titan-iac/services/comms/mas-db-ensure-job.yaml

# services/comms/mas-db-ensure-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: mas-db-ensure-16
  namespace: comms
spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 600
  template:
    spec:
      serviceAccountName: mas-db-ensure
      restartPolicy: Never
      containers:
        - name: ensure
          image: bitnami/kubectl:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu
              trap 'echo "mas-db-ensure failed"; sleep 300' ERR
              umask 077
              safe_pass() {
                head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
              }

              EXISTING_B64="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' 2>/dev/null || true)"
              if [ -n "${EXISTING_B64}" ]; then
                MAS_PASS="$(printf '%s' "${EXISTING_B64}" | base64 -d)"
                if printf '%s' "${MAS_PASS}" | grep -Eq '[^A-Za-z0-9_-]'; then
                  MAS_PASS="$(safe_pass)"
                  MAS_B64="$(printf '%s' "${MAS_PASS}" | base64 | tr -d '\n')"
                  payload="$(printf '{"data":{"password":"%s"}}' "${MAS_B64}")"
                  kubectl -n comms patch secret mas-db --type=merge -p "${payload}" >/dev/null
                fi
              else
                MAS_PASS="$(safe_pass)"
                kubectl -n comms create secret generic mas-db --from-literal=password="${MAS_PASS}" >/dev/null
              fi

              POD_NAME="$(kubectl -n postgres get pods -l app=postgres -o jsonpath='{.items[0].metadata.name}')"
              if [ -z "${POD_NAME}" ]; then
                echo "postgres pod not found" >&2
                exit 1
              fi

              MAS_PASS_SQL="$(printf '%s' "${MAS_PASS}" | sed "s/'/''/g")"
              kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
                -c "CREATE ROLE mas LOGIN PASSWORD '${MAS_PASS_SQL}';" || true
              kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
                -c "ALTER ROLE mas WITH PASSWORD '${MAS_PASS_SQL}';"
              kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
                -c "CREATE DATABASE mas OWNER mas;" || true
              kubectl -n postgres exec -i "${POD_NAME}" -- /bin/sh -c \
                "PGPASSWORD='${MAS_PASS_SQL}' psql -U mas -d mas -c 'select 1;'"