feat(backup): add backup script and refactor cron job to use it

terraform/modules/utils/scw_rclone/main.tf

@@ -29,6 +29,16 @@ resource "kubernetes_config_map" "rclone_config" {
   }
 }
 
+resource "kubernetes_config_map" "backup_script" {
+  metadata {
+    name      = "${var.app_name}-backup-script"
+    namespace = var.namespace
+  }
+  data = {
+    "backup.sh" = file("${path.module}/resources/backup.sh")
+  }
+}
+
 resource "kubernetes_cron_job_v1" "backup_job" {
   metadata {
     name      = "${var.app_name}-backup"
@@ -112,16 +122,10 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 value = var.bucket_name
               }
               command = ["/bin/sh", "-c"]
-              args = [join(";", [
-                "apk update",
-                "apk add gettext",
-                "envsubst</etc/rclone.conf.tmpl>/etc/rclone.conf",
-                "tar -zcvpf /backup/${var.app_name}-files-`date +\"%Y%m%d\"`.tar.gz /files",
-                "find /backup -type f -name '${var.app_name}-files-*.tar.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm",
-                "/usr/local/bin/rclone --config=/etc/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/${var.app_name}-backup"
-              ])]
+              args    = ["/tmp/scripts/backup.sh"]
               security_context {
                 allow_privilege_escalation = false
+                read_only_root_filesystem  = true
               }
               volume_mount {
                 name       = "backup-storage"
@@ -138,6 +142,15 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 sub_path   = "rclone.conf"
                 read_only  = true
               }
+              volume_mount {
+                name       = "backup-script"
+                mount_path = "/tmp/scripts"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "tmp"
+                mount_path = "/tmp"
+              }
             }
             volume {
               name = "backup-storage"
@@ -157,6 +170,17 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 name = kubernetes_config_map.rclone_config.metadata[0].name
               }
             }
+            volume {
+              name = "backup-script"
+              config_map {
+                name         = kubernetes_config_map.backup_script.metadata[0].name
+                default_mode = "0755"
+              }
+            }
+            volume {
+              name = "tmp"
+              empty_dir {}
+            }
             restart_policy                   = "Never"
             termination_grace_period_seconds = 30
           }

terraform/modules/utils/scw_rclone/resources/backup.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then
+  echo "SCW_ACCESS_KEY and SCW_SECRET_KEY must be set"
+  exit 1
+fi
+if [ -z "$BUCKET_NAME" ]; then
+  echo "BUCKET_NAME must be set"
+  exit 1
+fi
+if [ -z "$APP_NAME" ]; then
+  echo "APP_NAME must be set"
+  exit 1
+fi
+if [ -z "$BACKUP_RETENTION" ]; then
+  echo "BACKUP_RETENTION must be set"
+  exit 1
+fi
+
+envsubst < /etc/rclone.conf.tmpl > /tmp/rclone.conf
+unset $SCW_ACCESS_KEY
+unset $SCW_SECRET_KEY
+
+apk update
+apk add gettext
+tar -zcvpf /backup/$APP_NAME-files-`date +\"%Y%m%d\"`.tar.gz /files
+
+# Remove old backups
+BACKUP_FILE_PATTERN="$APP_NAME-files-*.tar.gz"
+find /backup -type f -name $BACKUP_FILE_PATTERN -mtime +$BACKUP_RETENTION | xargs --no-run-if-empty rm
+
+# Upload to Scaleway
+/usr/local/bin/rclone --config=/tmp/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/$APP_NAME-backup"