This repository has been archived by the owner on Dec 21, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* No-op migration test capability * newlines * bump minor * update boilerplate * nindent * resources in earlier wave * shareProcessNamespace * Add cloudsql sleep * Sleep for 15s * fix hostname * liquibase kill cloudsql proxy * Exit instead of return * Don't retry so many times * the other spec * Control no-op and failure behavior via values * Bring in the new liquibase.properties * Merge branch 'master' of github.com:broadinstitute/terra-helm into DDO-1292-liquibase-presync-job * clean up * line continuation * Use official google image * Sleep forever so I can see the pod * Fix version, normal sleep * No exec * alpine for sh * labels * delete on succeeded * Different syntax * No extra deletion policy * prefix with rawls * New readme * Put rbac behind flag, disable by default * spell the deletion policy field correctly :( * enable rbac * reuse rbac, move it to earlier wave * quotes * secretdef in same wave
- Loading branch information
1 parent
d143f91
commit 1bee360
Showing
8 changed files
with
157 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| {{- if .Values.migration.enabled }} | ||
| {{- $imageTag := .Values.migration.imageTag | default .Values.global.applicationVersion -}} | ||
| apiVersion: batch/v1 | ||
| kind: Job | ||
| metadata: | ||
| name: rawls-liquibase-migration | ||
| annotations: | ||
| argocd.argoproj.io/hook: Sync | ||
| argocd.argoproj.io/hook-delete-policy: BeforeHookCreation | ||
| argocd.argoproj.io/sync-wave: "{{ .Values.migration.syncWave }}" | ||
| labels: {{- include "rawls.labels" . | nindent 4 }} | ||
| spec: | ||
| backoffLimit: 2 | ||
| template: | ||
| metadata: | ||
| name: rawls-liquibase-migration | ||
| labels: {{- include "rawls.labels" . | nindent 8 }} | ||
| spec: | ||
| # Allow migration-liquibase to kill migration-sqlproxy's process | ||
| shareProcessNamespace: true | ||
| restartPolicy: Never | ||
| serviceAccountName: {{ .Values.migration.serviceAccount }} | ||
| hostAliases: | ||
| - ip: 127.0.0.1 | ||
| hostnames: | ||
| - sqlproxy | ||
| volumes: | ||
| - name: app-ctmpls | ||
| secret: | ||
| secretName: {{ .Values.migration.secretPrefix }}-app-ctmpls | ||
| - name: sqlproxy-ctmpls | ||
| secret: | ||
| secretName: {{ .Values.migration.secretPrefix }}-sqlproxy-ctmpls | ||
| containers: | ||
| - name: rawls-migration-liquibase | ||
| image: "gcr.io/broad-dsp-gcr-public/rawls:{{ $imageTag }}" | ||
| command: ['bash', '-c'] | ||
| # Sleep for 15s to allow CloudSQL proxy time to start up. See DDO-1284 / BT-296 | ||
| # The `find /rawls -name 'rawls*.jar'` is from Rawls's own Dockerfile CMD | ||
| # References templated liquibase.properties, see https://docs.google.com/document/d/19ethQWyH29H-jUWwgFoCxKfjmzcG-NCmSgXNAUJAYaU/edit# | ||
| args: | ||
| - |- | ||
| sleep 15s && \ | ||
| java -cp $(find /rawls -name 'rawls*.jar') liquibase.integration.commandline.Main \ | ||
| --defaultsFile='/etc/liquibase.properties' \ | ||
| --classpath="$(find /rawls -name 'rawls*.jar')" \ | ||
| --username="$DB_USERNAME" \ | ||
| --password="$DB_PASSWORD" \ | ||
| {{ .Values.migration.dryRun | ternary "updateSQL" "update" }}; \ | ||
| EXIT={{ .Values.migration.failBasedOnLiquibase | ternary "$?" "0" }}; \ | ||
| pkill -SIGTERM cloud_sql_proxy; \ | ||
| exit $EXIT | ||
| env: | ||
| - name: DB_USERNAME | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: rawls-sql-secrets | ||
| key: db-username | ||
| - name: DB_PASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: rawls-sql-secrets | ||
| key: db-password | ||
| volumeMounts: | ||
| - mountPath: /etc/liquibase.properties | ||
| subPath: liquibase.properties | ||
| name: app-ctmpls | ||
| readOnly: true | ||
| - name: rawls-migration-sqlproxy | ||
| # alpine provides `sh` | ||
| image: gcr.io/cloudsql-docker/gce-proxy:1.23.0-alpine | ||
| envFrom: | ||
| - secretRef: | ||
| name: {{ .Values.migration.secretPrefix }}-sqlproxy-env | ||
| volumeMounts: | ||
| - mountPath: /etc/sqlproxy-service-account.json | ||
| subPath: sqlproxy-service-account.json | ||
| name: sqlproxy-ctmpls | ||
| readOnly: true | ||
| command: ['sh', '-c'] | ||
| args: | ||
| - |- | ||
| /cloud_sql_proxy ${CLOUDSQL_LOGGING:-"-verbose"} \ | ||
| -max_connections=${CLOUDSQL_MAXCONNS:-0} \ | ||
| -instances="${CLOUDSQL_CONNECTION_LIST:-${GOOGLE_PROJECT}:${CLOUDSQL_ZONE}:${CLOUDSQL_INSTANCE}=tcp:0.0.0.0:${PORT:-3306}}" \ | ||
| -credential_file=${CLOUDSQL_CREDENTIAL_FILE:-"/etc/sqlproxy-service-account.json"} | ||
| {{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| {{- if .Values.migration.enabled }} | ||
| apiVersion: secrets-manager.tuenti.io/v1alpha1 | ||
| kind: SecretDefinition | ||
| metadata: | ||
| name: rawls-migration-secretdef | ||
| labels: {{- include "rawls.labels" . | nindent 4 }} | ||
| annotations: | ||
| argocd.argoproj.io/sync-wave: "{{ .Values.migration.syncWave }}" | ||
| spec: | ||
| name: rawls-sql-secrets | ||
| keysMap: | ||
| db-username: | ||
| key: {{ .Values.vault.migration.dbUsernameKey }} | ||
| path: {{ required "A valid vault.migration.path is required" .Values.vault.migration.path }} | ||
| encoding: text | ||
| db-password: | ||
| key: {{ .Values.vault.migration.dbPasswordKey }} | ||
| path: {{ required "A valid vault.migration.path is required" .Values.vault.migration.path }} | ||
| encoding: text | ||
| {{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters