Create resourceset alternative

README.md

@@ -92,12 +92,13 @@ It installs the following cluster-scoped CRDs:
 #### Restore
   Creating an instance of the Restore CRD lets you restore from a backup file. For help configuring restores, see [this documentation](https://ranchermanager.docs.rancher.com/reference-guides/backup-restore-configuration/restore-configuration).
 #### ResourceSet
-  ResourceSet specifies the Kubernetes core resources and CRDs that need to be backed up. This chart comes with a predetermined ResourceSet to be used for backing up Rancher application
+  ResourceSet specifies the Kubernetes core resources and CRDs that need to be backed up. This chart comes with three predetermined ResourceSets to be used for backing up the Rancher application. For help choosing which ResourceSet to use with your Backups, see [this documentation](https://ranchermanager.docs.rancher.com/reference-guides/backup-restore-configuration/backup-configuration#resourceset).
+  Note the default *rancher-resource-set* option has been deprecated and is currently kept for backwards compatibility only, and will be removed in v8.0.0 in favor of *rancher-resource-set-basic* and *rancher-resource-set-full*.
 
 ----
 
 ### User flow
-1. Create a ResourceSet, that targets all the resources you want to backup. The ResourceSet required for backing up Rancher will be provided and installed by the chart. Refer to the default [rancher-resourceset](https://github.com/rancher/backup-restore-operator/blob/master/charts/rancher-backup/templates/rancher-resourceset.yaml) as an example for creating resourceSets
+1. Create a ResourceSet, that targets all the resources you want to backup. The ResourceSets required for backing up Rancher will be provided and installed by the chart. Refer to the default [rancher-resourceset-basic](https://github.com/rancher/backup-restore-operator/blob/master/charts/rancher-backup/templates/rancher-resourceset-basic.yaml) as an example for creating resourceSets.
 2. Performing a backup: To take a backup, user has to create an instance of the Backup CRD (create a Backup CR). Each Backup CR must reference a ResourceSet. A Backup CR can be used to perform a one-time backup or recurring backups. Refer [examples](https://github.com/rancher/backup-restore-operator/tree/master/examples) folder for sample manifests
 3. Restoring from a backup: To restore from a backup, user has to create an instance of the Restore CRD (create a Restore CR). A Restore CR must contain the exact Backup filename. Refer to the [examples](https://github.com/rancher/backup-restore-operator/tree/master/examples) folder for sample manifests.
 

charts/rancher-backup/files/basic-resourceset-contents/aks.yaml

@@ -0,0 +1,25 @@
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "aks.cattle.io$"
+- apiVersion: "aks.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  namespaces:
+    - "cattle-system"
+  resourceNames:
+    - "aks-config-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNames:
+    - "aks-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNames:
+    - "aks-operator"
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  namespaces:
+    - "cattle-system"
+  resourceNames:
+  - "aks-operator"

charts/rancher-backup/files/basic-resourceset-contents/eks.yaml

@@ -0,0 +1,17 @@
+- apiVersion: "eks.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  resourceNames:
+    - "eks-config-operator"
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "eks.cattle.io$"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNames:
+    - "eks-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNames:
+    - "eks-operator"

charts/rancher-backup/files/basic-resourceset-contents/elemental.yaml

@@ -0,0 +1,49 @@
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "elemental.cattle.io$"
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  namespaces:
+    - "cattle-elemental-system"
+  resourceNames:
+    - "elemental-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNames:
+    - "elemental-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNames:
+    - "elemental-operator"
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  namespaces:
+    - "cattle-elemental-system"
+  resourceNames:
+    - "elemental-operator"
+- apiVersion: "management.cattle.io/v3"
+  kindsRegexp: "^globalrole$"
+  resourceNames:
+    - "elemental-operator"
+- apiVersion: "management.cattle.io/v3"
+  kindsRegexp: "^apiservice$"
+  resourceNameRegexp: "elemental.cattle.io$"
+- apiVersion: "elemental.cattle.io/v1beta1"
+  kindsRegexp: "."
+  namespaceRegexp: "^cattle-fleet-|^fleet-|^cattle-elemental-system$"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^roles$|^rolebindings$"
+  labelSelectors:
+    matchExpressions:
+    - key: "elemental.cattle.io/managed"
+      operator: "In"
+      values: ["true"]
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  labelSelectors:
+    matchExpressions:
+    - key: "elemental.cattle.io/managed"
+      operator: "In"
+      values: ["true"]
+  namespaceRegexp: "^cattle-fleet-|^fleet-"

charts/rancher-backup/files/basic-resourceset-contents/fleet.yaml

@@ -0,0 +1,48 @@
+- apiVersion: "v1"
+  kindsRegexp: "^namespaces$"
+  resourceNameRegexp: "^fleet-"
+- apiVersion: "v1"
+  kindsRegexp: "^namespaces$"
+  labelSelectors:
+    matchExpressions:
+      - key: "app.kubernetes.io/managed-by"
+        operator: "In"
+        values: ["rancher"]
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+  excludeResourceNameRegexp: "^default$"
+- apiVersion: "v1"
+  kindsRegexp: "^configmaps$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^roles$|^rolebindings$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNameRegexp: "^fleet-|^gitjob-"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNameRegexp: "^fleet-"
+  resourceNames:
+    - "gitjob"
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "fleet.cattle.io$|gitjob.cattle.io$"
+- apiVersion: "fleet.cattle.io/v1alpha1"
+  kindsRegexp: "."
+  excludeKinds:
+    - "bundledeployments"
+- apiVersion: "gitjob.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+  resourceNameRegexp: "^fleet-"
+  resourceNames:
+    - "gitjob"
+- apiVersion: "apps/v1"
+  kindsRegexp: "^services$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+  resourceNames:
+    - "gitjob"

charts/rancher-backup/files/basic-resourceset-contents/gke.yaml

@@ -0,0 +1,17 @@
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "gke.cattle.io$"
+- apiVersion: "gke.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  resourceNames:
+    - "gke-config-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNames:
+    - "gke-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNames:
+    - "gke-operator"

charts/rancher-backup/files/basic-resourceset-contents/provisioningv2.yaml

@@ -0,0 +1,18 @@
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "provisioning.cattle.io$|rke-machine-config.cattle.io$|rke-machine.cattle.io$|rke.cattle.io$|cluster.x-k8s.io$"
+- apiVersion: "provisioning.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "rke-machine-config.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "rke-machine.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "rke.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "cluster.x-k8s.io/v1beta1"
+  kindsRegexp: "."
+- apiVersion: "v1"
+  kindsRegexp: "^configmaps$"
+  resourceNames:
+    - "provisioning-log"
+  namespaceRegexp: "^c-m-"

charts/rancher-backup/files/basic-resourceset-contents/rancher-operator.yaml

@@ -0,0 +1,28 @@
+- apiVersion: "rancher.cattle.io/v1"
+  kindsRegexp: "."
+- apiVersion: "apps/v1"
+  kindsRegexp: "^deployments$"
+  resourceNames:
+    - "rancher-operator"
+  namespaces:
+    - "rancher-operator-system"
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  namespaces:
+    - "rancher-operator-system"
+  excludeResourceNameRegexp: "^default$"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNames:
+    - "rancher-operator"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNames:
+    - "rancher-operator"
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "rancher.cattle.io$"
+- apiVersion: "v1"
+  kindsRegexp: "^namespaces$"
+  resourceNames:
+    - "rancher-operator-system"

charts/rancher-backup/files/basic-resourceset-contents/rancher.yaml

@@ -0,0 +1,52 @@
+- apiVersion: "v1"
+  kindsRegexp: "^namespaces$"
+  resourceNameRegexp: "^cattle-|^p-|^c-|^user-|^u-"
+  resourceNames:
+    - "local"
+- apiVersion: "v1"
+  kindsRegexp: "^serviceaccounts$"
+  namespaceRegexp: "^cattle-|^p-|^c-|^local$|^user-|^u-"
+  excludeResourceNameRegexp: "^default$|^rancher-csp-adapter$"
+- apiVersion: "v1"
+  kindsRegexp: "^configmaps$"
+  namespaces:
+    - "cattle-system"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^roles$|^rolebindings$"
+  namespaceRegexp: "^cattle-|^p-|^c-|^local$|^user-|^u-"
+  excludeResourceNameRegexp: "^rancher-csp-adapter"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterrolebindings$"
+  resourceNameRegexp: "^cattle-|^clusterrolebinding-|^globaladmin-user-|^grb-u-|^crb-"
+- apiVersion: "rbac.authorization.k8s.io/v1"
+  kindsRegexp: "^clusterroles$"
+  resourceNameRegexp: "^cattle-|^p-|^c-|^local-|^user-|^u-|^project-|^create-ns$"
+  excludeResourceNameRegexp: "^rancher-csp-adapter-"
+- apiVersion: "scheduling.k8s.io/v1"
+  kindsRegexp: "^priorityclasses$"
+  resourceNameRegexp: "^rancher-critical$"
+- apiVersion: "apiextensions.k8s.io/v1"
+  kindsRegexp: "."
+  resourceNameRegexp: "management.cattle.io$|project.cattle.io$|catalog.cattle.io$|resources.cattle.io$"
+- apiVersion: "management.cattle.io/v3"
+  kindsRegexp: "."
+  excludeKinds:
+    - "tokens"
+    - "rancherusernotifications"
+- apiVersion: "management.cattle.io/v3"
+  kindsRegexp: "^tokens$"
+  labelSelectors:
+    matchExpressions:
+      - key: "authn.management.cattle.io/kind"
+        operator: "NotIn"
+        values: [ "provisioning" ]
+- apiVersion: "project.cattle.io/v3"
+  kindsRegexp: "."
+- apiVersion: "catalog.cattle.io/v1"
+  kindsRegexp: "^clusterrepos$"
+- apiVersion: "resources.cattle.io/v1"
+  kindsRegexp: "^ResourceSet$"
+- apiVersion: catalog.cattle.io/v1
+  kindsRegexp: ^UIPlugin$
+  namespaces:
+  - cattle-ui-plugin-system

charts/rancher-backup/files/sensitive-resourceset-contents/elemental.yaml

@@ -0,0 +1,8 @@
+- apiVersion: "v1"
+  kindsRegexp: "^secrets$"
+  labelSelectors:
+    matchExpressions:
+    - key: "elemental.cattle.io/managed"
+      operator: "In"
+      values: ["true"]
+  namespaceRegexp: "^cattle-fleet-|^fleet-"

charts/rancher-backup/files/sensitive-resourceset-contents/fleet.yaml

@@ -0,0 +1,12 @@
+- apiVersion: "v1"
+  kindsRegexp: "^secrets$"
+  namespaceRegexp: "^cattle-fleet-|^fleet-"
+  excludeResourceNameRegexp: "^import-token"
+  labelSelectors:
+    matchExpressions:
+      - key: "owner"
+        operator: "NotIn"
+        values: ["helm"]
+      - key: "fleet.cattle.io/managed"
+        operator: "In"
+        values: ["true"]

charts/rancher-backup/files/sensitive-resourceset-contents/provisioningv2.yaml

@@ -0,0 +1,5 @@
+- apiVersion: "v1"
+  kindsRegexp: "^secrets$"
+  resourceNameRegexp: "machine-plan$|rke-state$|machine-state$|machine-driver-secret$|machine-provision$|^harvesterconfig|^registryconfig-auth"
+  namespaces:
+  - "fleet-default"

charts/rancher-backup/files/sensitive-resourceset-contents/rancher.yaml

@@ -0,0 +1,17 @@
+- apiVersion: "v1"
+  kindsRegexp: "^secrets$"
+  namespaceRegexp: "^cattle-|^p-|^c-|^local$|^user-|^u-"
+  labelSelectors:
+    matchExpressions:
+      - key: "owner"
+        operator: "NotIn"
+        values: ["helm"]
+  excludeResourceNameRegexp: "^bootstrap-secret$|^rancher-csp-adapter|^csp-adapter-cache$"
+- apiVersion: "v1"
+  kindsRegexp: "^secrets$"
+  namespaceRegexp: "^.*$"
+  labelSelectors:
+    matchExpressions:
+      - key: "resources.cattle.io/backup"
+        operator: "In"
+        values: ["true"]

charts/rancher-backup/templates/rancher-resourceset-basic.yaml

@@ -0,0 +1,13 @@
+apiVersion: resources.cattle.io/v1
+kind: ResourceSet
+metadata:
+  name: rancher-resource-set-basic
+controllerReferences:
+  - apiVersion: "apps/v1"
+    resource: "deployments"
+    name: "rancher"
+    namespace: "cattle-system"
+resourceSelectors:
+{{- range $path, $_ := .Files.Glob "files/basic-resourceset-contents/*.yaml" -}}
+  {{- $.Files.Get $path | nindent 2 -}}
+{{- end -}}

charts/rancher-backup/templates/rancher-resourceset-full.yaml

@@ -0,0 +1,16 @@
+apiVersion: resources.cattle.io/v1
+kind: ResourceSet
+metadata:
+  name: rancher-resource-set-full
+controllerReferences:
+  - apiVersion: "apps/v1"
+    resource: "deployments"
+    name: "rancher"
+    namespace: "cattle-system"
+resourceSelectors:
+{{- range $path, $_ := .Files.Glob "files/basic-resourceset-contents/*.yaml" -}}
+  {{- $.Files.Get $path | nindent 2 -}}
+{{- end -}}
+{{- range $path, $_ := .Files.Glob "files/sensitive-resourceset-contents/*.yaml" -}}
+  {{- $.Files.Get $path | nindent 2 -}}
+{{- end -}}