Configurable object selection

[smlx]

Context

If a cluster has sensitive, but autogenerated or externally managed objects then I don't want those to be dumped by the object-dumper script for backup by k8up. Examples of such objects include:

• TLS-ACME certificates
• Service account tokens
• Helm releases

Since sensitive objects are almost always Secrets, maybe it would make sense to be able to exclude Secret objects by Secret type? Or at least be able to add a label to exclude an object from backup.

Alternatives

I could use an alternative to the object-dumper script to dump my objects. But this project has integration for use with k8up.

Are there any existing alternative object-dumping tools for use with k8up for a "full cluster backup" that has object filtering capabilities?

I guess this is related to k8up-io/k8up#908, because if k8up gained this functionality natively then I could stop using object-dumper.

[bastjan]

Would a blanket exclude by resource be enough for you? Or would you need finer grained control?

[smlx]

I think having both options would be ideal. For example to blanket exclude all secrets you could do something like this:

excludeKinds:
- Secret

But I think it would make sense to also be able to select using standard label selectors or field selectors? That way the types that you specify could be filtered but other types would be unfiltered.

So, for example, to match the behaviour of this kubectl command:

kubectl get pods --selector=app.kubernetes.io/instance=nginx --field-selector=status.phase=Running

... you could use a configuration like this to select pods which are the intersection of the two filter specifications:

filterKinds:
- kind: Pod
  matchLabels:
    app.kubernetes.io/instance: nginx
- kind: Pod
  fieldSelector:
    status.phase: Running

Or you could have a configuration like this to select only secrets that are an intersection of the two filter specifications:

filterKinds:
- kind: Secret
  fieldSelector:
    type: kubernetes.io/tls
- kind: Secret
  matchLabels:
    controller.cert-manager.io/fao: true

[bastjan]

That's how i imagined it as well, with the per resource matching of field and label selector.

We now brought the project to a testable and maintainable state, but i can't guarantee we have time currently to implement this feature. However blanked ignore is implemented.