policy-continuous-restore-backup-triliovault-for-kubernetes.yaml

# This is the 2nd policy to setup Continuous Restore Functionality using
# Triliovault for Kubernetes (TVK).
#
# This policy creates backup on the source cluster participating in the Continuous 
# Restore Functionality defined with labels "protected-by=triliovault" and
# "tvk-continuous-restore-cluster=source"
#
# Please note TVK should be installed and configured on the cluster and the event 
# target created using policy 
# ./CM-Configuration-Management/policy-continuous-restore-event-target-triliovault-for-kubernetes.yaml
# before applying this policy.
#
# Refer - https://docs.trilio.io/kubernetes/management-console/index/continuous-restore#create-a-backupplan
#
# To create the namespace backup, following process is followed
# 1. Create a backup plan that references the following:
#      Namespace to be backed up
#      Default Scheduling Policy - create daily 1 backup
#      Target to where the data should be backed up
# 2. Apply the Backup CR that references the Backup
#    This policy creates a full backup.
#
# IMPORTANT: Please follow below instructions for the policy to work
# 1. On the hub cluster, create a configmap tvk-cr-backup-configmap in the namespace
#    where this policy is placed. The configmap has the name of the namespace
#    for creating namespace based backup.
#
# 2. ConfigMap Example yaml (replace the values)
# apiVersion: v1
# kind: ConfigMap
# metadata:
#   name: tvk-cr-backup-configmap
# Data:
#   backupNS: "PROVIDE_NAMESPACE"
#
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: tvk-continuous-restore-backup
  annotations:
    policy.open-cluster-management.io/categories: CA Security Assessment and Authorization
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/controls: CA-2 Security Assessments, CA-7 Continuous Monitoring
spec:
  disabled: false
  remediationAction: inform
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-check-backup-ns
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: Namespace
                metadata:
                  name: '{{hub fromConfigMap "" "tvk-cr-backup-configmap" "backupNS" hub}}'
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-scheduling-policy
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: triliovault.trilio.io/v1
                kind: Policy
                metadata:
                  name: trilio-daily-schedule-policy
                  namespace: default
                spec:
                  scheduleConfig:
                    schedule:
                    - 0 23 * * *
                  type: Schedule
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-retention-policy
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: triliovault.trilio.io/v1
                kind: Policy
                metadata:
                  name: trilio-latest-retention-policy
                  namespace: default
                spec:
                  default: false
                  retentionConfig:
                    latest: 5
                  type: Retention
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-cr-policy
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: triliovault.trilio.io/v1
                kind: Policy
                metadata:
                  name: tvk-cr-policy
                  namespace: default
                spec:
                  continuousRestoreConfig:
                    consistentSets: 3
                  default: false
                  type: ContinuousRestore
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-cr-backupplan
        spec:
          remediationAction: enforce
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: triliovault.trilio.io/v1
                kind: BackupPlan
                metadata:
                  name: tvk-cr-backupplan
                  namespace: '{{hub fromConfigMap "" "tvk-cr-backup-configmap" "backupNS" hub}}'
                spec:
                  backupNamespace: '{{hub fromConfigMap "" "tvk-cr-backup-configmap" "backupNS" hub}}'
                  backupConfig:
                    target:
                      name: tvk-s3-event-target
                      namespace: default
                    schedulePolicy:
                      fullBackupPolicy:
                        name: trilio-daily-schedule-policy
                        namespace: default
                    retentionPolicy:
                      name: trilio-latest-retention-policy
                      namespace: default
                  backupPlanFlags:
                    skipImageBackup: true
                  continuousRestoreConfig:
                    continuousRestoreInstances:
                    - continuousRestorePolicy:
                        apiVersion: triliovault.trilio.io/v1
                        kind: Policy
                        name: tvk-cr-policy
                        namespace: default
                      instanceID: '{{with lookup "triliovault.trilio.io/v1" "Target" "default" "tvk-s3-event-target"}}{{- range $k, $v := .status.availableContinuousRestoreInstances }}{{ $k }}{{- end }}{{- end }}'
                  retainHelmApps: true
                status:
                  status: Available
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: tvk-cr-backup
        spec:
          remediationAction: enforce
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: triliovault.trilio.io/v1
                kind: Backup
                metadata:
                  name: tvk-cr-full-backup
                  namespace: '{{hub fromConfigMap "" "tvk-cr-backup-configmap" "backupNS" hub}}'
                spec:
                  type: Full
                  backupPlan:
                    name: tvk-cr-backupplan
                    namespace: '{{hub fromConfigMap "" "tvk-cr-backup-configmap" "backupNS" hub}}'
                status: 
                  status: Available
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: tvk-cr-backup-placement
spec:
  clusterSelector:
    matchExpressions:
      - key: protected-by
        operator: In
        values:
          - triliovault
      - key: tvk-continuous-restore-cluster
        operator: In
        values:
          - source
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: tvk-cr-backup-placement
placementRef:
  name: tvk-cr-backup-placement
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
subjects:
  - name: tvk-continuous-restore-backup
    apiGroup: policy.open-cluster-management.io
    kind: Policy