enhancement: Added oportuniy set ImagePullSecret

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,6 +11,7 @@
   `bug`, `enhancement`, `documentation`, `change`, `breaking`, `dependency`
   as they show up in the changelog
 - [ ] PR contains the label `area:operator`
+- [ ] Commits are [signed off](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
 - [ ] Link this PR to related issues
 - [ ] I have not made _any_ changes in the `charts/` directory.
 
@@ -21,6 +22,7 @@
   as they show up in the changelog
 - [ ] PR contains the label `area:chart`
 - [ ] PR contains the chart label, e.g. `chart:k8up`
+- [ ] Commits are [signed off](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
 - [ ] Variables are documented in the values.yaml using the format required by [Helm-Docs](https://github.com/norwoodj/helm-docs#valuesyaml-metadata).
 - [ ] Chart Version bumped if immediate release after merging is planned
 - [ ] I have run `make chart-docs`

.github/workflows/chart-release.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download cr
-        uses: giantswarm/install-binary-action@v1.0.0
+        uses: giantswarm/install-binary-action@v1.1.0
         with:
           binary: cr
           version: "1.4.0"

.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        uses: actions/checkout@v3
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        uses: ossf/scorecard-action@v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/test.yml

@@ -35,4 +35,7 @@ jobs:
           ${{ runner.os }}-go-
 
     - name: Run tests
+      run: make test
+
+    - name: Run integration tests
       run: make integration-test

.gitignore

@@ -21,6 +21,7 @@ coverage/
 .cache
 _public/
 _archive/
+tmp/
 
 .github/release-notes.md
 
@@ -41,3 +42,11 @@ e2e/debug
 # Charts
 .cr-release-packages/
 .cr-index/
+
+# Vagrant
+.vagrant/
+
+# Container volumes mount
+.config/
+.kube/
+.npm/

ADOPTERS.md

@@ -25,3 +25,4 @@ This list is sorted in the order that organizations were added to it.
 | [VSHN](https://www.vshn.ch)            | [@tobru](https://github.com/tobru/)               | K8up was born at VSHN because at that time there was no other mature enough backup operator around. Today, K8up is integral part of the service offering and protects precious data every day. |
 | [amazee.io](https://www.amazee.io)     | [@dasrecht](https://github.com/dasrecht/)         | We use K8up as an integral part of our Disaster Recovery procedures.                                                                                                                           |
 | [Lagoon](https://github.com/uselagoon) | [@tobybellwood](https://github.com/tobybellwood/) | We've adopted K8up within [Lagoon](https://github.com/uselagoon). This keeps the data of all Lagoon customers safe and restorable.                                                             |
+| [Kubezy](https://kubezy.com) | [@halil-bugol](https://github.com/halil-bugol/) | We use K8up as Backup Operator in our Kubernetes Management product.|

CODE_OF_CONDUCT.md

@@ -0,0 +1,6 @@
+# Community Code of Conduct
+
+K8up observes the [CNCF Community Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
+
+The code of conduct is overseen by the K8up project maintainers.
+Possible code of conduct violations should be emailed to the project maintainers [email protected].

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/alpine:3.17 as restic
+FROM docker.io/library/alpine:3.19 as restic
 
 RUN apk add --update --no-cache \
     bash \
@@ -7,9 +7,9 @@ RUN apk add --update --no-cache \
 
 COPY go.mod fetch_restic.sh ./
 RUN ./fetch_restic.sh /usr/local/bin/restic \
- && /usr/local/bin/restic version
+    && /usr/local/bin/restic version
 
-FROM docker.io/library/alpine:3.17 as k8up
+FROM docker.io/library/alpine:3.19 as k8up
 
 ENTRYPOINT ["k8up"]
 

GOVERNANCE.md

@@ -1,7 +1,7 @@
 # K8up Project Governance
 
 Please note: K8up is a young Open Source project, evolved from the project sponsor [VSHN](https://www.vshn.ch/).
-As such we're in the process of setting up a proper project governance.
+As such, we're in the process of setting up a proper project governance.
 If you have any wish, let use know via a [GitHub Discussion](https://github.com/k8up-io/k8up/discussions).
 
 ## Principles
@@ -11,7 +11,7 @@ The K8up community adheres to the following principles:
 - Open: K8up is open source.
 - Welcoming and respectful: See [Code of Conduct](#code-of-conduct).
 - Transparent and accessible: Changes to the K8up organization, K8up code repositories,
-  and CNCF related activities (e.g. level, involvement, etc) are done in public.
+  and CNCF related activities (e.g. level, involvement, etc.) are done in public.
 - Merit: Ideas and contributions are accepted according to their technical merit and alignment with
   project objectives, scope, and design principles.
 
@@ -24,7 +24,7 @@ The K8up roadmap is on GitHub, see [Projects -> Roadmap](https://github.com/k8up
 Every contribution is welcome.
 Please see our [Contribution Guide](https://k8up.io/k8up/about/contribution_guide.html) how to best contribute.
 
-## Github Project Administration
+## GitHub Project Administration
 
 The __k8up-io__ GitHub project maintainers team reflects the list of Maintainers.
 
@@ -35,12 +35,12 @@ As such, K8up might be involved in CNCF (or other CNCF projects) related marketi
 
 ## Code of Conduct
 
-Please read our code of conduct here: https://k8up.io/k8up/about/code_of_conduct.html
+Please read our code of conduct here: [CODE_OF_CONDUCT.md](https://github.com/k8up-io/k8up/blob/master/CODE_OF_CONDUCT.md).
 
 The code of conduct is overseen by the K8up project maintainers.
 Possible code of conduct violations should be emailed to the project maintainers [email protected].
 
-If the possible violation is against one of the project maintainers that member will be recused from voting on the issue.
+If the possible violation is against one of the project maintainers, that member will be recused from voting on the issue.
 Such issues must be escalated to the appropriate CNCF contact, and CNCF may choose to intervene.
 
 ## DCO and Licenses
@@ -49,4 +49,3 @@ The following licenses and contributor agreements will be used for K8up projects
 
 * [Apache 2.0](https://opensource.org/licenses/Apache-2.0) for code
 * [Developer Certificate of Origin](https://developercertificate.org/) for new contributions
-

Makefile

@@ -10,7 +10,7 @@ MAKEFLAGS += --no-builtin-variables
 
 .PHONY: help
 help: ## Show this help
-	@grep -E -h '\s##\s' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
+	@grep -E -h '^[^#].+\s##\s' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
 
 # extensible array of targets. Modules can add target to this variable for the all-in-one target.
 clean_targets := build-clean
@@ -27,21 +27,22 @@ include Makefile.restic-integration.mk envtest/integration.mk
 # E2E tests
 -include e2e/Makefile
 
-go_build ?= go build -o $(BIN_FILENAME) $(K8UP_MAIN_GO)
+go_build ?= $(GO_EXEC) build -o $(BIN_FILENAME) $(K8UP_MAIN_GO)
 
 .PHONY: test
 test: ## Run tests
-	go test ./... -coverprofile cover.out
+	$(GO_EXEC) test ./... -coverprofile cover.out
 
 .PHONY: build
 build: generate fmt vet $(BIN_FILENAME) docs-update-usage ## Build manager binary
 
 .PHONY: run
+run: export ARGS := $(ARGS) operator
 run: export BACKUP_ENABLE_LEADER_ELECTION = $(ENABLE_LEADER_ELECTION)
 run: export K8UP_DEBUG = true
 run: export BACKUP_OPERATOR_NAMESPACE = default
 run: fmt vet ## Run against the configured Kubernetes cluster in ~/.kube/config. Use ARGS to pass arguments to the command, e.g. `make run ARGS="--help"`
-	go run $(K8UP_MAIN_GO) $(ARGS) $(CMD) $(CMD_ARGS)
+	$(GO_EXEC) run $(K8UP_MAIN_GO) $(ARGS) $(CMD) $(CMD_ARGS)
 
 .PHONY: run-operator
 run-operator: CMD := operator
@@ -54,7 +55,7 @@ run-restic: run  ## Run the restic module. Use ARGS to pass arguments to the com
 .PHONY: install
 install: export KUBECONFIG = $(KIND_KUBECONFIG)
 install: generate kind-setup ## Install CRDs into a cluster
-	kubectl apply $(KIND_KUBECTL_ARGS) -f $(CRD_ROOT_DIR)/v1
+	kubectl apply $(KIND_KUBECTL_ARGS) -f $(CRD_ROOT_DIR)/v1 --server-side
 
 .PHONY: uninstall
 uninstall: export KUBECONFIG = $(KIND_KUBECONFIG)
@@ -80,21 +81,21 @@ deploy: kind-load-image install ## Deploy controller in the configured Kubernete
 .PHONY: generate
 generate: ## Generate manifests e.g. CRD, RBAC etc.
 	# Generate code
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile=".github/boilerplate.go.txt" paths="./..."
+	$(GO_EXEC) run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile=".github/boilerplate.go.txt" paths="./..."
 	# Generate CRDs
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=$(CRD_ROOT_DIR)/v1 crd:crdVersions=v1
+	$(GO_EXEC) run sigs.k8s.io/controller-tools/cmd/controller-gen rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=$(CRD_ROOT_DIR)/v1 crd:crdVersions=v1
 
 .PHONY: crd
 crd: generate ## Generate CRD to file
 	@yq $(CRD_ROOT_DIR)/v1/*.yaml > $(CRD_FILE)
 
 .PHONY: fmt
 fmt: ## Run go fmt against code
-	go fmt ./...
+	$(GO_EXEC) fmt ./...
 
 .PHONY: vet
 vet: ## Run go vet against code
-	go vet ./...
+	$(GO_EXEC) vet ./...
 
 .PHONY: lint
 lint: fmt vet golangci-lint ## Invokes all linting targets

Makefile.restic-integration.vars.mk

@@ -13,7 +13,7 @@ restore_dir ?= $(integrationtest_dir)/restore
 
 stats_url ?= http://localhost:8091
 
-restic_version ?= $(shell go mod edit -json | jq -r '.Require[] | select(.Path == "github.com/restic/restic").Version' | sed "s/v//")
+restic_version ?= $(shell $(GO_EXEC) mod edit -json | jq -r '.Require[] | select(.Path == "github.com/restic/restic").Version' | sed "s/v//")
 restic_path ?= $(go_bin)/restic
 restic_pid ?= $(integrationtest_dir)/restic.pid
 restic_url ?= https://github.com/restic/restic/releases/download/v$(restic_version)/restic_$(restic_version)_$(os)_$(arch).bz2

Makefile.vars.mk

@@ -1,5 +1,6 @@
 IMG_TAG ?= latest
 
+GO_EXEC ?= go
 K8UP_MAIN_GO ?= cmd/k8up/main.go
 K8UP_GOOS ?= linux
 K8UP_GOARCH ?= amd64
@@ -24,7 +25,7 @@ CRD_DOCS_REF_PATH ?= docs/modules/ROOT/pages/references/api-reference.adoc
 SAMPLES_ROOT_DIR ?= config/samples
 minio_sentinel = $(e2etest_dir)/minio_sentinel
 
-KIND_NODE_VERSION ?= v1.24.4
+KIND_NODE_VERSION ?= v1.26.6
 KIND_KUBECONFIG ?= $(e2etest_dir)/kind-kubeconfig-$(KIND_NODE_VERSION)
 KIND_CLUSTER ?= k8up-$(KIND_NODE_VERSION)
 KIND_KUBECTL_ARGS ?= --validate=true
@@ -46,4 +47,4 @@ K8UP_QUAY_IMG ?= quay.io/k8up-io/k8up:$(IMG_TAG)
 ENVTEST_ADDITIONAL_FLAGS ?= --bin-dir "$(go_bin)"
 INTEGRATION_TEST_DEBUG_OUTPUT ?= false
 # See https://storage.googleapis.com/kubebuilder-tools/ for list of supported K8s versions
-ENVTEST_K8S_VERSION = 1.24.x
+ENVTEST_K8S_VERSION = 1.26.x

OWNERS.md

@@ -13,7 +13,13 @@ This will be built up when time comes.
 
 ## Maintainers
 
-We document the list of maintainers in the [GitHub team "Maintainer"](https://github.com/orgs/k8up-io/teams/maintainer/members).
+* Tobias Brunner <[email protected]> ([tobru](https://github.com/tobru))
+* Simon Beck <[email protected]> ([Kidswiss](https://github.com/Kidswiss))
+* Nicolas Bigler <[email protected]> ([TheBigLee](https://github.com/TheBigLee))
+* Łukasz Widera <[email protected]> ([wejdross](https://github.com/wejdross))
+* Gabriel Saratura <[email protected]> ([zugao](https://github.com/zugao))
+
+We also document the list of maintainers in the [GitHub team "Maintainer"](https://github.com/orgs/k8up-io/teams/maintainer/members).
 
 ## Reviewers
 

README.md

@@ -16,6 +16,8 @@ K8up is a Kubernetes backup operator based on [Restic](https://restic.readthedoc
 Just create a `schedule` and a `credentials` object in the namespace you’d like to backup.
 It’s that easy. K8up takes care of the rest. It also provides a Prometheus endpoint for monitoring.
 
+K8up is production ready. It is used in production deployments since 2019.
+
 ## Documentation
 
 The documentation is written in AsciiDoc and published with Antora to [k8up.io](https://k8up.io/).
@@ -141,7 +143,19 @@ make clean
 There are a number of example configurations in [`config/samples`](config/samples).
 Apply them using `kubectl apply -f config/samples/somesample.yaml`
 
-### Code of Conduct
+# Community
+
+Read more about our community [in the documentation](https://k8up.io/k8up/about/community.html).
+
+## Chat with us
+
+The K8up project is present in the [CNCF Slack Workspace](https://slack.cncf.io/) in the [#k8up channel](https://app.slack.com/client/T08PSQ7BQ/C06GP0D5FEF).
+
+## Monthly community meeting
+
+We host a monthly community meeting. For more information, head over to [the community documentation](https://k8up.io/k8up/about/community.html).
+
+## Code of Conduct
 
 Our code of conduct can be read at [k8up.io](https://k8up.io/k8up/about/code_of_conduct.html).
 

api/v1/archive_types.go

@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"context"
 	"reflect"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // ArchiveSpec defines the desired state of Archive.
@@ -87,6 +89,13 @@ func (a *Archive) GetSuccessfulJobsHistoryLimit() *int {
 	return a.Spec.KeepJobs
 }
 
+func (a *Archive) GetPodConfig(ctx context.Context, c client.Client) (*PodConfig, error) {
+	if a.Spec.RunnableSpec.PodConfigRef == nil {
+		return nil, nil
+	}
+	return NewPodConfig(ctx, a.Spec.RunnableSpec.PodConfigRef.Name, a.GetNamespace(), c)
+}
+
 // GetJobObjects returns a sortable list of jobs
 func (a *ArchiveList) GetJobObjects() JobObjectList {
 	items := make(JobObjectList, len(a.Items))

api/v1/backend.go

@@ -3,6 +3,7 @@ package v1
 import (
 	"fmt"
 	"reflect"
+	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 
@@ -24,6 +25,9 @@ type (
 		Swift   *SwiftSpec             `json:"swift,omitempty"`
 		B2      *B2Spec                `json:"b2,omitempty"`
 		Rest    *RestServerSpec        `json:"rest,omitempty"`
+
+		TLSOptions   *TLSOptions           `json:"tlsOptions,omitempty"`
+		VolumeMounts *[]corev1.VolumeMount `json:"volumeMounts,omitempty"`
 	}
 
 	// +k8s:deepcopy-gen=false
@@ -204,6 +208,7 @@ func (in *GCSSpec) String() string {
 
 type AzureSpec struct {
 	Container            string                    `json:"container,omitempty"`
+	Path                 string                    `json:"path,omitempty"`
 	AccountNameSecretRef *corev1.SecretKeySelector `json:"accountNameSecretRef,omitempty"`
 	AccountKeySecretRef  *corev1.SecretKeySelector `json:"accountKeySecretRef,omitempty"`
 }
@@ -215,9 +220,14 @@ func (in *AzureSpec) EnvVars(vars map[string]*corev1.EnvVarSource) map[string]*c
 	return vars
 }
 
-// String returns "azure:container:/"
+// String returns "azure:container:path"
+// If Path is empty, the default value "/" will be used as path
 func (in *AzureSpec) String() string {
-	return fmt.Sprintf("azure:%s:/", in.Container)
+	path := "/"
+	if in.Path != "" {
+		path = in.Path
+	}
+	return fmt.Sprintf("azure:%s:%s", in.Container, path)
 }
 
 type SwiftSpec struct {
@@ -269,5 +279,12 @@ func (in *RestServerSpec) EnvVars(vars map[string]*corev1.EnvVarSource) map[stri
 
 // String returns "rest:URL"
 func (in *RestServerSpec) String() string {
-	return fmt.Sprintf("rest:%s", in.URL)
+	protocol, url, _ := strings.Cut(in.URL, "://")
+	return fmt.Sprintf("rest:%s://%s:%s@%s", protocol, "$(USER)", "$(PASSWORD)", url)
+}
+
+type TLSOptions struct {
+	CACert     string `json:"caCert,omitempty"`
+	ClientCert string `json:"clientCert,omitempty"`
+	ClientKey  string `json:"clientKey,omitempty"`
 }