94 lines
4.3 KiB
YAML
94 lines
4.3 KiB
YAML
# The schema, brought up to this image's expectations. Once, before any pod of it starts serving.
|
|
#
|
|
# A JOB, and deliberately neither of the two alternatives:
|
|
#
|
|
# NOT an initContainer. It would run once per pod — which is exactly the bug this replaces, where
|
|
# every API container ran `prisma db push` at boot and N replicas raced the same DDL while the
|
|
# previous generation was still selecting the columns being altered.
|
|
#
|
|
# NOT a leader election inside the API. A Job is the primitive built for run-once work: it has an
|
|
# observable status, a bounded number of retries, and a failure that stops the rollout instead of
|
|
# letting it proceed against a schema that was never applied.
|
|
#
|
|
# With Helm this becomes a `pre-install,pre-upgrade` hook; with Argo, a sync-wave. Applied by hand,
|
|
# the ordering is yours to keep — see the README.
|
|
#
|
|
# It is safe to run twice: every pass is idempotent and the whole phase is wrapped in a Postgres
|
|
# advisory lock, so a second copy waits rather than racing.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: jarvis-migrate
|
|
namespace: jarvis
|
|
spec:
|
|
# One writer. The lock makes a second one wait rather than corrupt, but there is no reason to
|
|
# have one waiting.
|
|
parallelism: 1
|
|
completions: 1
|
|
# Two retries, because the failures worth retrying are transient (a database not finished failing
|
|
# over). A schema that Prisma REFUSES is not transient and must not be retried into submission —
|
|
# it is refused for a reason, and the reason is printed.
|
|
backoffLimit: 2
|
|
# A migration that has not finished in fifteen minutes is stuck, not slow, and the rollout is
|
|
# blocked behind it.
|
|
activeDeadlineSeconds: 900
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: jarvis
|
|
app.kubernetes.io/component: migrate
|
|
spec:
|
|
restartPolicy: Never
|
|
# Required by the `restricted` Pod Security Standard that 00-namespace.yaml enforces. At pod
|
|
# level so it covers anything added beside this container later. Without it the Job is
|
|
# accepted and its pod is refused, so the rollout waits on a Job that will never complete.
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: migrate
|
|
# THE SAME IMAGE, by the same digest, as the API that is about to roll. A migration from a
|
|
# different build is a schema that matches nothing.
|
|
image: git.luxit.be/luxit/jarvis-api@sha256:REPLACE_ME
|
|
command: ["/usr/local/bin/migrate.sh"]
|
|
envFrom:
|
|
- configMapRef:
|
|
name: jarvis-api-config
|
|
# Generated first, hand-written last, for the reason spelled out in 04-api.yaml: the
|
|
# last occurrence of a name wins, and a generated value must never override a typed one.
|
|
- secretRef:
|
|
name: jarvis-generated
|
|
optional: true
|
|
- secretRef:
|
|
name: jarvis-secrets
|
|
env:
|
|
# Its own, smaller pool: this is one process doing one thing, and the connections it
|
|
# takes are connections the running API cannot have while it works.
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: jarvis-secrets
|
|
key: DATABASE_URL
|
|
# Off, and it should stay off between deliberate acts. `prisma db push` used to run with
|
|
# `--accept-data-loss` at every boot, which meant an upgrade could destroy a column with
|
|
# nobody having decided to — survivable on one container, not during a rolling update
|
|
# where the previous generation is still selecting it.
|
|
#
|
|
# Without the flag the phase REFUSES, prints which columns it would have dropped, and
|
|
# fails the Job — so the rollout stops and nothing is serving a half-migrated schema.
|
|
# Set it to "true" for the ONE deploy where that drop is intended, then remove it.
|
|
- name: SCHEMA_ACCEPT_DATA_LOSS
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|