Add VM data backups guide (restic) - #232
Merged
HiranAdikari merged 2 commits intoJul 22, 2026
Merged
Conversation
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds a restic-based VM application-data backup and restore guide covering S3 setup, Terraform/cloud-init automation, verification, same- and cross-datacenter recovery, retention, and production hardening. ChangesVM restic backups
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
modules/tenancy/vm/examples/BACKUPS.md (1)
275-277: 🗄️ Data Integrity & Integration | 🔵 TrivialAdd a periodic
restic check --read-data
restic checkis still useful for routine metadata checks, but schedule a--read-datarun (or a restore drill) so corruption in pack contents doesn’t go unnoticed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@modules/tenancy/vm/examples/BACKUPS.md` around lines 275 - 277, Update the backup verification instructions in BACKUPS.md to retain routine restic check metadata validation and add a scheduled restic check --read-data run, or an equivalent restore drill, to verify pack contents. Make the periodic data-integrity check explicit alongside the existing restic snapshots and restic check commands.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modules/tenancy/vm/examples/BACKUPS.md`:
- Around line 148-155: Remove long-lived AWS credentials and the Restic
repository password from the user_data/restic_env cloud-init payload. Replace
this interpolation with a runtime secret-delivery mechanism; if that is not
possible, explicitly document and enforce protection of Terraform state and
harvester_cloudinit_secret access, including credential rotation and revocation
procedures.
- Line 281: Update the backup verification instructions around the aws s3 ls
example to run the command from the operator workstation rather than inside the
VM SSH block. Clearly label the execution context and preserve the existing
region and bucket arguments; do not require AWS CLI or S3 credential setup on
the VM.
- Line 164: Update the backup commands in BACKUPS.md to scope both restic
forget/prune and dump latest operations to the my-app tag by adding the
appropriate --tag my-app argument. Preserve the existing retention and restore
behavior, and note that shared repositories require one repository per workload.
- Line 194: Update the password value in the cloud-init YAML example to wrap
var.vm_password with jsonencode, ensuring passwords containing YAML-significant
characters are serialized as valid quoted strings.
- Around line 311-320: Update the restore examples in BACKUPS.md to run the
environment sourcing and restic restore, dump, and mount commands through sudo
bash -c. Before restic mount, install the required FUSE package and create
/mnt/restic with mkdir -p, preserving the existing restore, dump, and mount
examples.
---
Nitpick comments:
In `@modules/tenancy/vm/examples/BACKUPS.md`:
- Around line 275-277: Update the backup verification instructions in BACKUPS.md
to retain routine restic check metadata validation and add a scheduled restic
check --read-data run, or an equivalent restore drill, to verify pack contents.
Make the periodic data-integrity check explicit alongside the existing restic
snapshots and restic check commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b93aaa87-4c1d-49c4-8bc8-281b68cd59a0
📒 Files selected for processing (1)
modules/tenancy/vm/examples/BACKUPS.md
docs: apply review feedback to modules/tenancy/vm/examples/BACKUPS.md - note that restic_env lands in the cloud-init Secret + TF state; advise limiting access, least-priv IAM, and key rotation - clarify the per-VM repo (prefix) and tag `restic dump` with my-app - serialize the VM password with jsonencode for YAML-safe cloud-init - drop the aws s3 ls check (restic snapshots/check already prove it) - sudo-wrap the file-level restore/dump/mount; make mount optional and install FUSE + create the mountpoint first
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
HiranAdikari
approved these changes
Jul 20, 2026
This was referenced Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Resolves #231. The
tenancy/vmexamples document how to provision a VM but not how to back up its data. Product teams own their VM-data backups to their own S3 buckets and had no guide. This is the general-VM companion to the cluster backups guide (#219, etcd + Velero).Goals
Provide a self-service VM-data backup + restore guide beside the
tenancy/vmmodule, matching the style ofk8s-cluster/examples/BACKUPS.md.Approach
Add
modules/tenancy/vm/examples/BACKUPS.md, covering:.timer, passed via thevmmodule'suser_data; MAC-agnostic netplan so a restored VM still gets an IP.restore --include/dump/mount), and cross-DC DR reading the same bucket.Release note
Docs: add a self-service restic VM-data backup + restore guide for the
tenancy/vmmodule.Documentation
This PR is documentation:
modules/tenancy/vm/examples/BACKUPS.md.Summary by CodeRabbit