Incorporate changes for restic standalone pkg

go.mod

@@ -12,6 +12,7 @@ require (
 	gomodules.xyz/go-sh v0.2.0
 	gomodules.xyz/logs v0.0.7
 	gomodules.xyz/pointer v0.1.0
+	gomodules.xyz/restic v0.0.0-20260127113541-2bdea1940793
 	gomodules.xyz/runtime v0.3.0
 	gomodules.xyz/x v0.0.17
 	k8s.io/api v0.34.3
@@ -25,7 +26,7 @@ require (
 	kmodules.xyz/offshoot-api v0.34.0
 	kmodules.xyz/prober v0.34.0
 	kubedb.dev/apimachinery v0.59.0
-	kubestash.dev/apimachinery v0.23.0
+	kubestash.dev/apimachinery v0.23.1-0.20260213123630-ee2e89dda76e
 	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/yaml v1.6.0
 	stash.appscode.dev/apimachinery v0.41.0

go.sum

@@ -780,6 +780,8 @@ gomodules.xyz/mergo v0.3.13 h1:q6cL/MMXZH/MrR2+yjSihFFq6UifXqjwaqI48B6cMEM=
 gomodules.xyz/mergo v0.3.13/go.mod h1:F/2rKC7j0URTnHUKDiTiLcGdLMhdv8jK2Za3cRTUVmc=
 gomodules.xyz/pointer v0.1.0 h1:sG2UKrYVSo6E3r4itAjXfPfe4fuXMi0KdyTHpR3vGCg=
 gomodules.xyz/pointer v0.1.0/go.mod h1:sPLsC0+yLTRecUiC5yVlyvXhZ6LAGojNCRWNNqoplvo=
+gomodules.xyz/restic v0.0.0-20260127113541-2bdea1940793 h1:dgUY5LElbKrnsn2qyGwiojiLhFwwUDndhhSRDuYcjEo=
+gomodules.xyz/restic v0.0.0-20260127113541-2bdea1940793/go.mod h1:Api8DksK5irIRJGjnxt7wSxsJ6AsSu3i97bQVRaQ5zs=
 gomodules.xyz/runtime v0.3.0 h1:Fgf3fjIE3xY/sswO73iRBeR3mundZAjlY42fQPigPR0=
 gomodules.xyz/runtime v0.3.0/go.mod h1:lJuiayVYjz8LWDwKhbDqFzUrXqr1btLbJS5/lKDz1YU=
 gomodules.xyz/sets v0.2.0/go.mod h1:jKgNp01/iDs+svOWXaPk5cKP3VXy0mWUoTF/ore+aMc=
@@ -910,8 +912,8 @@ kubeops.dev/petset v0.0.15 h1:iwTRFAp0RNw0A87sw2c97UZ6WIA9H/nhJBpDhXLa7fk=
 kubeops.dev/petset v0.0.15/go.mod h1:sw96WiXfzhpmKpXj4a5AdmEHs0Bx4QMhf+iW15zY4Gg=
 kubeops.dev/sidekick v0.0.12 h1:pmUjQLZDKxgREiM6z0PogLR1aDbgvkE9jRjbxG6dEt0=
 kubeops.dev/sidekick v0.0.12/go.mod h1:RU7QH3E8DOLw15rBYlOOJSyczuwAnVVtYyZjJb00UB8=
-kubestash.dev/apimachinery v0.23.0 h1:EB6w+lB0ACgnqIjtbyvRN5hVEmB8dVHSaN7SJCACHCY=
-kubestash.dev/apimachinery v0.23.0/go.mod h1:zJEjHjd/nYcXFSW+RfGbLxZMJK41IOWjQGosoAWZDRg=
+kubestash.dev/apimachinery v0.23.1-0.20260213123630-ee2e89dda76e h1:DlHm4ofKmuFf+QV1sj2S6jqrwPe5JTVgior7Wgh4CnQ=
+kubestash.dev/apimachinery v0.23.1-0.20260213123630-ee2e89dda76e/go.mod h1:urS7nlwj1kXAbZ5wfmHlYO0RvFDoO4J3KSpXWjvjKw4=
 open-cluster-management.io/api v1.1.1-0.20251222023835-510285203ee6 h1:mfcUKaSOYVDLzuontUOcasesbU9whNnvgrA0qf9trKs=
 open-cluster-management.io/api v1.1.1-0.20251222023835-510285203ee6/go.mod h1:YcmA6SpGEekIMxdoeVIIyOaBhMA6ImWRLXP4g8n8T+4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

pkg/add_key.go

@@ -23,11 +23,12 @@ import (
 
 	"github.com/spf13/cobra"
 	"gomodules.xyz/flags"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/klog/v2"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	v1 "kmodules.xyz/offshoot-api/api/v1"
-	"kubestash.dev/apimachinery/pkg/restic"
+	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 )
 
 func NewCmdAddKey(opt *keyOptions) *cobra.Command {
@@ -130,13 +131,17 @@ func (opt *keyOptions) addResticKeyViaDocker() error {
 		}
 	}()
 
+	encryptSecret, err := getEncryptionSecret(klient, opt.repo.Spec.EncryptionSecret)
+	if err != nil {
+		return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+	}
+
 	setupOptions := &restic.SetupOptions{
-		Client: klient,
 		Backends: []*restic.Backend{
 			{
+				ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &opt.repo.Spec.StorageRef),
 				Repository:       opt.repo.Name,
-				BackupStorage:    &opt.repo.Spec.StorageRef,
-				EncryptionSecret: opt.repo.Spec.EncryptionSecret,
+				EncryptionSecret: encryptSecret,
 			},
 		},
 		ScratchDir: ScratchDir,

pkg/common/helpers.go

@@ -54,9 +54,9 @@ func NewRuntimeClient(cfg *restclient.Config) (client.Client, error) {
 	})
 }
 
-func (opt *Options) GetSnapshot(ref kmapi.ObjectReference) (*storageapi.Snapshot, error) {
+func (opt *Options) GetSnapshot(kbClient client.Client, ref kmapi.ObjectReference) (*storageapi.Snapshot, error) {
 	snap := &storageapi.Snapshot{}
-	if err := opt.Client.Get(context.Background(), ref.ObjectKey(), snap); err != nil {
+	if err := kbClient.Get(context.Background(), ref.ObjectKey(), snap); err != nil {
 		return nil, err
 	}
 	return snap, nil

pkg/common/types.go

@@ -17,14 +17,13 @@ limitations under the License.
 package common
 
 import (
+	"gomodules.xyz/restic"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/rest"
 	"kubestash.dev/apimachinery/apis"
 	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
-	"kubestash.dev/apimachinery/pkg/restic"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 type ResourceItems struct {
@@ -51,7 +50,6 @@ type RestoredItemStatus struct {
 
 type Options struct {
 	Config          *rest.Config
-	Client          client.Client
 	DataDir         string
 	DryRunDir       string
 	MaxIterations   uint

pkg/download.go

@@ -26,6 +26,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/rest"
@@ -34,7 +35,6 @@ import (
 	v1 "kmodules.xyz/offshoot-api/api/v1"
 	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 	"kubestash.dev/apimachinery/pkg"
-	"kubestash.dev/apimachinery/pkg/restic"
 )
 
 type downloadOptions struct {
@@ -139,14 +139,18 @@ func NewCmdDownload(clientGetter genericclioptions.RESTClientGetter) *cobra.Comm
 				}
 			}()
 
+			encryptSecret, err := getEncryptionSecret(klient, repository.Spec.EncryptionSecret)
+			if err != nil {
+				return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+			}
+
 			setupOptions := &restic.SetupOptions{
-				Client:     klient,
 				ScratchDir: ScratchDir,
 				Backends: []*restic.Backend{
 					{
+						ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &repository.Spec.StorageRef),
 						Repository:       repository.Name,
-						BackupStorage:    &repository.Spec.StorageRef,
-						EncryptionSecret: repository.Spec.EncryptionSecret,
+						EncryptionSecret: encryptSecret,
 					},
 				},
 			}

pkg/key.go

@@ -25,13 +25,13 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
 	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 	"kubestash.dev/apimachinery/pkg"
-	"kubestash.dev/apimachinery/pkg/restic"
 )
 
 type keyOptions struct {

pkg/list_key.go

@@ -23,11 +23,12 @@ import (
 
 	"github.com/spf13/cobra"
 	"gomodules.xyz/flags"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/klog/v2"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	v1 "kmodules.xyz/offshoot-api/api/v1"
-	"kubestash.dev/apimachinery/pkg/restic"
+	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 )
 
 func NewCmdListKey(opt *keyOptions) *cobra.Command {
@@ -119,15 +120,19 @@ func (opt *keyOptions) listResticKeysViaDocker() error {
 		}
 	}()
 
+	encryptionSecret, err := getEncryptionSecret(klient, opt.repo.Spec.EncryptionSecret)
+	if err != nil {
+		return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+	}
+
 	for _, path := range opt.paths {
 		setupOptions := &restic.SetupOptions{
-			Client: klient,
 			Backends: []*restic.Backend{
 				{
+					ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &opt.repo.Spec.StorageRef),
 					Directory:        filepath.Join(opt.repo.Spec.Path, path),
 					Repository:       opt.repo.Name,
-					BackupStorage:    &opt.repo.Spec.StorageRef,
-					EncryptionSecret: opt.repo.Spec.EncryptionSecret,
+					EncryptionSecret: encryptionSecret,
 				},
 			},
 			ScratchDir: ScratchDir,

pkg/remove_key.go

@@ -24,11 +24,12 @@ import (
 
 	"github.com/spf13/cobra"
 	"gomodules.xyz/flags"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/klog/v2"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	v1 "kmodules.xyz/offshoot-api/api/v1"
-	"kubestash.dev/apimachinery/pkg/restic"
+	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 )
 
 func NewCmdRemoveKey(opt *keyOptions) *cobra.Command {
@@ -136,13 +137,17 @@ func (opt *keyOptions) removeResticKeyViaDocker() error {
 		}
 	}()
 
+	encryptionSecret, err := getEncryptionSecret(klient, opt.repo.Spec.EncryptionSecret)
+	if err != nil {
+		return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+	}
+
 	setupOptions := &restic.SetupOptions{
-		Client: klient,
 		Backends: []*restic.Backend{
 			{
+				ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &opt.repo.Spec.StorageRef),
 				Repository:       opt.repo.Name,
-				BackupStorage:    &opt.repo.Spec.StorageRef,
-				EncryptionSecret: opt.repo.Spec.EncryptionSecret,
+				EncryptionSecret: encryptionSecret,
 			},
 		},
 		ScratchDir: ScratchDir,

pkg/restore.go

@@ -27,12 +27,13 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/klog/v2"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	v1 "kmodules.xyz/offshoot-api/api/v1"
-	"kubestash.dev/apimachinery/pkg/restic"
+	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 	"kubestash.dev/cli/pkg/common"
 	"kubestash.dev/cli/pkg/common/dump"
 )
@@ -63,20 +64,18 @@ func NewCmdManifestRestore(clientGetter genericclioptions.RESTClientGetter) *cob
 				return err
 			}
 
-			opt.Client, err = common.NewRuntimeClient(opt.Config)
+			klient, err = common.NewRuntimeClient(opt.Config)
 			if err != nil {
 				return fmt.Errorf("failed to get kubernetes client: %w", err)
 			}
 
-			klient = opt.Client
-
 			srcNamespace = opt.Namespace
 
 			if err != nil {
 				return err
 			}
 
-			opt.Snapshot, err = opt.GetSnapshot(kmapi.ObjectReference{
+			opt.Snapshot, err = opt.GetSnapshot(klient, kmapi.ObjectReference{
 				Name:      opt.SnapshotName,
 				Namespace: srcNamespace,
 			})
@@ -161,14 +160,18 @@ func NewCmdManifestRestore(clientGetter genericclioptions.RESTClientGetter) *cob
 				return nil
 			}
 
+			encryptSecret, err := getEncryptionSecret(klient, repository.Spec.EncryptionSecret)
+			if err != nil {
+				return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+			}
+
 			opt.SetupOptions = restic.SetupOptions{
-				Client:     opt.Client,
 				ScratchDir: ScratchDir,
 				Backends: []*restic.Backend{
 					{
+						ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &repository.Spec.StorageRef),
 						Repository:       repository.Name,
-						BackupStorage:    &repository.Spec.StorageRef,
-						EncryptionSecret: repository.Spec.EncryptionSecret,
+						EncryptionSecret: encryptSecret,
 					},
 				},
 			}

pkg/unlock.go

@@ -25,6 +25,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/rest"
@@ -33,7 +34,6 @@ import (
 	v1 "kmodules.xyz/offshoot-api/api/v1"
 	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 	"kubestash.dev/apimachinery/pkg"
-	"kubestash.dev/apimachinery/pkg/restic"
 )
 
 type unlockOptions struct {
@@ -142,19 +142,22 @@ func (opt *unlockOptions) unlockRepositoryViaPod(pod *core.Pod) error {
 }
 
 func (opt *unlockOptions) unlockRepositoryViaDocker() error {
+	encryptSecret, err := getEncryptionSecret(klient, opt.repo.Spec.EncryptionSecret)
+	if err != nil {
+		return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+	}
+
 	setupOptions := &restic.SetupOptions{
-		Client: klient,
 		Backends: []*restic.Backend{
 			{
+				ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &opt.repo.Spec.StorageRef),
 				Repository:       opt.repo.Name,
-				BackupStorage:    &opt.repo.Spec.StorageRef,
-				EncryptionSecret: opt.repo.Spec.EncryptionSecret,
+				EncryptionSecret: encryptSecret,
 			},
 		},
 	}
 
 	// apply nice, ionice settings from env
-	var err error
 	setupOptions.Nice, err = v1.NiceSettingsFromEnv()
 	if err != nil {
 		return fmt.Errorf("failed to set nice settings: %w", err)

pkg/update_key.go

@@ -22,11 +22,12 @@ import (
 	"path/filepath"
 
 	"github.com/spf13/cobra"
+	"gomodules.xyz/restic"
 	core "k8s.io/api/core/v1"
 	"k8s.io/klog/v2"
 	kmapi "kmodules.xyz/client-go/api/v1"
 	v1 "kmodules.xyz/offshoot-api/api/v1"
-	"kubestash.dev/apimachinery/pkg/restic"
+	storageapi "kubestash.dev/apimachinery/apis/storage/v1alpha1"
 )
 
 func NewCmdUpdateKey(opt *keyOptions) *cobra.Command {
@@ -125,15 +126,19 @@ func (opt *keyOptions) updateResticKeyViaDocker() error {
 		}
 	}()
 
+	encryptionSecret, err := getEncryptionSecret(klient, opt.repo.Spec.EncryptionSecret)
+	if err != nil {
+		return fmt.Errorf("failed to get encryption secret. Reason: %w", err)
+	}
+
 	for _, path := range opt.paths {
 		setupOptions := &restic.SetupOptions{
-			Client: klient,
 			Backends: []*restic.Backend{
 				{
+					ConfigResolver:   storageapi.NewBackupStorageResolver(klient, &opt.repo.Spec.StorageRef),
 					Directory:        filepath.Join(opt.repo.Spec.Path, path),
 					Repository:       opt.repo.Name,
-					BackupStorage:    &opt.repo.Spec.StorageRef,
-					EncryptionSecret: opt.repo.Spec.EncryptionSecret,
+					EncryptionSecret: encryptionSecret,
 				},
 			},
 			ScratchDir: ScratchDir,

pkg/util.go

@@ -215,6 +215,19 @@ func setBackupConfigurationPausedField(value bool, name string) error {
 	return err
 }
 
+func getEncryptionSecret(kbClient client.Client, secretRef *kmapi.ObjectReference) (*core.Secret, error) {
+	secret := &core.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: secretRef.Namespace,
+			Name:      secretRef.Name,
+		},
+	}
+	if err := kbClient.Get(context.Background(), client.ObjectKeyFromObject(secret), secret); err != nil {
+		return nil, err
+	}
+	return secret, nil
+}
+
 func createTable(data [][]string) error {
 	table := tablewriter.NewWriter(os.Stdout)
 	table.SetHeader([]string{"Item", "Reason"})