feat: Velero sa backup (#190)

kubernetes_cluster_velero/01_main.tf

@@ -8,7 +8,7 @@ data "azurerm_kubernetes_cluster" "aks_cluster" {
 }
 
 module "velero_storage_account" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//storage_account?ref=v7.2.0"
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//storage_account?ref=v7.24.0"
 
   name                            = "${local.sa_prefix}velerosa"
   account_kind                    = var.storage_account_kind
@@ -22,6 +22,17 @@ module "velero_storage_account" {
   enable_low_availability_alert   = false
   public_network_access_enabled   = var.use_storage_private_endpoint ? false : true
   tags                            = var.tags
+
+  # it needs to be higher than the other retention policies
+  blob_delete_retention_days           = var.sa_backup_retention_days + 1
+  blob_change_feed_enabled             = var.enable_sa_backup
+  blob_change_feed_retention_in_days   = var.enable_sa_backup ? var.sa_backup_retention_days : null
+  blob_container_delete_retention_days = var.sa_backup_retention_days
+  blob_storage_policy = {
+    enable_immutability_policy = false
+    blob_restore_policy_days   = var.sa_backup_retention_days
+  }
+
 }
 
 resource "azurerm_private_endpoint" "velero_storage_private_endpoint" {

kubernetes_cluster_velero/99_variables.tf

@@ -86,3 +86,15 @@ variable "storage_account_kind" {
   default     = "StorageV2"
   description = "(Optional) Defines the Kind of account. Valid options are BlobStorage, BlockBlobStorage, FileStorage, Storage and StorageV2. Defaults to StorageV2"
 }
+
+variable "sa_backup_retention_days" {
+  type        = number
+  description = "(Optional) number of days for which the storage account is available for point in time recovery"
+  default     = 0
+}
+
+variable "enable_sa_backup" {
+  type        = bool
+  description = "(Optional) enables storage account point in time recovery"
+  default     = false
+}

kubernetes_cluster_velero/README.md

@@ -18,7 +18,6 @@ This is achievable using the utility script `k8setup.sh` included in the aks-set
     source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_cluster_velero?ref=<version>"
     
     # required
-    backup_storage_account_name = module.velero_storage_account.name
     backup_storage_container_name = "velero-backup"
     resource_group_name = azurerm_resource_group.rg_velero_backup.name
     subscription_id = data.azurerm_subscription.current.subscription_id
@@ -32,6 +31,10 @@ This is achievable using the utility script `k8setup.sh` included in the aks-set
     plugin_version = "v1.7.1"
     use_storage_private_endpoint = true
     
+    enable_sa_backup = var.velero_sa_backup_enabled
+    sa_backup_retention_days = var.velero_sa_backup_retention_days
+    
+    
     # required if use_storage_private_endpoint = true
     storage_account_private_dns_zone_id = azurerm_private_dns_zone.storage_account.id
     private_endpoint_subnet_id = module.private_endpoint_snet.id
@@ -57,7 +60,7 @@ This is achievable using the utility script `k8setup.sh` included in the aks-set
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_velero_storage_account"></a> [velero\_storage\_account](#module\_velero\_storage\_account) | git::https://github.com/pagopa/terraform-azurerm-v3.git//storage_account | v7.2.0 |
+| <a name="module_velero_storage_account"></a> [velero\_storage\_account](#module\_velero\_storage\_account) | git::https://github.com/pagopa/terraform-azurerm-v3.git//storage_account | v7.24.0 |
 
 ## Resources
 
@@ -83,11 +86,13 @@ This is achievable using the utility script `k8setup.sh` included in the aks-set
 | <a name="input_aks_cluster_name"></a> [aks\_cluster\_name](#input\_aks\_cluster\_name) | (Required) Name of the aks cluster on which Velero will be installed | `string` | n/a | yes |
 | <a name="input_aks_cluster_rg"></a> [aks\_cluster\_rg](#input\_aks\_cluster\_rg) | (Required) AKS cluster resource group name | `string` | n/a | yes |
 | <a name="input_backup_storage_container_name"></a> [backup\_storage\_container\_name](#input\_backup\_storage\_container\_name) | (Required) Name of the storage container where Velero keeps the backups | `string` | n/a | yes |
+| <a name="input_enable_sa_backup"></a> [enable\_sa\_backup](#input\_enable\_sa\_backup) | (Optional) enables storage account point in time recovery | `bool` | `false` | no |
 | <a name="input_location"></a> [location](#input\_location) | (Required) Resource location | `string` | n/a | yes |
 | <a name="input_plugin_version"></a> [plugin\_version](#input\_plugin\_version) | (Optional) Version for the velero plugin | `string` | `"v1.7.1"` | no |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | (Required) Prefix used in the Velero dedicated resource names | `string` | n/a | yes |
 | <a name="input_private_endpoint_subnet_id"></a> [private\_endpoint\_subnet\_id](#input\_private\_endpoint\_subnet\_id) | (Optional) Subnet id where to create the private endpoint for backups storage account | `string` | `null` | no |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | (Required) Name of the resource group in which the backup storage account is located | `string` | n/a | yes |
+| <a name="input_sa_backup_retention_days"></a> [sa\_backup\_retention\_days](#input\_sa\_backup\_retention\_days) | (Optional) number of days for which the storage account is available for point in time recovery | `number` | `0` | no |
 | <a name="input_storage_account_kind"></a> [storage\_account\_kind](#input\_storage\_account\_kind) | (Optional) Defines the Kind of account. Valid options are BlobStorage, BlockBlobStorage, FileStorage, Storage and StorageV2. Defaults to StorageV2 | `string` | `"StorageV2"` | no |
 | <a name="input_storage_account_private_dns_zone_id"></a> [storage\_account\_private\_dns\_zone\_id](#input\_storage\_account\_private\_dns\_zone\_id) | (Optional) Storage account private dns zone id, used in the private endpoint creation | `string` | `null` | no |
 | <a name="input_storage_account_replication_type"></a> [storage\_account\_replication\_type](#input\_storage\_account\_replication\_type) | (Optional) Replication type used for the backup storage account | `string` | `"ZRS"` | no |