job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: s3-clone
spec:
  parallelism: 1
  template:
    metadata:
      labels:
        app: cloner
    spec:
      restartPolicy: OnFailure
      containers:
        - name: clone
          image: rclone/rclone
          command:
            - rclone
            - copy
            - before:mybinder-2i2c-registry/harbor/
            - after:mybinder-2i2c-registry-2026/harbor/
            - -v
            - --stats
            - 60s
            - --stats-one-line
          volumeMounts:
            - mountPath: /config/rclone
              name: rclone
              readOnly: true
      volumes:
          - name: rclone
            secret:
              secretName: rclone

rclone.example.conf

# kubectl create secret generic rclone --from-file rclone.conf
[before]
type = s3
provider = Hetzner
access_key_id = key_id
secret_access_key = secret_id
region = nbg1
endpoint = nbg1.your-objectstorage.com

[after]
type = s3
provider = Hetzner
access_key_id = key_id
secret_access_key = secret_id
region = nbg1
endpoint = nbg1.your-objectstorage.com