Planning a backup system using postgress, chef and vault

Question

As the title says I am working on planning a way to backup postgres using chef and vault. Idea is that we already encrypt the backups from postgres using a key (random binary string) and we would like to keep that going. We would like to store that string in Hashicorp Vault. My issue is I am not sure how to get it so that the key is made into a file then a few scripts are run. Then comes the issue that a more senior person wants these backups to only be weekly not every time the cookbook runs which if memory serves me right is every 24 hours.

I am not sure the best way to access the secrets in Vault from a chef cookbook. Nor have it run weekly.

I would have preferred to do this with cron jobs and bash scripts, but sadly that is not an option.

Answer 1

First chef runs as often as you configure it to do.

Second Chef is a configuration management system and not a crontab or an orchestration system.

Use chef to configure cron (that can not be not an option, try to find out why this is not considered) for your backup using consul-template to retrieve the secret from vault. Don't use Chef to run the backups because of the caveats you already mention.

However if you really want to shoot yourself in the foot, just add a guard on your backup command like this (604800 seconds is roughly 7 days):

not_if { (Time.now() - File.mtime("/path/to/your/backup/file.tgz") < 604800 }