Implement Kopia

Dockerfile

@@ -1,6 +1,6 @@
 ######################################################################
 # Establish a common builder image for all golang-based images
-FROM golang:1.23 AS golang-builder
+FROM golang:1.24 AS golang-builder
 USER root
 WORKDIR /workspace
 # We don't vendor modules. Enforce that behavior
@@ -46,7 +46,8 @@ WORKDIR /workspace/rclone
 # Make sure the Rclone version tag matches the git hash we're expecting
 RUN /bin/bash -c "[[ $(git rev-list -n 1 HEAD) == ${RCLONE_GIT_HASH} ]]"
 
-RUN make rclone
+# Tell Go to use the standard BFD linker instead of gold
+RUN make rclone BUILD_ARGS="-ldflags='-extldflags=-fuse-ld=bfd'"
 
 
 ######################################################################
@@ -61,6 +62,22 @@ WORKDIR /workspace/restic
 RUN go run build.go --enable-cgo
 
 
+######################################################################
+# Build kopia
+FROM golang-builder AS kopia-builder
+
+ARG KOPIA_VERSION="v0.21.1"
+ARG KOPIA_GIT_HASH="0733cb4d2a731dbb92d927f66230694e014f4df2"
+
+RUN git clone --depth 1 -b ${KOPIA_VERSION} https://github.com/kopia/kopia.git
+WORKDIR /workspace/kopia
+
+# Make sure we have the correct Kopia release
+RUN /bin/bash -c "[[ $(git rev-list -n 1 HEAD) == ${KOPIA_GIT_HASH} ]]"
+
+RUN go build -o kopia
+
+
 ######################################################################
 # Build syncthing
 FROM golang-builder AS syncthing-builder
@@ -117,6 +134,7 @@ WORKDIR /
 RUN microdnf --refresh update -y && \
     microdnf --nodocs --setopt=install_weak_deps=0 install -y \
         acl             `# rclone - getfacl/setfacl` \
+        jq              `# kopia - JSON parsing in entry.sh` \
         openssh         `# rsync/ssh - ssh key generation in operator` \
         openssh-clients `# rsync/ssh - ssh client` \
         openssh-server  `# rsync/ssh - ssh server` \
@@ -146,6 +164,12 @@ COPY /mover-restic/entry.sh \
      /mover-restic/
 RUN chmod a+rx /mover-restic/*.sh
 
+##### kopia
+COPY --from=kopia-builder /workspace/kopia/kopia /usr/local/bin/kopia
+COPY /mover-kopia/entry.sh \
+     /mover-kopia/
+RUN chmod a+rx /mover-kopia/*.sh
+
 ##### rsync (ssh)
 COPY /mover-rsync/source.sh \
      /mover-rsync/destination.sh \

api/v1alpha1/common_types.go

@@ -63,12 +63,11 @@ const (
 )
 
 const (
-	ConditionSynchronizing     string = "Synchronizing"
-	SynchronizingReasonSync    string = "SyncInProgress"
-	SynchronizingReasonSched   string = "WaitingForSchedule"
-	SynchronizingReasonManual  string = "WaitingForManual"
-	SynchronizingReasonCleanup string = "CleaningUp"
-	SynchronizingReasonError   string = "Error"
+	ConditionSynchronizing    string = "Synchronizing"
+	SynchronizingReasonSync   string = "SyncInProgress"
+	SynchronizingReasonSched  string = "WaitingForSchedule"
+	SynchronizingReasonManual string = "WaitingForManual"
+	SynchronizingReasonError  string = "Error"
 )
 
 const (
@@ -149,6 +148,34 @@ type CustomCASpec struct {
 	Key string `json:"key,omitempty"`
 }
 
+// KopiaPolicySpec defines configuration for Kopia policy files
+type KopiaPolicySpec struct {
+	// The name of a Secret that contains Kopia policy configuration files
+	// If SecretName is used then ConfigMapName should not be set
+	SecretName string `json:"secretName,omitempty"`
+
+	// The name of a ConfigMap that contains Kopia policy configuration files
+	// If ConfigMapName is used then SecretName should not be set
+	ConfigMapName string `json:"configMapName,omitempty"`
+
+	// GlobalPolicyFilename specifies the filename for the global policy configuration.
+	// This file should contain a JSON policy configuration that will be applied globally.
+	// Defaults to "global-policy.json" if not specified.
+	//+optional
+	GlobalPolicyFilename string `json:"globalPolicyFilename,omitempty"`
+
+	// RepositoryConfigFilename specifies the filename for the repository configuration.
+	// This file should contain repository-specific settings like actions enablement.
+	// Defaults to "repository.config" if not specified.
+	//+optional
+	RepositoryConfigFilename string `json:"repositoryConfigFilename,omitempty"`
+
+	// RepositoryConfig is a multiline JSON string containing Kopia repository configuration
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Optional
+	RepositoryConfig *string `json:"repositoryConfig,omitempty"`
+}
+
 type MoverConfig struct {
 	// MoverSecurityContext allows specifying the PodSecurityContext that will
 	// be used by the data mover

api/v1alpha1/replicationdestination_types.go

@@ -196,6 +196,9 @@ type ReplicationDestinationSpec struct {
 	// restic defines the configuration when using Restic-based replication.
 	//+optional
 	Restic *ReplicationDestinationResticSpec `json:"restic,omitempty"`
+	// kopia defines the configuration when using Kopia-based replication.
+	//+optional
+	Kopia *ReplicationDestinationKopiaSpec `json:"kopia,omitempty"`
 	// external defines the configuration when using an external replication
 	// provider.
 	//+optional
@@ -264,6 +267,139 @@ type ReplicationDestinationResticSpec struct {
 	MoverConfig `json:",inline"`
 }
 
+type ReplicationDestinationKopiaCA CustomCASpec
+
+// KopiaSourceIdentity defines helper fields to identify the source of snapshots to restore.
+// This is the RECOMMENDED way to configure identity for Kopia ReplicationDestination.
+// At minimum, SourceName must be provided (SourceNamespace defaults to current namespace).
+type KopiaSourceIdentity struct {
+	// SourceName is the name of the ReplicationSource that created the snapshots.
+	// This field is REQUIRED when using SourceIdentity.
+	// +optional
+	SourceName string `json:"sourceName,omitempty"`
+	// SourceNamespace is the namespace of the ReplicationSource that created the snapshots.
+	// If not specified, defaults to the namespace of this ReplicationDestination.
+	// +optional
+	SourceNamespace string `json:"sourceNamespace,omitempty"`
+	// SourcePVCName is the name of the PVC that was backed up by the ReplicationSource.
+	// This is used to generate the exact same hostname/identity as the source.
+	// If not provided, VolSync will attempt to auto-discover it from the ReplicationSource.
+	// If auto-discovery fails, the destination PVC name will be used as a fallback.
+	// +optional
+	SourcePVCName string `json:"sourcePVCName,omitempty"`
+	// SourcePathOverride is the path override from the ReplicationSource.
+	// If not provided, VolSync will attempt to auto-discover it from the ReplicationSource.
+	// This allows the destination to restore from the correct snapshot path when the source
+	// used a different path name in the snapshot than the actual filesystem path.
+	// +kubebuilder:validation:Pattern="^/.*"
+	// +optional
+	SourcePathOverride *string `json:"sourcePathOverride,omitempty"`
+}
+
+// ReplicationDestinationKopiaSpec defines the field for kopia in replicationDestination.
+// Identity configuration is OPTIONAL. When not provided, VolSync automatically generates:
+// - Username: <destination-name>
+// - Hostname: <namespace>
+// This works perfectly for simple same-namespace restores when the destination name matches the source.
+// For cross-namespace restores or custom identity, use SourceIdentity or provide both Username AND Hostname.
+type ReplicationDestinationKopiaSpec struct {
+	ReplicationDestinationVolumeOptions `json:",inline"`
+	// Repository is the secret name containing repository info.
+	// When using SourceIdentity, this can be auto-discovered from the ReplicationSource.
+	Repository string `json:"repository,omitempty"`
+	// customCA is a custom CA that will be used to verify the remote
+	CustomCA ReplicationDestinationKopiaCA `json:"customCA,omitempty"`
+	// cacheCapacity can be used to set the size of the kopia metadata cache volume
+	//+optional
+	CacheCapacity *resource.Quantity `json:"cacheCapacity,omitempty"`
+	// cacheStorageClassName can be used to set the StorageClass of the kopia
+	// metadata cache volume
+	//+optional
+	CacheStorageClassName *string `json:"cacheStorageClassName,omitempty"`
+	// accessModes can be used to set the accessModes of kopia metadata cache volume
+	//+optional
+	CacheAccessModes []corev1.PersistentVolumeAccessMode `json:"cacheAccessModes,omitempty"`
+	// Set this to true to delete the kopia cache PVC (dynamically provisioned
+	// by VolSync) at the end of each successful ReplicationDestination sync iteration.
+	// Cache PVCs will always be deleted if the owning ReplicationDestination is
+	// removed, even if this setting is false.
+	// The default is false.
+	//+optional
+	CleanupCachePVC bool `json:"cleanupCachePVC,omitempty"`
+	// RestoreAsOf refers to the backup that is most recent as of that time.
+	// +kubebuilder:validation:Format="date-time"
+	//+optional
+	RestoreAsOf *string `json:"restoreAsOf,omitempty"`
+	// Shallow defines the shallow restore depth (only restore recent snapshots)
+	//+optional
+	Shallow *int32 `json:"shallow,omitempty"`
+	// Previous specifies the number of snapshots to skip before selecting one to restore from
+	//+optional
+	Previous *int32 `json:"previous,omitempty"`
+	// PolicyConfig defines configuration for Kopia policy files
+	//+optional
+	PolicyConfig *KopiaPolicySpec `json:"policyConfig,omitempty"`
+	// SourceIdentity provides an easy way to specify which ReplicationSource's snapshots to restore.
+	// When specified, it will be used to generate the username and hostname automatically.
+	// Use this for cross-namespace restores or when the destination has a different name than the source.
+	// Optional: When omitted, automatic identity is used based on the destination's name and namespace.
+	//+optional
+	SourceIdentity *KopiaSourceIdentity `json:"sourceIdentity,omitempty"`
+	// Username for Kopia repository access.
+	// When provided, MUST be used together with Hostname.
+	// Optional: If not specified, defaults to <destination-name>-<namespace>.
+	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9._-]*[a-zA-Z0-9]$|^[a-zA-Z0-9]$"
+	//+optional
+	Username *string `json:"username,omitempty"`
+	// Hostname for Kopia repository access.
+	// When provided, MUST be used together with Username.
+	// Optional: If not specified, defaults to the namespace name.
+	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9._-]*[a-zA-Z0-9]$|^[a-zA-Z0-9]$"
+	//+optional
+	Hostname *string `json:"hostname,omitempty"`
+	// enableFileDeletion will clean the destination directory before restore to ensure
+	// it exactly matches the snapshot. Files and directories in the destination that don't
+	// exist in the snapshot will be removed (except lost+found).
+	// Defaults to false.
+	//+optional
+	EnableFileDeletion *bool `json:"enableFileDeletion,omitempty"`
+	// AdditionalArgs allows specifying additional command-line arguments for Kopia.
+	// These arguments will be passed to Kopia restore commands during restore operations.
+	// This provides flexibility for advanced users to utilize Kopia features not directly
+	// exposed by VolSync. Use with caution as invalid arguments may cause restore failures.
+	// Security-sensitive flags like --password and --config-file are not allowed.
+	// Example: ["--ignore-permission-errors", "--parallel=8"]
+	// +kubebuilder:validation:MaxItems=20
+	// +optional
+	AdditionalArgs []string `json:"additionalArgs,omitempty"`
+
+	MoverConfig `json:",inline"`
+}
+
+// KopiaIdentityInfo provides information about available Kopia snapshot identities
+type KopiaIdentityInfo struct {
+	// Identity is the username@hostname identifier
+	Identity string `json:"identity"`
+	// SnapshotCount is the number of snapshots for this identity
+	SnapshotCount int32 `json:"snapshotCount"`
+	// LatestSnapshot is the timestamp of the most recent snapshot
+	//+optional
+	LatestSnapshot *metav1.Time `json:"latestSnapshot,omitempty"`
+}
+
+// ReplicationDestinationKopiaStatus defines status information for Kopia-based replication.
+type ReplicationDestinationKopiaStatus struct {
+	// RequestedIdentity is the username@hostname that was requested for restore
+	//+optional
+	RequestedIdentity string `json:"requestedIdentity,omitempty"`
+	// SnapshotsFound is the number of snapshots found for the requested identity
+	//+optional
+	SnapshotsFound int32 `json:"snapshotsFound,omitempty"`
+	// AvailableIdentities lists the identities available in the repository
+	//+optional
+	AvailableIdentities []KopiaIdentityInfo `json:"availableIdentities,omitempty"`
+}
+
 // ReplicationDestinationStatus defines the observed state of ReplicationDestination
 type ReplicationDestinationStatus struct {
 	// lastSyncTime is the time of the most recent successful synchronization.
@@ -299,6 +435,9 @@ type ReplicationDestinationStatus struct {
 	// used.
 	//+optional
 	External map[string]string `json:"external,omitempty"`
+	// kopia contains status information for Kopia-based replication.
+	//+optional
+	Kopia *ReplicationDestinationKopiaStatus `json:"kopia,omitempty"`
 	// conditions represent the latest available observations of the
 	// destination's state.
 	Conditions []metav1.Condition `json:"conditions,omitempty"`