apiVersion: batch/v1
kind: CronJob
metadata:
  name: etcd-backup
spec:
  schedule: "@daily"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: aws-provider # TODO: use separate SA for backup
          restartPolicy: OnFailure
          initContainers:
            - name: etcdctl
              image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/bitnami/etcd:3.4.16-debian-10-r14
              command:
                - /bin/bash
                - -c
                - "cp /opt/bitnami/etcd/bin/* /backup/"
              volumeMounts:
                - name: backup
                  mountPath: /backup
          containers:
            - name: backup
              image: amazon/aws-cli:2.13.0
              env:
                - name: BACKUP_BUCKET
                  value: s3://dbaas-backup/
              command:
                - /bin/bash
                - -c
                - |
                  timestamp=$(date +%Y-%m-%d-%H%M%S)
                  /backup/etcdctl --endpoints=https://etcd.infra.svc.cluster.local:2379 \
                  --cacert=/opt/bitnami/etcd/certs/client/ca.crt \
                  --cert=/opt/bitnami/etcd/certs/client/tls.crt \
                  --key=/opt/bitnami/etcd/certs/client/tls.key \
                  snapshot save /backup/etcd-snapshot-${timestamp}.db
                  aws s3 cp /backup/etcd-snapshot-${timestamp}.db ${BACKUP_BUCKET}
              volumeMounts:
                - name: backup
                  mountPath: /backup
                - mountPath: /opt/bitnami/etcd/certs/client/
                  name: etcd-client-certs
                  readOnly: true
          volumes:
            - name: etcd-client-certs
              secret:
                defaultMode: 256
                secretName: etcd-server-client
            - name: backup
              emptyDir: {}