unit test for utils file and refactoring ZeroLen function Signed-off-by: poyaz <[email protected]> commit 22de53e Author: poyaz <[email protected]> Date: Thu Apr 11 00:56:30 2024 +0330 [DELETE] Delete e2e test self signed tls becuase it has too many test case and spend too much time Move restore and archive test case to two separated files Signed-off-by: poyaz <[email protected]> commit 7d121ff Author: poyaz <[email protected]> Date: Thu Apr 11 00:53:42 2024 +0330 [ADD] Add two e2e test for restore and archive Signed-off-by: poyaz <[email protected]> commit dc9f803 Author: poyaz <[email protected]> Date: Thu Apr 11 00:52:56 2024 +0330 [ADD] Add cmctl command for check cert-manager is ready Signed-off-by: poyaz <[email protected]> commit 0acef98 Author: poyaz <[email protected]> Date: Thu Apr 11 00:32:34 2024 +0330 [UPDATE] Refactoring code for duplciate fucntions in operators These functions is created in utils: - AppendTLSOptionsArgs: for generate env for backend and restore specs - AttachTLSVolumes: for create volumes for pods AttachTLSVolumeMounts: for create volumeMount for backend and restore specs Signed-off-by: poyaz <[email protected]> commit b59589a Author: poyaz <[email protected]> Date: Thu Apr 11 00:30:11 2024 +0330 [UPDATE] Update documents because of changing options to tlsOptions Signed-off-by: poyaz <[email protected]> commit 01cb120 Author: Pooya Azarpour <[email protected]> Date: Mon Apr 8 14:21:24 2024 +0330 [CHANGE] Rename options to tlsOptions Signed-off-by: Pooya Azarpour <[email protected]> commit 9b4216a Author: Pooya Azarpour <[email protected]> Date: Mon Apr 8 11:01:50 2024 +0330 [DELETE] Delete unnecessary error param in setupArgs function Signed-off-by: Pooya Azarpour <[email protected]> commit ccd6bce Author: Ludovic Ortega <[email protected]> Date: Sat Apr 6 17:59:17 2024 +0200 feat: add support for dual stack clusters Signed-off-by: Ludovic Ortega <[email protected]> commit d1319f0 Author: Pooya Azarpour <[email protected]> Date: Sat Apr 6 13:43:25 2024 +0330 [FIX] Fix typo and document's grammers Signed-off-by: Pooya Azarpour <[email protected]> commit 8713c81 Author: Pooya Azarpour <[email protected]> Date: Sat Apr 6 13:40:33 2024 +0330 [UPDATE] Formatting go files to old style (Remove idea customziation formatter) Signed-off-by: Pooya Azarpour <[email protected]> commit f6b0f12 Author: Pooya Azarpour <[email protected]> Date: Sat Apr 6 11:20:33 2024 +0330 [DELETE] Delete command "sleep 3" Signed-off-by: Pooya Azarpour <[email protected]> commit 1088118 Merge: b16b4bf 29cdb0a Author: Tobias Brunner <[email protected]> Date: Thu Apr 4 08:36:45 2024 +0200 Merge pull request k8up-io#952 from halil-bugol/patch-1 Add Kubezy as adopter commit 29cdb0a Author: Halil İbrahim BUGÖL <[email protected]> Date: Thu Apr 4 00:53:48 2024 +0300 Update ADOPTERS.md Signed-off-by: Halil Bugol <[email protected]> Signed-off-by: Halil İbrahim BUGÖL <[email protected]> commit 9f776fe Author: poyaz <[email protected]> Date: Sat Mar 23 17:05:19 2024 +0330 [FIX] Fix test for expected args Signed-off-by: poyaz <[email protected]> commit 295e5bf Author: poyaz <[email protected]> Date: Sat Mar 23 16:55:12 2024 +0330 [ADD] Adding variable GO_EXEC in Makefile to choose different versions of Golang Signed-off-by: poyaz <[email protected]> commit c668b25 Author: poyaz <[email protected]> Date: Sat Mar 23 16:53:54 2024 +0330 [FIX] Fixing integration test for restic s3. Missing CaCert arguments Signed-off-by: poyaz <[email protected]> commit da60a0b Author: poyaz <[email protected]> Date: Sat Mar 23 15:03:13 2024 +0330 ADD] Adding e2e test over using env for TLS and mTls Also fixing bug in get lentgh of archive object in minio-mc Signed-off-by: poyaz <[email protected]> commit 41825f9 Author: poyaz <[email protected]> Date: Sat Mar 23 15:03:06 2024 +0330 [ADD] Adding e2e definitaions for using env for TLS and mTls Signed-off-by: poyaz <[email protected]> commit bd2c880 Author: poyaz <[email protected]> Date: Sat Mar 23 15:01:04 2024 +0330 [UPDATE] Update cert-manager to v1.14.4 Signed-off-by: poyaz <[email protected]> commit 6b659b8 Author: poyaz <[email protected]> Date: Sat Mar 23 13:14:10 2024 +0330 [UPDATE] Update api-refrence according to supporting volume, volumeMount, and options Signed-off-by: poyaz <[email protected]> commit b2b83e1 Author: poyaz <[email protected]> Date: Sat Mar 23 13:12:30 2024 +0330 [ADD] Adding document about how to use TLS and mTls in api refrence Signed-off-by: poyaz <[email protected]> commit fe51211 Author: poyaz <[email protected]> Date: Sat Mar 23 13:12:03 2024 +0330 [FIX] Removing unnecessary snipped tag (tag: <SNIP>) Signed-off-by: poyaz <[email protected]> commit 800b819 Author: poyaz <[email protected]> Date: Sat Mar 23 13:10:27 2024 +0330 [UPDATE] Update operator and restic cli help according to new values is added Signed-off-by: poyaz <[email protected]> commit 11f0945 Author: poyaz <[email protected]> Date: Sat Mar 23 13:09:48 2024 +0330 [ADD] Adding RESTORE_CA_CERT_FILE, RESTORE_CA_CERT_FILE, RESTORE_CLIENT_KEY_FILE env instead of filling TLS and mTls options in restore method Signed-off-by: poyaz <[email protected]> commit a9cf8fd Author: poyaz <[email protected]> Date: Sat Mar 23 02:08:07 2024 +0330 [FIX] Fixning problem in attach mode when failer happend in pod Signed-off-by: poyaz <[email protected]> commit 97e03e0 Merge: 5270d54 b16b4bf Author: poyaz <[email protected]> Date: Sat Mar 23 02:06:15 2024 +0330 Merge remote-tracking branch 'upstream/master' into feature/custom-tls Signed-off-by: poyaz <[email protected]> commit 5270d54 Author: poyaz <[email protected]> Date: Sat Mar 23 02:05:02 2024 +0330 [ADD] Adding new e2e test for supporting self-signed issuer This test contains below sections: - Testing backup API for TLS and mTLS mode - Testing restore API in pvc for TLS and mTLS mode - Testing restore API in S3 for TLS and mTLS mode - Testing archive API in S3 for TLS and mTLS mode - Testin check API for TLS and mTLS mode Signed-off-by: poyaz <[email protected]> commit f391110 Author: poyaz <[email protected]> Date: Sat Mar 23 02:04:44 2024 +0330 [ADD] Add some fucntions for checking e2e test These fucntions add: - Adding "mc" function for using minio client for using download files, remove buckets, get list of files - Adding "given_a_clean_archive" function for clear archive bucket - Adding "given_a_subject_dl" function for apply deployment for checking last backup when restore in S3 - Adding "give_self_signed_issuer" function for create self-signed issuer - Adding "expect_dl_file_in_container" function for checking is last backup was uploaded in S3 is okay Also fix some bugs: - Fixing empty output when get last dump of snapshot - becuase of syncing and storing file in disk, fetching last dump is took and the output of "run restic dump latest" is empty - Adding sleep before running restic and mc Signed-off-by: poyaz <[email protected]> commit 2af7fd6 Author: poyaz <[email protected]> Date: Sat Mar 23 02:04:23 2024 +0330 [ADD] Adding new resource definitions for e2e test in TLS and mTls mode These definitions contain below: - Adding archive Adding restore Adding backup Adding nginx for use reverse proxy in TLS and mTls mode Adding cert-manager for genrate self-signed issuer Signed-off-by: poyaz <[email protected]> commit a56d465 Author: poyaz <[email protected]> Date: Sat Mar 23 02:03:58 2024 +0330 [UPDATE] Generating new crd according to adding VolumeMounts to BackendSpec and RestoreMethodSpec Signed-off-by: poyaz <[email protected]> commit ece84c7 Author: poyaz <[email protected]> Date: Sat Mar 23 02:03:46 2024 +0330 [UPDATE] Addin VolumeMounts to BackendSpec and RestoreMethod Change: - Removing VolumeMounts from S3Spec and RestServerSpec in BackendSpec. Adding to BackendSpec (File: v1/backend.go) - Adding VolumeMounts to RestoreMethod (File: v1/restore_types.go) Signed-off-by: poyaz <[email protected]> commit c42e748 Author: poyaz <[email protected]> Date: Sat Mar 23 02:02:47 2024 +0330 [UPDATE] Generating new crd according to adding VolumeMounts to BackendSpec and RestoreMethodSpec Also these changes appends: - Running linter - Fixing check null pointer error if BackendSpec or Volume of Spec is null - Fixing check add duplicate VolumeMount in archive and restore API - Refactoring setupArgs Signed-off-by: poyaz <[email protected]> commit a0f78d7 Author: poyaz <[email protected]> Date: Sat Mar 23 02:01:14 2024 +0330 [ADD] Adding container volumes when they are mounting Signed-off-by: poyaz <[email protected]> commit e2622c6 Author: Pooya Azarpour <[email protected]> Date: Mon Mar 18 19:45:22 2024 +0330 [ADD] Supporting self certificate authority and mTls when using S3 object storage Signed-off-by: Pooya Azarpour <[email protected]> commit e13ba45 Author: Pooya Azarpour <[email protected]> Date: Mon Mar 18 19:43:39 2024 +0330 [ADD] Add vardir command option for mount emptyDir in pod Signed-off-by: Pooya Azarpour <[email protected]> commit 8eb0703 Author: Pooya Azarpour <[email protected]> Date: Mon Mar 18 19:41:40 2024 +0330 [ADD] Add Volume for using secret or configmap in k8s, Add VolumeMounts for mount volume, Add BackendOpts for using custom options in k8up or restic Signed-off-by: Pooya Azarpour <[email protected]> commit 2ea688a Author: Pooya Azarpour <[email protected]> Date: Mon Mar 18 19:39:05 2024 +0330 [ADD] Add GO_EXEC variable for using multiply version of go binary Signed-off-by: Pooya Azarpour <[email protected]> commit 43f750c Author: Pooya Azarpour <[email protected]> Date: Mon Mar 18 19:37:59 2024 +0330 [ADD] Ignoring vagrant dir in git Signed-off-by: Pooya Azarpour <[email protected]>
eunames · Jun 6, 2024 · 01c1c79 · 01c1c79
1 parent 46edd86
commit 01c1c79
Show file tree

Hide file tree

Showing 117 changed files with 16,878 additions and 285 deletions.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -11,6 +11,7 @@
   `bug`, `enhancement`, `documentation`, `change`, `breaking`, `dependency`
   as they show up in the changelog
 - [ ] PR contains the label `area:operator`
+- [ ] Commits are [signed off](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
 - [ ] Link this PR to related issues
 - [ ] I have not made _any_ changes in the `charts/` directory.
 
@@ -21,6 +22,7 @@
   as they show up in the changelog
 - [ ] PR contains the label `area:chart`
 - [ ] PR contains the chart label, e.g. `chart:k8up`
+- [ ] Commits are [signed off](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
 - [ ] Variables are documented in the values.yaml using the format required by [Helm-Docs](https://github.com/norwoodj/helm-docs#valuesyaml-metadata).
 - [ ] Chart Version bumped if immediate release after merging is planned
 - [ ] I have run `make chart-docs`

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -35,4 +35,7 @@ jobs:
           ${{ runner.os }}-go-
 
     - name: Run tests
+      run: make test
+
+    - name: Run integration tests
       run: make integration-test
diff --git a/.gitignore b/.gitignore
@@ -42,3 +42,11 @@ e2e/debug
 # Charts
 .cr-release-packages/
 .cr-index/
+
+# Vagrant
+.vagrant/
+
+# Container volumes mount
+.config/
+.kube/
+.npm/
diff --git a/ADOPTERS.md b/ADOPTERS.md
@@ -25,3 +25,4 @@ This list is sorted in the order that organizations were added to it.
 | [VSHN](https://www.vshn.ch)            | [@tobru](https://github.com/tobru/)               | K8up was born at VSHN because at that time there was no other mature enough backup operator around. Today, K8up is integral part of the service offering and protects precious data every day. |
 | [amazee.io](https://www.amazee.io)     | [@dasrecht](https://github.com/dasrecht/)         | We use K8up as an integral part of our Disaster Recovery procedures.                                                                                                                           |
 | [Lagoon](https://github.com/uselagoon) | [@tobybellwood](https://github.com/tobybellwood/) | We've adopted K8up within [Lagoon](https://github.com/uselagoon). This keeps the data of all Lagoon customers safe and restorable.                                                             |
+| [Kubezy](https://kubezy.com) | [@halil-bugol](https://github.com/halil-bugol/) | We use K8up as Backup Operator in our Kubernetes Management product.|
diff --git a/Makefile b/Makefile
@@ -27,21 +27,22 @@ include Makefile.restic-integration.mk envtest/integration.mk
 # E2E tests
 -include e2e/Makefile
 
-go_build ?= go build -o $(BIN_FILENAME) $(K8UP_MAIN_GO)
+go_build ?= $(GO_EXEC) build -o $(BIN_FILENAME) $(K8UP_MAIN_GO)
 
 .PHONY: test
 test: ## Run tests
-	go test ./... -coverprofile cover.out
+	$(GO_EXEC) test ./... -coverprofile cover.out
 
 .PHONY: build
 build: generate fmt vet $(BIN_FILENAME) docs-update-usage ## Build manager binary
 
 .PHONY: run
+run: export ARGS := $(ARGS) operator
 run: export BACKUP_ENABLE_LEADER_ELECTION = $(ENABLE_LEADER_ELECTION)
 run: export K8UP_DEBUG = true
 run: export BACKUP_OPERATOR_NAMESPACE = default
 run: fmt vet ## Run against the configured Kubernetes cluster in ~/.kube/config. Use ARGS to pass arguments to the command, e.g. `make run ARGS="--help"`
-	go run $(K8UP_MAIN_GO) $(ARGS) $(CMD) $(CMD_ARGS)
+	$(GO_EXEC) run $(K8UP_MAIN_GO) $(ARGS) $(CMD) $(CMD_ARGS)
 
 .PHONY: run-operator
 run-operator: CMD := operator
@@ -80,21 +81,21 @@ deploy: kind-load-image install ## Deploy controller in the configured Kubernete
 .PHONY: generate
 generate: ## Generate manifests e.g. CRD, RBAC etc.
 	# Generate code
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile=".github/boilerplate.go.txt" paths="./..."
+	$(GO_EXEC) run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile=".github/boilerplate.go.txt" paths="./..."
 	# Generate CRDs
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=$(CRD_ROOT_DIR)/v1 crd:crdVersions=v1
+	$(GO_EXEC) run sigs.k8s.io/controller-tools/cmd/controller-gen rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=$(CRD_ROOT_DIR)/v1 crd:crdVersions=v1
 
 .PHONY: crd
 crd: generate ## Generate CRD to file
 	@yq $(CRD_ROOT_DIR)/v1/*.yaml > $(CRD_FILE)
 
 .PHONY: fmt
 fmt: ## Run go fmt against code
-	go fmt ./...
+	$(GO_EXEC) fmt ./...
 
 .PHONY: vet
 vet: ## Run go vet against code
-	go vet ./...
+	$(GO_EXEC) vet ./...
 
 .PHONY: lint
 lint: fmt vet golangci-lint ## Invokes all linting targets

diff --git a/Makefile.restic-integration.vars.mk b/Makefile.restic-integration.vars.mk
@@ -13,7 +13,7 @@ restore_dir ?= $(integrationtest_dir)/restore
 
 stats_url ?= http://localhost:8091
 
-restic_version ?= $(shell go mod edit -json | jq -r '.Require[] | select(.Path == "github.com/restic/restic").Version' | sed "s/v//")
+restic_version ?= $(shell $(GO_EXEC) mod edit -json | jq -r '.Require[] | select(.Path == "github.com/restic/restic").Version' | sed "s/v//")
 restic_path ?= $(go_bin)/restic
 restic_pid ?= $(integrationtest_dir)/restic.pid
 restic_url ?= https://github.com/restic/restic/releases/download/v$(restic_version)/restic_$(restic_version)_$(os)_$(arch).bz2

diff --git a/Makefile.vars.mk b/Makefile.vars.mk
@@ -1,5 +1,6 @@
 IMG_TAG ?= latest
 
+GO_EXEC ?= go
 K8UP_MAIN_GO ?= cmd/k8up/main.go
 K8UP_GOOS ?= linux
 K8UP_GOARCH ?= amd64

diff --git a/api/v1/archive_types.go b/api/v1/archive_types.go
@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // ArchiveSpec defines the desired state of Archive.
@@ -87,6 +89,13 @@ func (a *Archive) GetSuccessfulJobsHistoryLimit() *int {
 	return a.Spec.KeepJobs
 }
 
+func (a *Archive) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if a.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, a.Spec.RunnableSpec.PodConfigRef.Name, a.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (a *ArchiveList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(a.Items))

diff --git a/api/v1/backend.go b/api/v1/backend.go
@@ -17,15 +17,19 @@ type (
 		// RepoPasswordSecretRef references a secret key to look up the restic repository password
 		RepoPasswordSecretRef *corev1.SecretKeySelector `json:"repoPasswordSecretRef,omitempty"`
 		// EnvFrom adds all environment variables from a an external source to the Restic job.
-		EnvFrom     []corev1.EnvFromSource `json:"envFrom,omitempty"`
-		Local       *LocalSpec             `json:"local,omitempty"`
-		S3          *S3Spec                `json:"s3,omitempty"`
-		GCS         *GCSSpec               `json:"gcs,omitempty"`
-		Azure       *AzureSpec             `json:"azure,omitempty"`
-		Swift       *SwiftSpec             `json:"swift,omitempty"`
-		B2          *B2Spec                `json:"b2,omitempty"`
-		Rest        *RestServerSpec        `json:"rest,omitempty"`
+		EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`
+		Local   *LocalSpec             `json:"local,omitempty"`
+		S3      *S3Spec                `json:"s3,omitempty"`
+		GCS     *GCSSpec               `json:"gcs,omitempty"`
+		Azure   *AzureSpec             `json:"azure,omitempty"`
+		Swift   *SwiftSpec             `json:"swift,omitempty"`
+		B2      *B2Spec                `json:"b2,omitempty"`
+		Rest    *RestServerSpec        `json:"rest,omitempty"`
 		InsecureTLS bool                   `json:"insecureTLS,omitempty"`
+
+
+		TLSOptions   *TLSOptions           `json:"tlsOptions,omitempty"`
+		VolumeMounts *[]corev1.VolumeMount `json:"volumeMounts,omitempty"`
 	}
 
 	// +k8s:deepcopy-gen=false
@@ -280,3 +284,9 @@ func (in *RestServerSpec) String() string {
 	protocol, url, _ := strings.Cut(in.URL, "://")
 	return fmt.Sprintf("rest:%s://%s:%s@%s", protocol, "$(USER)", "$(PASSWORD)", url)
 }
+
+type TLSOptions struct {
+	CACert     string `json:"caCert,omitempty"`
+	ClientCert string `json:"clientCert,omitempty"`
+	ClientKey  string `json:"clientKey,omitempty"`
+}
diff --git a/api/v1/backup_types.go b/api/v1/backup_types.go
@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // BackupSpec defines a single backup. It must contain all information to connect to
@@ -127,6 +129,13 @@ func (b *Backup) GetSuccessfulJobsHistoryLimit() *int {
 	return b.Spec.KeepJobs
 }
 
+func (b *Backup) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if b.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, b.Spec.RunnableSpec.PodConfigRef.Name, b.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (b *BackupList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(b.Items))

diff --git a/api/v1/check_types.go b/api/v1/check_types.go
@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // CheckSpec defines the desired state of Check. It needs to contain the repository
@@ -106,6 +108,13 @@ func (c *Check) GetSuccessfulJobsHistoryLimit() *int {
 	return c.Spec.KeepJobs
 }
 
+func (b *Check) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if b.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, b.Spec.RunnableSpec.PodConfigRef.Name, b.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (c *CheckList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(c.Items))

diff --git a/api/v1/job_object.go b/api/v1/job_object.go
@@ -1,6 +1,8 @@
 package v1
 
 import (
+	"context"
+
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -19,6 +21,8 @@ type JobObject interface {
 	GetPodSecurityContext() *corev1.PodSecurityContext
 	// GetActiveDeadlineSeconds returns the specified active deadline seconds timeout.
 	GetActiveDeadlineSeconds() *int64
+	// GetPodConfig returns the defined PodSpec
+	GetPodConfig(context.Context, client.Client) (*PodConfig, error)
 }
 
 // +k8s:deepcopy-gen=false

diff --git a/api/v1/podconfig_types.go b/api/v1/podconfig_types.go
@@ -0,0 +1,60 @@
+package v1
+
+import (
+	"context"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// +kubebuilder:rbac:groups=k8up.io,resources=podconfigs,verbs=get;list;watch
+
+// PodConfigSpec contains the podTemplate definition.
+type PodConfigSpec struct {
+	Template corev1.PodTemplateSpec `json:"template,omitempty"`
+}
+
+// PodConfigStatus defines the observed state of Snapshot
+type PodConfigStatus struct {
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+
+// PodConfig is the Schema for the PodConcig API
+// Any annotations and labels set on this object will also be set on
+// the final pod.
+type PodConfig struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   PodConfigSpec   `json:"spec,omitempty"`
+	Status PodConfigStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// SnapshotList contains a list of Snapshot
+type PodConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []PodConfig `json:"items"`
+}
+
+func NewPodConfig(ctx context.Context, name, namespace string, c client.Client) (*PodConfig, error) {
+	config := &PodConfig{}
+	err := c.Get(ctx, client.ObjectKey{Name: name, Namespace: namespace}, config)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return config, nil
+}
+
+func init() {
+	SchemeBuilder.Register(&PodConfig{}, &PodConfigList{})
+}
diff --git a/api/v1/prune_types.go b/api/v1/prune_types.go
@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // PruneSpec needs to contain the repository information as well as the desired
@@ -115,6 +117,13 @@ func (p *Prune) GetSuccessfulJobsHistoryLimit() *int {
 	return p.Spec.KeepJobs
 }
 
+func (p *Prune) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if p.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, p.Spec.RunnableSpec.PodConfigRef.Name, p.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (p *PruneList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(p.Items))

diff --git a/api/v1/restore_types.go b/api/v1/restore_types.go
@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // RestoreSpec can either contain an S3 restore point or a local one. For the local
@@ -35,8 +37,10 @@ type RestoreSpec struct {
 // RestoreMethod contains how and where the restore should happen
 // all the settings are mutual exclusive.
 type RestoreMethod struct {
-	S3     *S3Spec        `json:"s3,omitempty"`
-	Folder *FolderRestore `json:"folder,omitempty"`
+	S3           *S3Spec               `json:"s3,omitempty"`
+	Folder       *FolderRestore        `json:"folder,omitempty"`
+	TLSOptions   *TLSOptions           `json:"tlsOptions,omitempty"`
+	VolumeMounts *[]corev1.VolumeMount `json:"volumeMounts,omitempty"`
 }
 
 type FolderRestore struct {
@@ -105,6 +109,13 @@ func (r *Restore) GetSuccessfulJobsHistoryLimit() *int {
 	return r.Spec.KeepJobs
 }
 
+func (r *Restore) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if r.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, r.Spec.RunnableSpec.PodConfigRef.Name, r.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (r *RestoreList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(r.Items))