Refactor ansible-apply.yaml and inventory/hosts, add ansible.cfg

terraform/k8sapps/modules/k8s_mariadb/main.tf

@@ -215,6 +215,9 @@ resource "kubernetes_cron_job_v1" "backup_data_cron" {
                 name  = "MARIADB_DATABASE"
                 value = var.app_name
               }
+              security_context {
+                allow_privilege_escalation = false
+              }
               command = ["/bin/sh", "-c"]
               args = [join(";", [
                 "/usr/bin/mariadb-dump --single-transaction -h mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE | gzip > /backups/${var.app_name}-sql-`date +\"%Y%m%d\"`.sql.gz",

terraform/k8sapps/modules/scw_backup_job/main.tf

@@ -120,6 +120,9 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 "find /backup -type f -name '${var.app_name}-files-*.tar.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm",
                 "/usr/local/bin/rclone --config=/etc/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/${var.app_name}-backup"
               ])]
+              security_context {
+                allow_privilege_escalation = false
+              }
               volume_mount {
                 name       = "backup-storage"
                 mount_path = "/backup"