Add encrypted off-cluster etcd backups

apps/application/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/application/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: application

apps/naviya/00-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: application-metier
+  labels:
+    app.kubernetes.io/part-of: application-metier

apps/naviya/05-serviceaccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+  namespace: application-metier
+imagePullSecrets:
+  - name: application-metier-registry

apps/naviya/10-configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: application-metier-config
+  namespace: application-metier
+data:
+  APP_ENV: production
+  LOG_LEVEL: info
+  HTTP_ADDRESS: ":8080"
+  REDIS_ADDRESS: application-metier-redis:6379
+  REDIS_DATABASE: "0"
+  JWT_ISSUER: application-metier
+  JWT_AUDIENCE: application-metier-api
+  JWT_ACCESS_TTL: 15m
+  JWT_REFRESH_TTL: 720h
+  OPEN_METEO_FORECAST_URL: https://api.open-meteo.com/v1/forecast
+  OPEN_METEO_ARCHIVE_URL: https://archive-api.open-meteo.com/v1/archive
+  OPEN_METEO_MODEL: best_match
+  OPEN_METEO_REANALYSIS_DATASET: best_match
+  METEO_FRANCE_STATION_LIST_URL: https://public-api.meteofrance.fr/public/DPObs/liste-stations
+  METEO_FRANCE_OBSERVATION_URL: https://public-api.meteofrance.fr/public/DPObs/v2/station/horaire

apps/naviya/20-data.yaml

@@ -0,0 +1,216 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: application-metier-postgres
+  namespace: application-metier
+  labels:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: postgres
+spec:
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+  selector:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: postgres
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: application-metier-postgres
+  namespace: application-metier
+spec:
+  serviceName: application-metier-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: application-metier
+        app.kubernetes.io/component: postgres
+        app.kubernetes.io/part-of: application-metier
+    spec:
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 70
+        runAsGroup: 70
+        seccompProfile:
+          type: RuntimeDefault
+        fsGroup: 70
+      containers:
+        - name: postgres
+          image: postgres:17.10-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: application-metier-secrets
+                  key: POSTGRES_DB
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: application-metier-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: application-metier-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_INITDB_ARGS
+              value: --auth-host=scram-sha-256
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -ec
+                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 12
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -ec
+                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 20Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: application-metier-redis
+  namespace: application-metier
+  labels:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: redis
+spec:
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: redis
+  selector:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: redis
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: application-metier-redis
+  namespace: application-metier
+spec:
+  serviceName: application-metier-redis
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: redis
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: application-metier
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/part-of: application-metier
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: redis
+          image: redis:7.4.9-alpine
+          imagePullPolicy: IfNotPresent
+          command: ["sh", "-ec"]
+          args:
+            - exec redis-server --appendonly yes --requirepass "$REDIS_PASSWORD"
+          ports:
+            - name: redis
+              containerPort: 6379
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: application-metier-secrets
+                  key: REDIS_PASSWORD
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -ec
+                - redis-cli -a "$REDIS_PASSWORD" ping | grep -q PONG
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 12
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -ec
+                - redis-cli -a "$REDIS_PASSWORD" ping | grep -q PONG
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 2Gi

apps/naviya/30-backup.yaml

@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: application-metier-postgres-backups
+  namespace: application-metier
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: application-metier-postgres-backup
+  namespace: application-metier
+spec:
+  schedule: "17 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: backup
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 70
+            runAsGroup: 70
+            seccompProfile:
+              type: RuntimeDefault
+            fsGroup: 70
+          containers:
+            - name: pg-dump
+              image: postgres:17.10-alpine
+              imagePullPolicy: IfNotPresent
+              command: ["sh", "-ec"]
+              args:
+                - |
+                  umask 077
+                  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+                  target="/backups/application-metier-${stamp}.dump"
+                  tmp="${target}.tmp.$$"
+
+                  cleanup() {
+                    rm -f "$tmp"
+                  }
+                  trap cleanup EXIT
+
+                  pg_dump --format=custom --no-owner --no-acl --file="$tmp" "$DATABASE_URL"
+                  test -s "$tmp"
+                  mv "$tmp" "$target"
+                  trap - EXIT
+                  ls -lh "$target"
+                  find /backups -type f -name 'application-metier-*.dump' -mtime +14 -delete
+              env:
+                - name: DATABASE_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: application-metier-secrets
+                      key: DATABASE_URL
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 64Mi
+                limits:
+                  cpu: 500m
+                  memory: 256Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: backups
+                  mountPath: /backups
+          volumes:
+            - name: backups
+              persistentVolumeClaim:
+                claimName: application-metier-postgres-backups

apps/naviya/31-offsite-backup.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: naviya-postgres-backups-offsite
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - hard
+    - nfsvers=4.2
+    - timeo=600
+    - retrans=2
+    - nosuid
+    - nodev
+    - noexec
+  nfs:
+    server: 172.16.2.252
+    path: /Volume1/Backup/naviya-kubernetes/postgresql
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: application-metier-postgres-backups-offsite
+  namespace: application-metier
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: naviya-postgres-backups-offsite
+  resources:
+    requests:
+      storage: 100Gi

apps/naviya/32-offsite-cronjob.yaml

@@ -0,0 +1,191 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: application-metier-postgres-offsite-backup
+  namespace: application-metier
+spec:
+  schedule: "47 2 * * *"
+  timeZone: Etc/UTC
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 3600
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      activeDeadlineSeconds: 1800
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: backup
+            naviya.io/backup-target: offsite
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 70
+            runAsGroup: 70
+            fsGroup: 70
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: pg-dump
+              image: postgres:17.10-alpine
+              imagePullPolicy: IfNotPresent
+              command: ["sh", "-ec"]
+              args:
+                - |
+                  umask 077
+
+                  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+                  name="application-metier-${stamp}.dump"
+                  target="/offsite/daily/${name}"
+                  tmp="${target}.tmp.$$"
+                  checksum="${target}.sha256"
+                  checksum_tmp="${checksum}.tmp.$$"
+
+                  cleanup() {
+                    rm -f "$tmp" "$checksum_tmp"
+                  }
+                  trap cleanup EXIT
+
+                  pg_dump \
+                    --format=custom \
+                    --no-owner \
+                    --no-acl \
+                    --file="$tmp" \
+                    "$DATABASE_URL"
+
+                  test -s "$tmp"
+                  pg_restore --list "$tmp" >/dev/null
+                  mv "$tmp" "$target"
+
+                  digest="$(sha256sum "$target" | awk '{print $1}')"
+
+                  printf '%s  %s\n' \
+                    "$digest" \
+                    "$name" \
+                    > "$checksum_tmp"
+
+                  mv "$checksum_tmp" "$checksum"
+
+                  (
+                    cd /offsite/daily
+                    sha256sum -c "$(basename "$checksum")"
+                  )
+
+                  pg_restore \
+                    --file=/dev/null \
+                    "$target"
+
+                  echo "Sauvegarde quotidienne validée : $target"
+
+                  copy_tmp=""
+                  copy_checksum_tmp=""
+
+                  cleanup() {
+                    rm -f "$tmp" "$checksum_tmp"
+
+                    test -z "$copy_tmp" ||
+                      rm -f "$copy_tmp"
+
+                    test -z "$copy_checksum_tmp" ||
+                      rm -f "$copy_checksum_tmp"
+                  }
+
+                  copy_archive() {
+                    tier="$1"
+                    tier_dir="/offsite/${tier}"
+                    tier_target="${tier_dir}/${name}"
+                    copy_tmp="${tier_target}.tmp.$$"
+                    tier_checksum="${tier_target}.sha256"
+                    copy_checksum_tmp="${tier_checksum}.tmp.$$"
+
+                    cp "$target" "$copy_tmp"
+
+                    copy_digest="$(sha256sum "$copy_tmp" |
+                      awk '{print $1}')"
+
+                    test "$copy_digest" = "$digest"
+                    mv "$copy_tmp" "$tier_target"
+
+                    printf '%s  %s\n' \
+                      "$digest" \
+                      "$name" \
+                      > "$copy_checksum_tmp"
+
+                    mv \
+                      "$copy_checksum_tmp" \
+                      "$tier_checksum"
+
+                    (
+                      cd "$tier_dir"
+                      sha256sum -c "$(basename "$tier_checksum")"
+                    )
+
+                    copy_tmp=""
+                    copy_checksum_tmp=""
+
+                    echo "Copie ${tier} validée : $tier_target"
+                  }
+
+                  if test "$(date -u +%u)" = "7"; then
+                    copy_archive weekly
+                  fi
+
+                  if test "$(date -u +%d)" = "01"; then
+                    copy_archive monthly
+                  fi
+
+                  find /offsite/daily \
+                    -type f \
+                    \( -name '*.dump' -o -name '*.dump.sha256' \) \
+                    -mtime +14 \
+                    -delete
+
+                  find /offsite/weekly \
+                    -type f \
+                    \( -name '*.dump' -o -name '*.dump.sha256' \) \
+                    -mtime +56 \
+                    -delete
+
+                  find /offsite/monthly \
+                    -type f \
+                    \( -name '*.dump' -o -name '*.dump.sha256' \) \
+                    -mtime +370 \
+                    -delete
+
+                  find /offsite \
+                    -type f \
+                    -name '*.tmp.*' \
+                    -mtime +1 \
+                    -delete
+
+                  trap - EXIT
+                  echo "Sauvegarde externe terminée avec succès"
+              env:
+                - name: DATABASE_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: application-metier-secrets
+                      key: DATABASE_URL
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 64Mi
+                limits:
+                  cpu: 500m
+                  memory: 256Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: offsite
+                  mountPath: /offsite
+          volumes:
+            - name: offsite
+              persistentVolumeClaim:
+                claimName: application-metier-postgres-backups-offsite

apps/naviya/40-migrate.yaml

@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: application-metier-migrate
+  namespace: application-metier
+  labels:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 2
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: application-metier
+        app.kubernetes.io/component: migration
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: goose
+          image: git.guillin.ovh/baptiste/application-metier/api@sha256:ac01821f84a2413c6f34589f0f88dc54d4eb6188a0cd9c82267d092a3090b500
+          imagePullPolicy: IfNotPresent
+          command: ["/app/goose"]
+          args: ["up"]
+          env:
+            - name: GOOSE_DRIVER
+              value: postgres
+            - name: GOOSE_MIGRATION_DIR
+              value: /app/migrations
+            - name: GOOSE_DBSTRING
+              valueFrom:
+                secretKeyRef:
+                  name: application-metier-secrets
+                  key: DATABASE_URL
+            - name: NO_COLOR
+              value: "1"
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]

apps/naviya/50-api.yaml

@@ -0,0 +1,112 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: application-metier-api
+  namespace: application-metier
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: api
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: application-metier-api
+  namespace: application-metier
+spec:
+  replicas: 2
+  revisionHistoryLimit: 5
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: api
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: application-metier
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: application-metier
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: application-metier
+                    app.kubernetes.io/component: api
+      containers:
+        - name: api
+          image: git.guillin.ovh/baptiste/application-metier/api@sha256:ac01821f84a2413c6f34589f0f88dc54d4eb6188a0cd9c82267d092a3090b500
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: application-metier-config
+            - secretRef:
+                name: application-metier-secrets
+          startupProbe:
+            httpGet:
+              path: /livez
+              port: http
+            periodSeconds: 2
+            failureThreshold: 30
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: application-metier-api
+  namespace: application-metier
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: api

apps/naviya/60-frontend.yaml

@@ -0,0 +1,121 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: application-metier-frontend
+  namespace: application-metier
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: application-metier
+    app.kubernetes.io/component: frontend
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: application-metier-frontend
+  namespace: application-metier
+spec:
+  replicas: 2
+  revisionHistoryLimit: 5
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: application-metier
+        app.kubernetes.io/component: frontend
+        app.kubernetes.io/part-of: application-metier
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 20
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        fsGroup: 101
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: application-metier
+                    app.kubernetes.io/component: frontend
+      containers:
+        - name: frontend
+          image: git.guillin.ovh/baptiste/application-metier/frontend@sha256:f1035440814a2ece869cb7c12e2373b00d51b4a38086a53d06bb99412462b55a
+          imagePullPolicy: IfNotPresent
+          command: ["nginx"]
+          args: ["-g", "daemon off;"]
+          ports:
+            - name: http
+              containerPort: 8080
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 2
+            failureThreshold: 30
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 150m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: nginx-cache
+              mountPath: /var/cache/nginx
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: nginx-cache
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: application-metier-frontend
+  namespace: application-metier
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: frontend

apps/naviya/70-policies.yaml

@@ -0,0 +1,161 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: application-metier-frontend
+  namespace: application-metier
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: frontend
+  ingress:
+    - fromEntities:
+        - ingress
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: api
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            "k8s:k8s-app": kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: application-metier-api
+  namespace: application-metier
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: api
+  ingress:
+    - fromEntities:
+        - cluster
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: postgres
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: redis
+      toPorts:
+        - ports:
+            - port: "6379"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            "k8s:k8s-app": kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: application-metier-postgres
+  namespace: application-metier
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: postgres
+  ingress:
+    - fromEndpoints:
+        - matchExpressions:
+            - key: app.kubernetes.io/component
+              operator: In
+              values: [api, migration, bootstrap, backup, restore]
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: application-metier-redis
+  namespace: application-metier
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: application-metier
+      app.kubernetes.io/component: redis
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: api
+      toPorts:
+        - ports:
+            - port: "6379"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: application-metier-jobs
+  namespace: application-metier
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values: [migration, bootstrap, backup, restore]
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: application-metier
+            app.kubernetes.io/component: postgres
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            "k8s:k8s-app": kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

apps/naviya/80-gateway.yaml

@@ -0,0 +1,41 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: application-metier
+  namespace: application-metier
+spec:
+  gatewayClassName: cilium
+  addresses:
+    - type: IPAddress
+      value: 172.16.40.100
+  infrastructure:
+    labels:
+      naviya.io/ingress-lb: "true"
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: naviya.guillin.ovh
+      allowedRoutes:
+        namespaces:
+          from: Same
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: application-metier
+  namespace: application-metier
+spec:
+  parentRefs:
+    - name: application-metier
+      sectionName: http
+  hostnames:
+    - naviya.guillin.ovh
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: application-metier-frontend
+          port: 8080

apps/naviya/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- 00-namespace.yaml
+- 05-serviceaccount.yaml
+- 10-configmap.yaml
+- 20-data.yaml
+- 30-backup.yaml
+- 31-offsite-backup.yaml
+- 32-offsite-cronjob.yaml
+- 40-migrate.yaml
+- 50-api.yaml
+- 60-frontend.yaml
+- 70-policies.yaml
+- 80-gateway.yaml
+
+patches:
+- path: patch-migrate.yaml
+- path: patch-api.yaml
+- path: patch-frontend.yaml
+- path: patch-gateway.yaml
+- path: patch-route.yaml

apps/naviya/patch-api.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: application-metier-api
+  namespace: application-metier
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"

apps/naviya/patch-frontend.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: application-metier-frontend
+  namespace: application-metier
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"

apps/naviya/patch-gateway.yaml

@@ -0,0 +1,7 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: application-metier
+  namespace: application-metier
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"

apps/naviya/patch-migrate.yaml

@@ -0,0 +1,9 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: application-metier-migrate
+  namespace: application-metier
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+    argocd.argoproj.io/sync-wave: "1"

apps/naviya/patch-route.yaml

@@ -0,0 +1,7 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: application-metier
+  namespace: application-metier
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"

apps/web-test/web-ingress.yaml

@@ -2,10 +2,21 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: web
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
+
 spec:
   ingressClassName: nginx
+
+  tls:
+    - hosts:
+        - test.guillin.ovh
+      secretName: test-guillin-ovh-tls
+
   rules:
-  - host: web.local
+    - host: test.guillin.ovh
       http:
         paths:
           - path: /

bootstrap/argocd/helm/values.yaml

@@ -4,6 +4,11 @@ global:
 configs:
   params:
     server.insecure: true
+  ssh:
+    extraHosts: |
+      172.16.2.52 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPoracm1IhCGmmtbB3g29Vnk5Yy320vBGfuM239sJhccrFqF0VZSYVS16dby8hS/wj/35rn285yFPAoT8rrS2ZA=
+      172.16.2.52 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsIRmrVr88MnCjROlFRt/mS4bGip63Jpdt6SYo6GOAr
+      172.16.2.52 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDYLzn7/lyzGPg3jvYgi3brUzZOoS8noFA/gvB0YXmQsL1hMvU/GFYRW/Hhd8J1TsrtR9oYpyzuVQxryS7Au+FRpsW8SBdpLMSEdt+7q9y5k4GbUSb/48/xr/Ij2LN2mTltCBSGoO+IU98ujr9YJG5pBjfnV8AqSbTU/FILiTNrXNem3qcSb+pc8tWKq7oHNGXE6lLSdEm6fnMlkXdZmG66bW9kHH7q9CzJBpnaS0VYtteU/N3E51abHGYImLodv8GQeIlMtsl1fC8ZNflhIqeEHU+ynXRt0GG0uFpFbdbmN3niXegqR1L7Dfg1GNmLaWPIh69Cn0bYrtq2xFDvSQQ6hwDDXLr/WoF2jeeqOYselarpTBF0jeTq4gNpUl/sD5BIyYJNMuGzytrwrsFtgfkLIQYfdbVM3X1evF5lc2Cb1fro1FGiglg7L6Rv3+7Qfhi3ATg2KZUnct8z097ti1FuRO3uPJCbPgEGw+vFaCfcWTLs5afoECtwQlavOO0oPd8=
 
 server:
   replicas: 2
@@ -14,9 +19,12 @@ server:
   ingress:
     enabled: true
     ingressClassName: nginx
-
+    hostname: argocd.guillin.ovh
-    hosts:
+    annotations:
-      - argocd.guillin.ovh
+      cert-manager.io/cluster-issuer: letsencrypt-staging
+      nginx.ingress.kubernetes.io/ssl-redirect: "false"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
+    tls: true
 
 controller:
   replicas: 1

bootstrap/argocd/project.yaml

@@ -8,6 +8,7 @@ spec:
 
   sourceRepos:
     - 'gitea@172.16.2.52:baptiste/k8s.git'
+    - 'oci://quay.io/jetstack/charts/cert-manager'
 
   destinations:
     - namespace: '*'

clusters/homelab/apps/application.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: application
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: homelab
+
+  source:
+    repoURL: gitea@172.16.2.52:baptiste/k8s.git
+    targetRevision: main
+    path: apps/application
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: application
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

clusters/homelab/apps/cert-manager-config.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: homelab
+
+  source:
+    repoURL: gitea@172.16.2.52:baptiste/k8s.git
+    targetRevision: main
+    path: infrastructure/cert-manager/config
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
+      - SkipDryRunOnMissingResource=true

clusters/homelab/apps/cert-manager.yaml

@@ -3,15 +3,17 @@ kind: Application
 metadata:
   name: cert-manager
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=true
   finalizers:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: homelab
 
   sources:
-    - repoURL: oci://quay.io/jetstack/charts
+    - repoURL: oci://quay.io/jetstack/charts/cert-manager
-      chart: cert-manager
       targetRevision: v1.20.2
+      path: .
       helm:
         releaseName: cert-manager
         valueFiles:

clusters/homelab/apps/ingress-nginx.yaml

@@ -0,0 +1,62 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: homelab
+
+  source:
+    repoURL: https://kubernetes.github.io/ingress-nginx
+    chart: ingress-nginx
+    targetRevision: 4.15.1
+
+    helm:
+      releaseName: ingress-nginx
+      values: |
+        controller:
+          replicaCount: 2
+
+          ingressClassResource:
+            name: nginx
+            enabled: true
+            default: true
+
+          ingressClass: nginx
+
+          service:
+            type: LoadBalancer
+            loadBalancerIP: 172.16.10.200
+            externalTrafficPolicy: Local
+
+          config:
+            use-forwarded-headers: "true"
+            compute-full-forwarded-for: "true"
+            enable-real-ip: "true"
+            proxy-body-size: "100m"
+
+          metrics:
+            enabled: true
+
+          admissionWebhooks:
+            enabled: true
+
+        defaultBackend:
+          enabled: false
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

clusters/homelab/apps/kustomization.yaml

@@ -4,4 +4,7 @@ kind: Kustomization
 resources:
 - metallb.yaml
 - cert-manager.yaml
+- cert-manager-config.yaml
 - web-test.yaml
+- application.yaml
+- naviya.yaml

clusters/homelab/apps/naviya.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: naviya
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: homelab
+  source:
+    repoURL: gitea@172.16.2.52:baptiste/k8s.git
+    targetRevision: main
+    path: apps/naviya
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: application-metier
+  syncPolicy:
+    syncOptions:
+    - CreateNamespace=true
+    - PruneLast=true

infrastructure/cert-manager/config/clusterissuer-prod.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: baptiste.guillin@gmail.com
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: nginx

infrastructure/cert-manager/config/clusterissuer-staging.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    email: baptiste.guillin@gmail.com
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: nginx

infrastructure/cert-manager/config/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - clusterissuer-staging.yaml
+  - clusterissuer-prod.yaml

infrastructure/etcd-backup/10-storage.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: naviya-etcd-backups-offsite
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - hard
+    - nfsvers=4.2
+    - timeo=600
+    - retrans=2
+    - nosuid
+    - nodev
+    - noexec
+  nfs:
+    server: 172.16.2.252
+    path: /Volume1/Backup/naviya-kubernetes/etcd
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: naviya-etcd-backups-offsite
+  namespace: kube-system
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: naviya-etcd-backups-offsite
+  resources:
+    requests:
+      storage: 10Gi

infrastructure/etcd-backup/20-cronjob.yaml

@@ -0,0 +1,285 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: naviya-etcd-backup
+  namespace: kube-system
+spec:
+  schedule: "17 3 * * *"
+  timeZone: Etc/UTC
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 3600
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: naviya-etcd-backup
+        spec:
+          automountServiceAccountToken: false
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+          restartPolicy: Never
+          nodeSelector:
+            node-role.kubernetes.io/control-plane: ""
+          tolerations:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+              effect: NoSchedule
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault
+          initContainers:
+            - name: snapshot
+              image: registry.k8s.io/etcd:3.6.8-0
+              imagePullPolicy: IfNotPresent
+              command:
+                - etcdctl
+              args:
+                - --endpoints=https://127.0.0.1:2379
+                - --cacert=/etcd-certs/ca.crt
+                - --cert=/etcd-certs/healthcheck-client.crt
+                - --key=/etcd-certs/healthcheck-client.key
+                - snapshot
+                - save
+                - /work/snapshot.db
+              securityContext:
+                runAsUser: 0
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: etcd-certs
+                  mountPath: /etcd-certs
+                  readOnly: true
+                - name: work
+                  mountPath: /work
+            - name: validate
+              image: registry.k8s.io/etcd:3.6.8-0
+              imagePullPolicy: IfNotPresent
+              command:
+                - etcdutl
+              args:
+                - --write-out=table
+                - snapshot
+                - status
+                - /work/snapshot.db
+              securityContext:
+                runAsUser: 0
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: work
+                  mountPath: /work
+                  readOnly: true
+          containers:
+            - name: encrypt
+              image: docker.io/alpine/openssl@sha256:61cec9c1f221755bf995f1f309211b222164599e2d1943b666f878ef644d3a0e
+              imagePullPolicy: IfNotPresent
+              command: ["sh", "-ec"]
+              args:
+                - |
+                  umask 077
+
+                  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+                  name="naviya-etcd-${stamp}-${NODE_NAME}.db.enc"
+                  target="/offsite/daily/${name}"
+                  tmp="${target}.tmp.$$"
+                  checksum="${target}.sha256"
+                  checksum_tmp="${checksum}.tmp.$$"
+                  verification="/work/verification.db"
+
+                  cleanup() {
+                    rm -f \
+                      "$tmp" \
+                      "$checksum_tmp" \
+                      "$verification"
+                  }
+                  trap cleanup EXIT
+
+                  openssl enc \
+                    -aes-256-cbc \
+                    -salt \
+                    -pbkdf2 \
+                    -iter 600000 \
+                    -md sha256 \
+                    -in /work/snapshot.db \
+                    -out "$tmp" \
+                    -pass file:/key/passphrase
+
+                  test -s "$tmp"
+
+                  openssl enc \
+                    -d \
+                    -aes-256-cbc \
+                    -pbkdf2 \
+                    -iter 600000 \
+                    -md sha256 \
+                    -in "$tmp" \
+                    -out "$verification" \
+                    -pass file:/key/passphrase
+
+                  snapshot_sha="$(sha256sum /work/snapshot.db |
+                    awk '{print $1}')"
+
+                  verification_sha="$(sha256sum "$verification" |
+                    awk '{print $1}')"
+
+                  test "$snapshot_sha" = "$verification_sha"
+
+                  rm -f "$verification"
+
+                  echo "Chiffrement et déchiffrement de contrôle : OK"
+
+                  mv "$tmp" "$target"
+
+                  encrypted_sha="$(sha256sum "$target" |
+                    awk '{print $1}')"
+
+                  printf '%s  %s\n' \
+                    "$encrypted_sha" \
+                    "$name" \
+                    > "$checksum_tmp"
+
+                  mv "$checksum_tmp" "$checksum"
+
+                  (
+                    cd /offsite/daily
+                    sha256sum -c "$(basename "$checksum")"
+                  )
+
+                  echo "Snapshot etcd quotidien validé : $target"
+
+                  copy_tmp=""
+                  copy_checksum_tmp=""
+
+                  cleanup() {
+                    rm -f \
+                      "$tmp" \
+                      "$checksum_tmp" \
+                      "$verification"
+
+                    test -z "$copy_tmp" ||
+                      rm -f "$copy_tmp"
+
+                    test -z "$copy_checksum_tmp" ||
+                      rm -f "$copy_checksum_tmp"
+                  }
+
+                  copy_archive() {
+                    tier="$1"
+                    tier_dir="/offsite/${tier}"
+                    tier_target="${tier_dir}/${name}"
+                    copy_tmp="${tier_target}.tmp.$$"
+                    tier_checksum="${tier_target}.sha256"
+                    copy_checksum_tmp="${tier_checksum}.tmp.$$"
+
+                    cp "$target" "$copy_tmp"
+
+                    copy_sha="$(sha256sum "$copy_tmp" |
+                      awk '{print $1}')"
+
+                    test "$copy_sha" = "$encrypted_sha"
+                    mv "$copy_tmp" "$tier_target"
+
+                    printf '%s  %s\n' \
+                      "$encrypted_sha" \
+                      "$name" \
+                      > "$copy_checksum_tmp"
+
+                    mv \
+                      "$copy_checksum_tmp" \
+                      "$tier_checksum"
+
+                    (
+                      cd "$tier_dir"
+                      sha256sum -c "$(basename "$tier_checksum")"
+                    )
+
+                    copy_tmp=""
+                    copy_checksum_tmp=""
+
+                    echo "Copie ${tier} validée : $tier_target"
+                  }
+
+                  if test "$(date -u +%u)" = "7"; then
+                    copy_archive weekly
+                  fi
+
+                  if test "$(date -u +%d)" = "01"; then
+                    copy_archive monthly
+                  fi
+
+                  find /offsite/daily \
+                    -type f \
+                    \( -name '*.db.enc' -o -name '*.db.enc.sha256' \) \
+                    -mtime +14 \
+                    -delete
+
+                  find /offsite/weekly \
+                    -type f \
+                    \( -name '*.db.enc' -o -name '*.db.enc.sha256' \) \
+                    -mtime +56 \
+                    -delete
+
+                  find /offsite/monthly \
+                    -type f \
+                    \( -name '*.db.enc' -o -name '*.db.enc.sha256' \) \
+                    -mtime +370 \
+                    -delete
+
+                  find /offsite \
+                    -type f \
+                    -name '*.tmp.*' \
+                    -mtime +1 \
+                    -delete
+
+                  trap - EXIT
+                  echo "Sauvegarde etcd chiffrée terminée avec succès"
+              env:
+                - name: NODE_NAME
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: spec.nodeName
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 32Mi
+                limits:
+                  cpu: 500m
+                  memory: 256Mi
+              securityContext:
+                runAsUser: 0
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: work
+                  mountPath: /work
+                - name: offsite
+                  mountPath: /offsite
+                - name: encryption-key
+                  mountPath: /key
+                  readOnly: true
+          volumes:
+            - name: work
+              emptyDir: {}
+            - name: etcd-certs
+              hostPath:
+                path: /etc/kubernetes/pki/etcd
+                type: Directory
+            - name: offsite
+              persistentVolumeClaim:
+                claimName: naviya-etcd-backups-offsite
+            - name: encryption-key
+              secret:
+                secretName: naviya-etcd-backup-encryption
+                defaultMode: 0400

infrastructure/etcd-backup/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - 10-storage.yaml
+  - 20-cronjob.yaml