Add Remote ConfigBackup type with S3 object storage - #490
Open
felix-kaestner wants to merge 7 commits into
Open
Conversation
Introduce a Method string type with constants MethodCLI and MethodCLIASCII. Add WithMethod(m Method) on Request, following the same pattern as WithRollback. The cli_ascii method returns plain text in the result.msg field instead of structured JSON in result.body. The response decoder now handles both fields, returning whichever is populated. This enables callers to retrieve unstructured output such as show running-config as a JSON-encoded string. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
Add a new ConfigBackupType 'Remote' that fetches the running configuration from the device via RunningConfig() and uploads it to an S3-compatible object store. API changes: - Add ConfigBackupTypeRemote enum value - Add ConfigBackupS3 struct (endpoint, bucket, region, creds) - Add S3 field to ConfigBackupSpec with CEL validation - Add SecretNotFoundReason condition reason - Add GetSecretRefs() helper on ConfigBackup Controller changes: - Add ObjectStorage interface and optional field on reconciler - Add ListRemoteConfigBackups, CreateRemoteConfigBackup, and DeleteRemoteConfigBackups methods - Integrate Remote type into the existing reconcile flow with switch/default dispatch alongside Local/Startup - Watch referenced Secrets to re-reconcile on creation/update - Handle missing Secret with terminal SecretNotFound condition New package internal/objectstorage: - S3-compatible client wrapping aws-sdk-go-v2 with PutObject, ListObjects, and DeleteObjects operations Also adds RunningConfig() to ConfigBackupProvider interface with NX-OS implementation via cli_ascii NX-API method. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
felix-kaestner
force-pushed
the
remote-backup
branch
from
August 10, 2026 16:28
7a8bd3e to
a7a446c
Compare
felix-kaestner
force-pushed
the
remote-backup
branch
from
August 10, 2026 17:05
f195032 to
52cfd88
Compare
Add a MinIO deployment to config/develop for local S3 testing. Includes a ClusterIP Service and credentials Secret. The Tilt setup port-forwards the MinIO console to localhost:9001. Add a remote-backup sample in the ConfigBackup samples that backs up every minute to the in-cluster MinIO instance with retention of 10 backups. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
Before performing a Remote backup, the controller now calls HeadBucket to verify the S3 endpoint is reachable and the configured bucket exists. If the check succeeds, RemoteEndpointReady is set to True. If it fails, both RemoteEndpointReady and Ready are set to False with reason RemoteEndpointUnreachable, and the reconciliation stops with an error. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
Add ConfigBackupEncryption struct with support for AES-256-GCM and ChaCha20-Poly1305 algorithms. Encryption is performed in the controller pod before uploading to object storage. The encryption key is resolved from a referenced Secret via the existing clientutil.Secret pattern. If the key Secret is missing, a terminal SecretNotFound condition is set. If encryption fails (e.g., invalid key size), a terminal EncryptionFailed condition is set with a warning event. The LastBackup status now includes EncryptionAlgorithm and EncryptionKeySecret fields so users can inspect which encryption was applied to each backup. GetSecretRefs is extended to include the encryption key Secret so the watcher triggers re-reconciliation on key changes. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
Add hack/decrypt-backup, a CLI tool that downloads and decrypts a remote ConfigBackup from S3. It reads the ConfigBackup resource to determine the S3 endpoint, credentials, encryption settings, and the object key from status.lastBackup.filepath. Also adds GetObject to the objectstorage client for downloading objects from S3. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
Document the new Remote backup type including S3 configuration, encrypted backups, supported algorithms, status conditions, and the decrypt-backup tool usage. Signed-off-by: Felix Kästner <felix.kaestner@sap.com>
felix-kaestner
force-pushed
the
remote-backup
branch
from
August 10, 2026 17:09
52cfd88 to
0d1362f
Compare
Merging this branch changes the coverage (2 decrease, 2 increase)
Coverage by fileChanged files (no unit tests)
Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code. Changed unit test files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.