From 3e12b13d950a4d0b9ee9534d6fd89e8ade3bffd9 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Sat, 10 May 2025 19:40:01 +0200
Subject: [PATCH] fix(backup): update security context in cron job and improve
 backup script logging

---
 terraform/modules/utils/scw_rclone/main.tf       |  1 -
 .../modules/utils/scw_rclone/resources/backup.sh | 16 ++++++++++------
 terraform/modules/utils/scw_rclone/variables.tf  |  2 +-
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/terraform/modules/utils/scw_rclone/main.tf b/terraform/modules/utils/scw_rclone/main.tf
index 55b45e1..1554c6c 100644
--- a/terraform/modules/utils/scw_rclone/main.tf
+++ b/terraform/modules/utils/scw_rclone/main.tf
@@ -133,7 +133,6 @@ resource "kubernetes_cron_job_v1" "backup_job" {
               args    = ["/tmp/scripts/backup.sh"]
               security_context {
                 allow_privilege_escalation = false
-                read_only_root_filesystem  = true
               }
               volume_mount {
                 name       = "backup-storage"
diff --git a/terraform/modules/utils/scw_rclone/resources/backup.sh b/terraform/modules/utils/scw_rclone/resources/backup.sh
index d742fa6..5669730 100644
--- a/terraform/modules/utils/scw_rclone/resources/backup.sh
+++ b/terraform/modules/utils/scw_rclone/resources/backup.sh
@@ -16,20 +16,24 @@ if [ -z "$BACKUP_RETENTION" ]; then
   exit 1
 fi
 
-# Create rclone config (Scaleway)
-envsubst < /etc/rclone.conf.tmpl > /tmp/rclone.conf
-unset $SCW_ACCESS_KEY
-unset $SCW_SECRET_KEY
-
+# install required packages
 apk update
 apk add gettext
 
+# Create rclone config (Scaleway)
+envsubst < /etc/rclone.conf.tmpl > /tmp/rclone.conf
+unset SCW_ACCESS_KEY
+unset SCW_SECRET_KEY
+
 # Create backup
+echo "Creating backup of /src directory"
 tar -zcvpf /backup/$APP_NAME-files-`date +\"%Y%m%d\"`.tar.gz /src
 
 # Remove old backups
 BACKUP_FILE_PATTERN="$APP_NAME-files-*.tar.gz"
+echo "Removing old backups matching pattern: $BACKUP_FILE_PATTERN"
 find /backup -type f -name "$BACKUP_FILE_PATTERN" -mtime +$BACKUP_RETENTION | xargs --no-run-if-empty rm
 
 # Upload to Scaleway
-/usr/local/bin/rclone --config=/tmp/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/$APP_NAME-backup"
+echo "Uploading backup to Scaleway bucket"
+/usr/local/bin/rclone --config=/tmp/rclone.conf sync --progress /backup "scaleway:$BUCKET_NAME/$APP_NAME-backup"
diff --git a/terraform/modules/utils/scw_rclone/variables.tf b/terraform/modules/utils/scw_rclone/variables.tf
index f1f52ec..1c50a83 100644
--- a/terraform/modules/utils/scw_rclone/variables.tf
+++ b/terraform/modules/utils/scw_rclone/variables.tf
@@ -72,5 +72,5 @@ variable "retention_days" {
 variable "tag" {
   description = "Tag to add to the backup"
   type        = string
-  default     = "latest"
+  default     = "1.61.1"
 }