maintenance: drop completed wait-bound oneoffs
This commit is contained in:
jenkins
parent
37ca992610
commit
72ec2c2979
@ -5,14 +5,6 @@ resources:
|
||||
- namespace.yaml
|
||||
- serviceaccount.yaml
|
||||
- pvc.yaml
|
||||
- oneoffs/veles-feedback-acl-ensure-job.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
configMapGenerator:
|
||||
- name: veles-feedback-acl-ensure-script
|
||||
namespace: gitea
|
||||
files:
|
||||
- scripts/veles_feedback_acl_ensure.sh
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
@ -1,54 +0,0 @@
|
||||
# services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
|
||||
# One-off job for gitea/veles-feedback-acl-ensure-4.
|
||||
# Purpose: keep Veles feedback anonymously readable while limiting write access
|
||||
# to testers/admins and avoiding source-code repository access.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: veles-feedback-acl-ensure-4
|
||||
namespace: gitea
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
suspend: true
|
||||
backoffLimit: 0
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
vault.hashicorp.com/agent-inject: "true"
|
||||
vault.hashicorp.com/agent-pre-populate-only: "true"
|
||||
vault.hashicorp.com/role: "gitea"
|
||||
vault.hashicorp.com/agent-inject-secret-gitea-db-secret__password: "kv/data/atlas/gitea/gitea-db-secret"
|
||||
vault.hashicorp.com/agent-inject-template-gitea-db-secret__password: |
|
||||
{{ with secret "kv/data/atlas/gitea/gitea-db-secret" }}
|
||||
{{ .Data.data.password }}
|
||||
{{ end }}
|
||||
spec:
|
||||
serviceAccountName: gitea-vault
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: veles-feedback-acl-ensure-script
|
||||
configMap:
|
||||
name: veles-feedback-acl-ensure-script
|
||||
defaultMode: 0555
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/arch
|
||||
operator: In
|
||||
values: ["arm64"]
|
||||
- key: hardware
|
||||
operator: In
|
||||
values: ["rpi5"]
|
||||
- key: node-role.kubernetes.io/worker
|
||||
operator: Exists
|
||||
containers:
|
||||
- name: apply
|
||||
image: postgres:15
|
||||
command: ["/bin/sh"]
|
||||
args: ["/scripts/veles_feedback_acl_ensure.sh"]
|
||||
volumeMounts:
|
||||
- name: veles-feedback-acl-ensure-script
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
@ -1,122 +0,0 @@
|
||||
#!/usr/bin/env sh
|
||||
set -eu
|
||||
|
||||
db_host="${GITEA_DB_HOST:-postgres-service.postgres.svc.cluster.local}"
|
||||
db_port="${GITEA_DB_PORT:-5432}"
|
||||
db_name="${GITEA_DB_NAME:-gitea}"
|
||||
db_user="${GITEA_DB_USER:-gitea}"
|
||||
org_name="${VELES_GITEA_ORG:-veles-alpha}"
|
||||
repo_name="${VELES_GITEA_FEEDBACK_REPO:-feedback}"
|
||||
team_name="${VELES_GITEA_TESTER_TEAM:-testers}"
|
||||
|
||||
if [ ! -r /vault/secrets/gitea-db-secret__password ]; then
|
||||
echo "Missing readable Vault secret file: /vault/secrets/gitea-db-secret__password" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PGPASSWORD
|
||||
PGPASSWORD="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"
|
||||
|
||||
psql_base="psql -h ${db_host} -p ${db_port} -U ${db_user} -d ${db_name} -v ON_ERROR_STOP=1 -P pager=off"
|
||||
|
||||
${psql_base} \
|
||||
-v org_name="${org_name}" \
|
||||
-v repo_name="${repo_name}" \
|
||||
-v team_name="${team_name}" <<'SQL'
|
||||
begin;
|
||||
|
||||
create temporary table veles_acl_ids on commit drop as
|
||||
select
|
||||
org.id as org_id,
|
||||
repo.id as repo_id,
|
||||
team.id as team_id
|
||||
from gitea."user" org
|
||||
join gitea.repository repo
|
||||
on repo.owner_id = org.id
|
||||
join gitea.team team
|
||||
on team.org_id = org.id
|
||||
where org.lower_name = lower(:'org_name')
|
||||
and org.type = 1
|
||||
and repo.lower_name = lower(:'repo_name')
|
||||
and team.lower_name = lower(:'team_name');
|
||||
|
||||
do $$
|
||||
begin
|
||||
if (select count(*) from veles_acl_ids) != 1 then
|
||||
raise exception 'Expected one veles feedback ACL target, found %', (select count(*) from veles_acl_ids);
|
||||
end if;
|
||||
end $$;
|
||||
|
||||
update gitea.team team
|
||||
set authorize = 1,
|
||||
includes_all_repositories = false,
|
||||
can_create_org_repo = false
|
||||
from veles_acl_ids ids
|
||||
where team.id = ids.team_id;
|
||||
|
||||
update gitea."user" org
|
||||
set visibility = 0
|
||||
from veles_acl_ids ids
|
||||
where org.id = ids.org_id;
|
||||
|
||||
update gitea.repository repo
|
||||
set is_private = false
|
||||
from veles_acl_ids ids
|
||||
where repo.id = ids.repo_id;
|
||||
|
||||
delete from gitea.repo_unit unit
|
||||
using veles_acl_ids ids
|
||||
where unit.repo_id = ids.repo_id
|
||||
and unit.type in (1, 3, 4, 5, 6, 7, 8, 9, 10);
|
||||
|
||||
insert into gitea.repo_unit (repo_id, type, config, created_unix, everyone_access_mode)
|
||||
select
|
||||
ids.repo_id,
|
||||
2,
|
||||
'{"EnableTimetracker":false,"AllowOnlyContributorsToTrackTime":true,"EnableDependencies":true}',
|
||||
extract(epoch from now())::bigint,
|
||||
0
|
||||
from veles_acl_ids ids
|
||||
where not exists (
|
||||
select 1
|
||||
from gitea.repo_unit existing
|
||||
where existing.repo_id = ids.repo_id
|
||||
and existing.type = 2
|
||||
);
|
||||
|
||||
insert into gitea.team_repo (org_id, team_id, repo_id)
|
||||
select ids.org_id, ids.team_id, ids.repo_id
|
||||
from veles_acl_ids ids
|
||||
where not exists (
|
||||
select 1
|
||||
from gitea.team_repo existing
|
||||
where existing.team_id = ids.team_id
|
||||
and existing.repo_id = ids.repo_id
|
||||
);
|
||||
|
||||
delete from gitea.team_unit unit
|
||||
using veles_acl_ids ids
|
||||
where unit.team_id = ids.team_id
|
||||
and unit.type in (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
|
||||
|
||||
insert into gitea.team_unit (org_id, team_id, type, access_mode)
|
||||
select ids.org_id, ids.team_id, desired.type, desired.access_mode
|
||||
from veles_acl_ids ids
|
||||
cross join (
|
||||
values
|
||||
(1, 0),
|
||||
(2, 2),
|
||||
(3, 0),
|
||||
(4, 0),
|
||||
(5, 0),
|
||||
(6, 0),
|
||||
(7, 0),
|
||||
(8, 0),
|
||||
(9, 0),
|
||||
(10, 0)
|
||||
) as desired(type, access_mode);
|
||||
|
||||
commit;
|
||||
SQL
|
||||
|
||||
echo "Veles feedback Gitea ACL ready"
|
||||
@ -13,7 +13,6 @@ resources:
|
||||
- unbound-configmap.yaml
|
||||
- serverstransport.yaml
|
||||
- ingressroute.yaml
|
||||
- oneoffs/mailu-sync-job.yaml
|
||||
- mailu-sync-cronjob.yaml
|
||||
- front-lb.yaml
|
||||
|
||||
|
||||
@ -1,103 +0,0 @@
|
||||
# services/mailu/oneoffs/mailu-sync-job.yaml
|
||||
# One-off job for mailu-mailserver/mailu-sync-9.
|
||||
# Purpose: mailu sync 9 (see container args/env in this file).
|
||||
# Run by setting spec.suspend to false, reconcile, then set it back to true.
|
||||
# Safe to delete the finished Job/pod; it should not run continuously.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: mailu-sync-9
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
suspend: true
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
vault.hashicorp.com/agent-inject: "true"
|
||||
vault.hashicorp.com/agent-pre-populate-only: "true"
|
||||
vault.hashicorp.com/role: "mailu-mailserver"
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.database }}{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-db-secret__username: "kv/data/atlas/mailu/mailu-db-secret"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-db-secret__username: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.username }}{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-db-secret__password: "kv/data/atlas/mailu/mailu-db-secret"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-db-secret__password: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.password }}{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-sync-credentials__client-id: "kv/data/atlas/mailu/mailu-sync-credentials"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-sync-credentials__client-id: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-id" }}{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-sync-credentials__client-secret: "kv/data/atlas/mailu/mailu-sync-credentials"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-sync-credentials__client-secret: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-secret" }}{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-mailu-initial-account-secret__password: "kv/data/atlas/mailu/mailu-initial-account-secret"
|
||||
vault.hashicorp.com/agent-inject-template-mailu-initial-account-secret__password: |
|
||||
{{- with secret "kv/data/atlas/mailu/mailu-initial-account-secret" -}}{{ .Data.data.password }}{{- end -}}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/worker
|
||||
operator: Exists
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/arch
|
||||
operator: In
|
||||
values: ["arm64"]
|
||||
serviceAccountName: mailu-vault-sync
|
||||
containers:
|
||||
- name: mailu-sync
|
||||
image: python:3.11-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
. /vault/scripts/mailu_vault_env.sh
|
||||
pip install --no-cache-dir requests psycopg2-binary passlib >/tmp/pip.log \
|
||||
&& python /app/sync.py
|
||||
env:
|
||||
- name: KEYCLOAK_BASE_URL
|
||||
value: http://keycloak.sso.svc.cluster.local
|
||||
- name: KEYCLOAK_REALM
|
||||
value: atlas
|
||||
- name: MAILU_DOMAIN
|
||||
value: bstein.dev
|
||||
- name: MAILU_DEFAULT_QUOTA
|
||||
value: "20000000000"
|
||||
- name: MAILU_SYSTEM_USERS
|
||||
value: no-reply-portal@bstein.dev,no-reply-vaultwarden@bstein.dev
|
||||
- name: MAILU_DB_HOST
|
||||
value: postgres-service.postgres.svc.cluster.local
|
||||
- name: MAILU_DB_PORT
|
||||
value: "5432"
|
||||
volumeMounts:
|
||||
- name: sync-script
|
||||
mountPath: /app/sync.py
|
||||
subPath: sync.py
|
||||
- name: vault-scripts
|
||||
mountPath: /vault/scripts
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: sync-script
|
||||
configMap:
|
||||
name: mailu-sync-script
|
||||
defaultMode: 0444
|
||||
- name: vault-scripts
|
||||
configMap:
|
||||
name: mailu-vault-env
|
||||
defaultMode: 0555
|
||||
Loading…
x
Reference in New Issue
Block a user