56 lines
2.4 KiB
YAML
56 lines
2.4 KiB
YAML
# services/comms/mas-db-ensure-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: mas-db-ensure-17
|
|
namespace: comms
|
|
spec:
|
|
backoffLimit: 1
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
spec:
|
|
serviceAccountName: mas-db-ensure
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: ensure
|
|
image: registry.bstein.dev/bstein/kubectl:1.35.0
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -eu
|
|
trap 'echo "mas-db-ensure failed"; sleep 300' ERR
|
|
umask 077
|
|
safe_pass() {
|
|
head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
|
|
}
|
|
|
|
EXISTING_B64="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' 2>/dev/null || true)"
|
|
if [ -n "${EXISTING_B64}" ]; then
|
|
MAS_PASS="$(printf '%s' "${EXISTING_B64}" | base64 -d)"
|
|
if printf '%s' "${MAS_PASS}" | grep -Eq '[^A-Za-z0-9_-]'; then
|
|
MAS_PASS="$(safe_pass)"
|
|
MAS_B64="$(printf '%s' "${MAS_PASS}" | base64 | tr -d '\n')"
|
|
payload="$(printf '{"data":{"password":"%s"}}' "${MAS_B64}")"
|
|
kubectl -n comms patch secret mas-db --type=merge -p "${payload}" >/dev/null
|
|
fi
|
|
else
|
|
MAS_PASS="$(safe_pass)"
|
|
kubectl -n comms create secret generic mas-db --from-literal=password="${MAS_PASS}" >/dev/null
|
|
fi
|
|
|
|
POD_NAME="$(kubectl -n postgres get pods -l app=postgres -o jsonpath='{.items[0].metadata.name}')"
|
|
if [ -z "${POD_NAME}" ]; then
|
|
echo "postgres pod not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
MAS_PASS_SQL="$(printf '%s' "${MAS_PASS}" | sed "s/'/''/g")"
|
|
kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
|
|
-c "CREATE ROLE mas LOGIN PASSWORD '${MAS_PASS_SQL}';" || true
|
|
kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
|
|
-c "ALTER ROLE mas WITH PASSWORD '${MAS_PASS_SQL}';"
|
|
kubectl -n postgres exec -i "${POD_NAME}" -- psql -U postgres -d postgres \
|
|
-c "CREATE DATABASE mas OWNER mas;" || true
|
|
kubectl -n postgres exec -i "${POD_NAME}" -- /bin/sh -c \
|
|
"PGPASSWORD='${MAS_PASS_SQL}' psql -U mas -d mas -c 'select 1;'"
|