small changes

k8s/README.md

@@ -6,23 +6,24 @@ Kubernetes-focused shell scripts intended for cronjobs and operational utilities
 
 ### `automated-nfs-backup.sh`
 
-Backs up each top-level folder found in `NFS_SOURCE_PATH` into an encrypted `.7z` archive, with optional Kubernetes workload quiescing when a folder name exactly matches a namespace name.
+Backs up each top-level folder found in `NFS_SOURCE_PATH` into a single encrypted `.7z` archive per run, with optional Kubernetes workload quiescing when a folder name exactly matches a namespace name.
 
 Behavior:
 - Exact folder-to-namespace mapping only.
 - Unmapped folder: backup still runs, Kubernetes scale actions are skipped.
-- Mapped folder: saves replicas, scales selected workloads down, waits, runs backup, restores replicas, waits again.
+- Mapped folder: saves replicas, scales selected workloads down, waits, adds that folder to the shared run archive, restores replicas, waits again.
 - Scale-down issues are warnings by policy (backup still runs).
 - Restore issues are warnings by policy (run can still complete successfully).
+- Cleanup can delete the last `N` archives ordered by date (oldest side), while keeping at least one archive.
 
 ## Environment Variables
 
 Required:
 - `NFS_SOURCE_PATH`: Root path containing folders to back up.
 - `BACKUP_OUTPUT_PATH`: Destination path for generated `.7z` archives.
-- `BACKUP_PASSWORD`: Password used for 7z encryption.
 
 Optional:
+- `BACKUP_PASSWORD` (default: empty): When set, archive uses password protection; when empty, archive is not encrypted.
 - `KUBECTL_BIN` (default: `kubectl`)
 - `KUBE_CONTEXT` (default: empty)
 - `WORKLOAD_KINDS` (default: `deployment,statefulset,replicaset,replicationcontroller`)
@@ -30,7 +31,7 @@ Optional:
 - `ARCHIVE_TS_FORMAT` (default: `%Y%m%d_%H%M%S`)
 - `SEVENZ_METHOD` (default: `lzma2`)
 - `SEVENZ_LEVEL` (default: `9`)
-- `SEVENZ_HEADER_ENCRYPT` (default: `on`)
+- `SEVENZ_HEADER_ENCRYPT` (default: `on`, only applied when `BACKUP_PASSWORD` is set)
 - `SEVENZ_THREADS` (default: `on`)
 - `SCALE_TIMEOUT_SECONDS` (default: `600`)
 - `SCALE_RETRY_COUNT` (default: `3`)
@@ -41,6 +42,7 @@ Optional:
 - `NOTIFY_FAILURE_URL` (default: empty, disabled)
 - `NOTIFY_TITLE` (default: `Kubernetes`)
 - `NOTIFY_ASSET` (default: `kube config`)
+- `CLEANUP_DELETE_COUNT` (default: `5`)
 
 Notification payload (success and failure):
 
@@ -67,6 +69,7 @@ Notification payload (success and failure):
 - Restore warnings/timeouts: logged and counted, script does not fail solely because of restore warnings.
 - If `NOTIFY_SUCCESS_URL` is set, success notification is sent at the end of a successful run.
 - If `NOTIFY_FAILURE_URL` is set, failure notification is sent when backup failures are detected.
+- On successful runs, cleanup removes the last `CLEANUP_DELETE_COUNT` archives by date ordering (oldest side), without deleting the final remaining archive.
 - Final summary always logs:
   - `processed`
   - `mapped`