Skip to content

Add Restic SFTP Support #1735

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jonnobrow wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add Restic SFTP Support #1735

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3f8f845
adds SSHKeys to restic API types
Jonnobrow Aug 12, 2025
30a64bd
adds SSH keys secrets for restic mover
Jonnobrow Aug 12, 2025
77d01af
setup build and tempsshdir for restic sftp
Jonnobrow Aug 14, 2025
684c639
feat: add support for known hosts
Jonnobrow Aug 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ RUN microdnf --refresh update -y && \
microdnf --nodocs --setopt=install_weak_deps=0 install -y \
acl `# rclone - getfacl/setfacl` \
openssh `# rsync/ssh - ssh key generation in operator` \
openssh-clients `# rsync/ssh - ssh client` \
openssh-clients `# rsync/ssh and restic - ssh client` \
openssh-server `# rsync/ssh - ssh server` \
perl `# rsync/ssh - rrsync script` \
stunnel `# rsync-tls` \
Expand Down
15 changes: 15 additions & 0 deletions api/v1alpha1/replicationdestination_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,15 @@ type ReplicationDestinationRsyncStatus struct {
Port *int32 `json:"port,omitempty"`
}

type ReplicationDestinationResticStatus struct {
// sshKeys is the name of a Secret that contains the SSH keys to be used for
// authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
// generated and the appropriate keys for the remote side will be placed
// here.
//+optional
SSHKeys *string `json:"sshKeys,omitempty"`
}

type ReplicationDestinationResticCA CustomCASpec

// ReplicationDestinationResticSpec defines the field for restic in replicationDestination.
Expand Down Expand Up @@ -255,6 +264,10 @@ type ReplicationDestinationResticSpec struct {
// +kubebuilder:validation:Format="date-time"
//+optional
RestoreAsOf *string `json:"restoreAsOf,omitempty"`
// sshKeys is the name of a Secret that contains the SSH keys to be used for
// authentication. If not provided, the keys will be generated.
//+optional
SSHKeys *string `json:"sshKeys,omitempty"`
// enableFileDeletion will pass the --delete flag to the restic restore command.
// This will remove files and directories in the pvc that do not exist in the snapshot being restored.
// Defaults to false.
Expand Down Expand Up @@ -294,6 +307,8 @@ type ReplicationDestinationStatus struct {
Rsync *ReplicationDestinationRsyncStatus `json:"rsync,omitempty"`
// rsyncTLS contains status information for Rsync-based replication over TLS.
RsyncTLS *ReplicationDestinationRsyncTLSStatus `json:"rsyncTLS,omitempty"`
// restic containers status information for Restic-based replication.
Restic *ReplicationDestinationResticStatus `json:"restic,omitempty"`
// external contains provider-specific status information. For more details,
// please see the documentation of the specific replication provider being
// used.
Expand Down
10 changes: 10 additions & 0 deletions api/v1alpha1/replicationsource_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,10 @@ type ReplicationSourceResticCA CustomCASpec
// ReplicationSourceResticSpec defines the field for restic in replicationSource.
type ReplicationSourceResticSpec struct {
ReplicationSourceVolumeOptions `json:",inline"`
// sshKeys is the name of a Secret that contains the SSH keys to be used for
// authentication. If not provided, the keys will be generated.
//+optional
SSHKeys *string `json:"sshKeys,omitempty"`
// PruneIntervalDays define how often to prune the repository
PruneIntervalDays *int32 `json:"pruneIntervalDays,omitempty"`
// Repository is the secret name containing repository info
Expand Down Expand Up @@ -215,6 +219,12 @@ type ReplicationSourceResticSpec struct {

// ReplicationSourceResticStatus defines the field for ReplicationSourceStatus in ReplicationSourceStatus
type ReplicationSourceResticStatus struct {
// sshKeys is the name of a Secret that contains the SSH keys to be used for
// authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
// generated and the appropriate keys for the remote side will be placed
// here.
//+optional
SSHKeys *string `json:"sshKeys,omitempty"`
// lastPruned in the object holding the time of last pruned
//+optional
LastPruned *metav1.Time `json:"lastPruned,omitempty"`
Expand Down
40 changes: 40 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 17 additions & 0 deletions bundle/manifests/volsync.backube_replicationdestinations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2760,6 +2760,11 @@ spec:
as of that time.
format: date-time
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to specify the StorageClass of the
Expand Down Expand Up @@ -4421,6 +4426,18 @@ spec:
scheduled to start (for schedule-based synchronization).
format: date-time
type: string
restic:
description: restic containers status information for Restic-based
replication.
properties:
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
properties:
Expand Down
12 changes: 12 additions & 0 deletions bundle/manifests/volsync.backube_replicationsources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2741,6 +2741,11 @@ spec:
format: int32
type: integer
type: object
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to override the StorageClass of the PiT
Expand Down Expand Up @@ -5642,6 +5647,13 @@ spec:
lastUnlocked is set to the last spec.restic.unlock when a sync is done that unlocks the
restic repository.
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/volsync.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ metadata:
}
]
capabilities: Basic Install
createdAt: "2025-08-20T15:32:39Z"
createdAt: "2025-08-28T19:57:25Z"
olm.skipRange: '>=0.4.0 <0.14.0'
operators.operatorframework.io/builder: operator-sdk-v1.33.0
operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
Expand Down
17 changes: 17 additions & 0 deletions config/crd/bases/volsync.backube_replicationdestinations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2760,6 +2760,11 @@ spec:
as of that time.
format: date-time
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to specify the StorageClass of the
Expand Down Expand Up @@ -4421,6 +4426,18 @@ spec:
scheduled to start (for schedule-based synchronization).
format: date-time
type: string
restic:
description: restic containers status information for Restic-based
replication.
properties:
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
properties:
Expand Down
12 changes: 12 additions & 0 deletions config/crd/bases/volsync.backube_replicationsources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2741,6 +2741,11 @@ spec:
format: int32
type: integer
type: object
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to override the StorageClass of the PiT
Expand Down Expand Up @@ -5642,6 +5647,13 @@ spec:
lastUnlocked is set to the last spec.restic.unlock when a sync is done that unlocks the
restic repository.
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
Expand Down
16 changes: 16 additions & 0 deletions helm/volsync/templates/volsync.backube_replicationdestinations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2641,6 +2641,11 @@ spec:
description: RestoreAsOf refers to the backup that is most recent as of that time.
format: date-time
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to specify the StorageClass of the
Expand Down Expand Up @@ -4238,6 +4243,17 @@ spec:
scheduled to start (for schedule-based synchronization).
format: date-time
type: string
restic:
description: restic containers status information for Restic-based replication.
properties:
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
properties:
Expand Down
12 changes: 12 additions & 0 deletions helm/volsync/templates/volsync.backube_replicationsources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2618,6 +2618,11 @@ spec:
format: int32
type: integer
type: object
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided, the keys will be generated.
type: string
storageClassName:
description: |-
storageClassName can be used to override the StorageClass of the PiT
Expand Down Expand Up @@ -5396,6 +5401,13 @@ spec:
lastUnlocked is set to the last spec.restic.unlock when a sync is done that unlocks the
restic repository.
type: string
sshKeys:
description: |-
sshKeys is the name of a Secret that contains the SSH keys to be used for
authentication. If not provided in .spec.restic.sshKeys, SSH keys will be
generated and the appropriate keys for the remote side will be placed
here.
type: string
type: object
rsync:
description: rsync contains status information for Rsync-based replication.
Expand Down
22 changes: 18 additions & 4 deletions internal/controller/mover/restic/builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ func (rb *Builder) FromSource(client client.Client, logger logr.Logger,
saHandler := utils.NewSAHandler(client, source, isSource, privileged,
source.Spec.Restic.MoverServiceAccount)

return &Mover{
mover := &Mover{
client: client,
logger: logger.WithValues("method", "Restic"),
eventRecorder: eventRecorder,
Expand All @@ -136,6 +136,7 @@ func (rb *Builder) FromSource(client client.Client, logger logr.Logger,
cacheCapacity: source.Spec.Restic.CacheCapacity,
cacheStorageClassName: source.Spec.Restic.CacheStorageClassName,
repositoryName: source.Spec.Restic.Repository,
sshKeys: source.Spec.Restic.SSHKeys,
isSource: isSource,
paused: source.Spec.Paused,
mainPVCName: &source.Spec.SourcePVC,
Expand All @@ -147,7 +148,13 @@ func (rb *Builder) FromSource(client client.Client, logger logr.Logger,
sourceStatus: source.Status.Restic,
latestMoverStatus: source.Status.LatestMoverStatus,
moverConfig: source.Spec.Restic.MoverConfig,
}, nil
}

if source.Spec.Restic.SSHKeys != nil {
mover.moverConfig.MoverSecurityContext = nil
}

return mover, nil
}

func (rb *Builder) FromDestination(client client.Client, logger logr.Logger,
Expand Down Expand Up @@ -177,7 +184,7 @@ func (rb *Builder) FromDestination(client client.Client, logger logr.Logger,
saHandler := utils.NewSAHandler(client, destination, isSource, privileged,
destination.Spec.Restic.MoverServiceAccount)

return &Mover{
mover := &Mover{
client: client,
logger: logger.WithValues("method", "Restic"),
eventRecorder: eventRecorder,
Expand All @@ -190,6 +197,7 @@ func (rb *Builder) FromDestination(client client.Client, logger logr.Logger,
cacheStorageClassName: destination.Spec.Restic.CacheStorageClassName,
cleanupCachePVC: destination.Spec.Restic.CleanupCachePVC,
repositoryName: destination.Spec.Restic.Repository,
sshKeys: destination.Spec.Restic.SSHKeys,
isSource: isSource,
paused: destination.Spec.Paused,
mainPVCName: destination.Spec.Restic.DestinationPVC,
Expand All @@ -201,5 +209,11 @@ func (rb *Builder) FromDestination(client client.Client, logger logr.Logger,
enableFileDeletionOnRestore: destination.Spec.Restic.EnableFileDeletion,
latestMoverStatus: destination.Status.LatestMoverStatus,
moverConfig: destination.Spec.Restic.MoverConfig,
}, nil
}

if destination.Spec.Restic.SSHKeys != nil {
mover.moverConfig.MoverSecurityContext = nil
}

return mover, nil
}
Loading