fix: remove Rancher backup workflow

2026-04-26 22:13:20 +00:00
parent 2bde45e106
commit d925eeac3f
60 changed files with 0 additions and 2623 deletions
@@ -928,106 +928,6 @@ jobs:
          kubectl -n cattle-system wait --for=condition=Ready issuer/cattle-system-rancher --timeout=900s
          kubectl -n cattle-system wait --for=condition=Ready certificate/tls-rancher-ingress --timeout=900s

-          echo "Waiting for rancher-backup operator..."
-          wait_for_resource flux-system kustomization.kustomize.toolkit.fluxcd.io/addon-rancher-backup 600
-          kubectl -n flux-system annotate kustomization/addon-rancher-backup reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
-          wait_for_resource flux-system helmrelease.helm.toolkit.fluxcd.io/rancher-backup-crd 600
-          wait_for_resource flux-system helmrelease.helm.toolkit.fluxcd.io/rancher-backup 600
-          reconcile_helmrelease rancher-backup-crd
-          reconcile_helmrelease rancher-backup
-          wait_for_helmchart_ready flux-system-rancher-backup-crd rancher-backup-crd 180s 5
-          wait_for_helmchart_ready flux-system-rancher-backup rancher-backup 180s 5
-          wait_for_helmrelease_ready rancher-backup-crd cattle-resources-system 600
-          wait_for_helmrelease_ready rancher-backup cattle-resources-system 600
-          wait_for_resource "" namespace/cattle-resources-system 600
-          kubectl -n cattle-resources-system rollout status deployment/rancher-backup --timeout=900s
-
-      - name: Restore Rancher from latest B2 backup
-        env:
-          KUBECONFIG: outputs/kubeconfig
-          B2_ACCOUNT_ID: ${{ secrets.B2_ACCOUNT_ID }}
-          B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
-        run: |
-          set -euo pipefail
-          echo "Finding latest backup in B2..."
-
-          CREDS=$(echo -n "${B2_ACCOUNT_ID}:${B2_APPLICATION_KEY}" | base64)
-          AUTH_RESP=$(curl -sS -H "Authorization: Basic ${CREDS}" https://api.backblazeb2.com/b2api/v2/b2_authorize_account)
-          API_URL=$(echo "$AUTH_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin)['apiUrl'])")
-          AUTH_TOKEN=$(echo "$AUTH_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin)['authorizationToken'])")
-          BUCKET_ID=$(echo "$AUTH_RESP" | python3 -c "
-          import json,sys
-          resp = json.load(sys.stdin)
-          bid = resp.get('allowed', {}).get('bucketId')
-          if bid:
-            print(bid)
-          else:
-            print('')
-          ")
-
-          if [ -z "$BUCKET_ID" ]; then
-            echo "Restricted B2 key - resolving bucket ID by name..."
-            BUCKET_ID=$(curl -sS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-              "${API_URL}/b2api/v2/b2_list_buckets?accountId=${B2_ACCOUNT_ID}&bucketName=HetznerTerra" \
-              | python3 -c "import json,sys; buckets=json.load(sys.stdin).get('buckets',[]); print(buckets[0]['bucketId'] if buckets else '')")
-          fi
-
-          LATEST=$(curl -sS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-            "${API_URL}/b2api/v2/b2_list_file_names?bucketId=${BUCKET_ID}&prefix=rancher-backups/&maxFileCount=100" \
-            | python3 -c "
-          import json,sys
-          files = json.load(sys.stdin).get('files', [])
-          tars = [f['fileName'] for f in files if f['fileName'].endswith('.tar.gz')]
-          if not tars:
-            print('NONE')
-          else:
-            tars.sort()
-            print(tars[-1])
-          ")
-
-          if [ "$LATEST" = "NONE" ]; then
-            echo "No Rancher backups found in B2. Skipping restore; rancher-backup will create future backups."
-            exit 0
-          fi
-
-          BACKUP_FILE=$(basename "$LATEST")
-          echo "Latest backup: ${BACKUP_FILE}"
-
-          echo "Creating Restore CR..."
-          kubectl -n cattle-resources-system delete restore restore-from-b2 --ignore-not-found
-          kubectl apply -f - <<EOF
-          apiVersion: resources.cattle.io/v1
-          kind: Restore
-          metadata:
-            name: restore-from-b2
-            namespace: cattle-resources-system
-          spec:
-            backupFilename: ${BACKUP_FILE}
-            storageLocation:
-              s3:
-                credentialSecretName: rancher-b2-creds
-                credentialSecretNamespace: cattle-resources-system
-                bucketName: HetznerTerra
-                folder: rancher-backups
-                endpoint: s3.us-east-005.backblazeb2.com
-                region: us-east-005
-          EOF
-
-          echo "Waiting for restore to complete..."
-          for i in $(seq 1 60); do
-            STATUS=$(kubectl get restore restore-from-b2 -n cattle-resources-system -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "Unknown")
-            MESSAGE=$(kubectl get restore restore-from-b2 -n cattle-resources-system -o jsonpath='{.status.conditions[?(@.type=="Ready")].message}' 2>/dev/null || echo "")
-            echo "  Restore status: ${STATUS} - ${MESSAGE}"
-            if [ "$STATUS" = "True" ]; then
-              echo "Restore completed successfully!"
-              exit 0
-            fi
-            sleep 10
-          done
-          echo "Restore did not complete within timeout." >&2
-          kubectl -n cattle-resources-system describe restore restore-from-b2 || true
-          exit 1
-
      - name: Seed observability runtime images
        run: |
          set -euo pipefail
@@ -1129,8 +1029,6 @@ jobs:
            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-tailscale-proxyclass --timeout=300s
            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher --timeout=900s
            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-config --timeout=300s
-            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-backup --timeout=300s
-            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-backup-config --timeout=300s
            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability --timeout=1200s
            kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability-content --timeout=300s
            kubectl -n flux-system wait --for=condition=Ready helmrelease --all --timeout=1200s
@@ -1144,7 +1042,6 @@ jobs:
              | grep -Ev "^cattle-system[[:space:]]+helm-operation-" \
              | grep -Ev "^cattle-capi-system[[:space:]]+capi-controller-manager-" \
              | grep -Ev "^cattle-turtles-system[[:space:]]+cluster-api-operator-resources-cleanup-" \
-              | grep -Ev "^cattle-resources-system[[:space:]]+rancher-backup-patch-sa-" \
              | grep -Ev "^kube-system[[:space:]]+helm-install-" \
              | tee "${unhealthy_pods}" || true
            test ! -s "${unhealthy_pods}"
@@ -7,14 +7,6 @@ on:
        description: 'Type "destroy" to confirm'
        required: true
        default: ''
-      require_rancher_backup:
-        description: 'Require an existing Rancher B2 backup before destroy'
-        required: true
-        default: 'true'
-        type: choice
-        options:
-          - 'true'
-          - 'false'

 concurrency:
  group: prod-cluster
@@ -31,8 +23,6 @@ env:
  TF_VAR_proxmox_api_token_id: ${{ secrets.PROXMOX_API_TOKEN_ID }}
  TF_VAR_proxmox_api_token_secret: ${{ secrets.PROXMOX_API_TOKEN_SECRET }}
  TF_VAR_proxmox_insecure: "true"
-  B2_ACCOUNT_ID: ${{ secrets.B2_ACCOUNT_ID }}
-  B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}

 jobs:
  destroy:
@@ -68,48 +58,6 @@ jobs:
            -backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}" \
            -backend-config="skip_requesting_account_id=true"

-      - name: Verify Rancher backup exists
-        if: github.event.inputs.require_rancher_backup == 'true'
-        run: |
-          set -euo pipefail
-          if [ -z "${B2_ACCOUNT_ID}" ] || [ -z "${B2_APPLICATION_KEY}" ]; then
-            echo "B2 credentials are not available in this workflow/environment; cannot verify Rancher backups." >&2
-            exit 1
-          fi
-
-          CREDS=$(printf '%s:%s' "${B2_ACCOUNT_ID}" "${B2_APPLICATION_KEY}" | base64 -w0)
-          AUTH_RESP=$(curl -fsS -H "Authorization: Basic ${CREDS}" https://api.backblazeb2.com/b2api/v2/b2_authorize_account) || {
-            echo "Failed to authorize with B2; check B2_ACCOUNT_ID/B2_APPLICATION_KEY in the destroy environment." >&2
-            exit 1
-          }
-          API_URL=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['apiUrl'])")
-          AUTH_TOKEN=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['authorizationToken'])")
-          BUCKET_ID=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('allowed', {}).get('bucketId') or '')")
-
-          if [ -z "${BUCKET_ID}" ]; then
-            BUCKET_ID=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-              "${API_URL}/b2api/v2/b2_list_buckets?accountId=${B2_ACCOUNT_ID}&bucketName=HetznerTerra" \
-              | python3 -c "import json,sys; buckets=json.load(sys.stdin).get('buckets',[]); print(buckets[0]['bucketId'] if buckets else '')")
-          fi
-
-          LATEST=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"bucketId\":\"${BUCKET_ID}\",\"prefix\":\"rancher-backups/\",\"maxFileCount\":100}" \
-            "${API_URL}/b2api/v2/b2_list_file_names" \
-            | python3 -c "import json,sys; files=json.load(sys.stdin).get('files', []); tars=sorted(f['fileName'] for f in files if f['fileName'].endswith('.tar.gz')); print(tars[-1] if tars else '')")
-
-          if [ -z "${LATEST}" ]; then
-            echo "No Rancher backup found in B2; refusing to destroy cluster." >&2
-            exit 1
-          fi
-
-          echo "Verified Rancher backup exists: ${LATEST}"
-
-      - name: Skip Rancher backup verification
-        if: github.event.inputs.require_rancher_backup == 'false'
-        run: |
-          echo "Rancher backup verification explicitly skipped for this destroy run."
-
      - name: Terraform Destroy
        id: destroy
        working-directory: terraform