titan-iac/services/bstein-dev-home/oneoffs/migrations/portal-migrate-job.yaml

# services/bstein-dev-home/oneoffs/migrations/portal-migrate-job.yaml
# One-off job for bstein-dev-home/bstein-dev-home-portal-migrate-36.
# Purpose: bstein dev home portal migrate 36 (see container args/env in this file).
# Run by setting spec.suspend to false, reconcile, then set it back to true.
# Safe to delete the finished Job/pod; it should not run continuously.
apiVersion: batch/v1
kind: Job
metadata:
  name: bstein-dev-home-portal-migrate-36
  namespace: bstein-dev-home
  annotations:
    kustomize.toolkit.fluxcd.io/force: "true"
spec:
  suspend: true
  backoffLimit: 1
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app: bstein-dev-home-portal-migrate
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "bstein-dev-home"
        vault.hashicorp.com/agent-inject-secret-portal-env.sh: "kv/data/atlas/portal/atlas-portal-db"
        vault.hashicorp.com/agent-inject-template-portal-env.sh: |
          {{ with secret "kv/data/atlas/portal/atlas-portal-db" }}
          export PORTAL_DATABASE_URL="{{ .Data.data.PORTAL_DATABASE_URL }}"
          {{ end }}
    spec:
      serviceAccountName: bstein-dev-home
      restartPolicy: Never
      nodeSelector:
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      imagePullSecrets:
        - name: harbor-regcred
      containers:
        - name: migrate
          image: registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-95
          imagePullPolicy: Always
          command: ["/bin/sh", "-c"]
          args:
            - >-
              . /vault/secrets/portal-env.sh
              && exec python -m atlas_portal.migrate
          env:
            - name: PORTAL_RUN_MIGRATIONS
              value: "true"