k.rennerandClaude Opus 4.6
49db7668e1
Downloads backup from RustFS S3 directly into the CNPG pod using the MinIO client. No extra pods or complex orchestration needed. Requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
60 lines
2.1 KiB
Bash
Executable File
60 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Restore Authentik database from RustFS backup into K8s CloudNativePG
|
|
#
|
|
# Prerequisites:
|
|
# - kubectl configured
|
|
# - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars set (RustFS creds)
|
|
#
|
|
# Usage:
|
|
# export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
|
|
# ./restore-authentik-db.sh
|
|
|
|
S3_ENDPOINT="http://s3.renner.uno:9000"
|
|
S3_BUCKET="migration"
|
|
S3_KEY="authentik-backup.dump"
|
|
NAMESPACE="authentik"
|
|
PG_POD="ak-pg-1"
|
|
|
|
: "${AWS_ACCESS_KEY_ID:?Set AWS_ACCESS_KEY_ID}"
|
|
: "${AWS_SECRET_ACCESS_KEY:?Set AWS_SECRET_ACCESS_KEY}"
|
|
|
|
echo "=== Authentik DB Restore ==="
|
|
|
|
# Scale down Authentik
|
|
echo "Scaling down Authentik..."
|
|
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=0
|
|
kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=0
|
|
kubectl wait -n "$NAMESPACE" --for=delete pod -l app.kubernetes.io/name=authentik --timeout=120s 2>/dev/null || true
|
|
sleep 5
|
|
|
|
# Install mc (MinIO client) in the PG pod and download the backup
|
|
echo "Downloading backup into PG pod..."
|
|
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- bash -c "
|
|
curl -sfL https://dl.min.io/client/mc/release/linux-amd64/mc -o /tmp/mc && chmod +x /tmp/mc
|
|
/tmp/mc alias set rustfs '$S3_ENDPOINT' '$AWS_ACCESS_KEY_ID' '$AWS_SECRET_ACCESS_KEY'
|
|
/tmp/mc cp rustfs/$S3_BUCKET/$S3_KEY /tmp/backup.dump
|
|
ls -lh /tmp/backup.dump
|
|
"
|
|
|
|
# Restore
|
|
echo "Restoring database..."
|
|
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- \
|
|
pg_restore --clean --if-exists --no-owner --no-privileges \
|
|
--dbname=authentik /tmp/backup.dump \
|
|
|| echo "Warning: pg_restore reported errors (usually safe to ignore for pre-existing objects)"
|
|
|
|
# Cleanup
|
|
echo "Cleaning up..."
|
|
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- rm -f /tmp/backup.dump /tmp/mc
|
|
|
|
# Scale back up
|
|
echo "Scaling up Authentik..."
|
|
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=2
|
|
kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=2
|
|
kubectl wait -n "$NAMESPACE" --for=condition=Ready pod -l app.kubernetes.io/component=server --timeout=120s
|
|
|
|
echo "=== Restore Complete ==="
|
|
echo "All users, passwords, 2FA devices, and sessions preserved."
|