titan-iac/services/comms/mas-db-ensure-job.yaml

# services/comms/mas-db-ensure-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: mas-db-ensure-8
  namespace: comms
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 600
  template:
    spec:
      serviceAccountName: mas-db-ensure
      restartPolicy: OnFailure
      containers:
        - name: ensure
          image: bitnami/kubectl:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu
              umask 077
              if kubectl -n comms get secret mas-db >/dev/null 2>&1; then
                MAS_PASS="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' | base64 -d)"
              else
                MAS_PASS="$(head -c 32 /dev/urandom | base64 | tr -d '\n')"
                kubectl -n comms create secret generic mas-db --from-literal=password="${MAS_PASS}" >/dev/null
              fi

              POD_NAME="$(kubectl -n postgres get pods -l app=postgres -o jsonpath='{.items[0].metadata.name}')"
              if [ -z "${POD_NAME}" ]; then
                echo "postgres pod not found" >&2
                exit 1
              fi

              kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres -v ON_ERROR_STOP=1 -v mas_pass="${MAS_PASS}" <<'SQL'
              DO $$
              BEGIN
                IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'mas') THEN
                  EXECUTE format('CREATE ROLE mas LOGIN PASSWORD %L', :mas_pass);
                ELSE
                  EXECUTE format('ALTER ROLE mas WITH PASSWORD %L', :mas_pass);
                END IF;
              END
              $$;
              DO $$
              BEGIN
                IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'mas') THEN
                  CREATE DATABASE mas OWNER mas;
                END IF;
              END
              $$;
              SQL