tegwick
4d5af7698d
RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached rather than ahead of it. rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a database-owner receipt with 12 checks proven live. creds/canned-prompts-publish was deliberately not issued, so the service runs read-only and POST /packages returns 503 explaining why — the intended posture, not a gap. Four defects surfaced that only a real rollout could expose, two of them silent: - SET ROLE opened an implicit transaction that Alembic nested inside rather than owning, so every revision logged as applied and was rolled back. Alembic reported success against an empty database. - The egress NetworkPolicy selected app.kubernetes.io/name, which the migration Job does not carry. The Job matched only the default-deny and succeeded exactly once, because it ran before the policies existed; the next migration would have failed on DNS. Now selects part-of, with ingress split into its own policy so the Job is never reachable. - env.py read database_url rather than resolved_database_url, so the migration could never run where the credential is a mounted file. - live-image-digest-match extracted the pin with a line-offset grep, which returned empty once comments were added above `version:`. The check degraded to reporting "not pinned yet" while a digest was pinned — it could not have passed for any pin. Now parsed as YAML. A verification step that cannot fail is worth less than none, because it is trusted. Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
73 lines
2.7 KiB
YAML
73 lines
2.7 KiB
YAML
# Schema migration as a Job, not an init container and not a start-up hook.
|
|
# Running migrations at start-up races between replicas and couples a rollback
|
|
# of the code to a rollback of the schema. The Job name carries the target
|
|
# revision so a re-apply at the same revision is a no-op rather than a rerun.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: canned-prompts-schema-migration-0002
|
|
namespace: canned-prompts
|
|
labels:
|
|
app.kubernetes.io/name: canned-prompts-migration
|
|
app.kubernetes.io/component: migration
|
|
spec:
|
|
backoffLimit: 2
|
|
ttlSecondsAfterFinished: 86400
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: canned-prompts-migration
|
|
# Carries part-of so the egress NetworkPolicy selects this Job too.
|
|
# Without it the Job matches only the default-deny and cannot reach
|
|
# PostgreSQL or DNS.
|
|
app.kubernetes.io/part-of: canned-prompts
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: migrate
|
|
image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
|
|
command: ["alembic"]
|
|
args: ["upgrade", "head"]
|
|
workingDir: /app
|
|
env:
|
|
# The migration role owns the schema; the runtime role does not.
|
|
- name: CANNED_PROMPTS_DATABASE_URL_FILE
|
|
value: /var/run/secrets/postgres-migration/url
|
|
# Authenticate as the leased migration login, then SET ROLE to the
|
|
# durable owner before creating anything. Leases are revoked; an
|
|
# object owned by a dead login has to be normalized afterwards.
|
|
# Required by the rapp-postgres database-owner boundary.
|
|
- name: CANNED_PROMPTS_MIGRATION_ROLE
|
|
value: canned_prompts_owner
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
readOnlyRootFilesystem: true
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
volumeMounts:
|
|
- name: postgres-migration
|
|
mountPath: /var/run/secrets/postgres-migration
|
|
readOnly: true
|
|
volumes:
|
|
- name: postgres-migration
|
|
secret:
|
|
defaultMode: 0440
|
|
secretName: canned-prompts-postgres-migration
|
|
items:
|
|
- key: url
|
|
path: url
|