88 lines
2.3 KiB
YAML
88 lines
2.3 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: tenant-engine-schema-migration
|
|
namespace: tenant-engine
|
|
labels:
|
|
app.kubernetes.io/name: tenant-engine
|
|
app.kubernetes.io/component: migration
|
|
spec:
|
|
backoffLimit: 2
|
|
ttlSecondsAfterFinished: 86400
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: tenant-engine-migration
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
fsGroup: 10001
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: migrate
|
|
image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24
|
|
args:
|
|
- tenant-engine-migrate
|
|
- --url-file
|
|
- /var/run/secrets/postgres-migration/url
|
|
- --role
|
|
- tenant_engine_migrate
|
|
env:
|
|
- name: TENANT_ENGINE_MIGRATION_DATABASE_URL_FILE
|
|
value: /var/run/secrets/postgres-migration/url
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 25m
|
|
memory: 48Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
volumeMounts:
|
|
- mountPath: /var/run/secrets/postgres-migration
|
|
name: postgres-migration
|
|
readOnly: true
|
|
volumes:
|
|
- name: postgres-migration
|
|
secret:
|
|
defaultMode: 0440
|
|
secretName: tenant-engine-postgres-migration
|
|
items:
|
|
- key: url
|
|
path: url
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: tenant-engine-schema-migration
|
|
namespace: tenant-engine
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: tenant-engine-migration
|
|
policyTypes: [Egress]
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: databases
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: platform-pg
|
|
ports:
|
|
- {port: 5432, protocol: TCP}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- {port: 53, protocol: UDP}
|
|
- {port: 53, protocol: TCP}
|