apiVersion: v1
kind: Service
metadata:
  name: backup-manager
  namespace: {{ namespace }}
  labels:
    app: backup-manager
    app.kubernetes.io/name: backup-manager
spec:
  type: ClusterIP
  selector:
    app: backup-manager
  ports:
    - name: api
      port: {{ daemon_http_port }}
      targetPort: api
      protocol: TCP
    - name: metrics
      port: {{ daemon_metrics_port }}
      targetPort: metrics
      protocol: TCP
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: backup-manager
  namespace: {{ namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: backup-manager
rules:
  # Read state of every workload to know what to back up.
  - apiGroups: [""]
    resources: ["pods", "services", "configmaps", "secrets", "persistentvolumeclaims", "namespaces", "events"]
    verbs: ["get", "list", "watch"]
  # Drive Longhorn VolumeSnapshot CRD for csi_consistent_group coordination.
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots", "volumesnapshotclasses", "volumesnapshotcontents"]
    verbs: ["get", "list", "watch", "create", "delete"]
  # Manage CronJobs for one-shot scheduling.
  - apiGroups: ["batch"]
    resources: ["cronjobs", "jobs"]
    verbs: ["get", "list", "watch", "create", "patch", "update", "delete"]
  # Pod exec for quiesce hooks.
  - apiGroups: [""]
    resources: ["pods/exec", "pods/log"]
    verbs: ["create", "get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: backup-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: backup-manager
subjects:
  - kind: ServiceAccount
    name: backup-manager
    namespace: {{ namespace }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: backup-manager-state
  namespace: {{ namespace }}
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: hcloud-volumes
  resources:
    requests:
      storage: 5Gi