WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content

Commit f58db48

Browse files
Brutus5000Brutus5000
committed
Sync MariaDB databases and users
1 parent 6024ea1 commit f58db48

File tree

5 files changed

+185
-1
lines changed

5 files changed

+185
-1
lines changed

‎infra/clusterroles/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: clusterroles
3+
version: 1.0.0
4+
5+
description: "Special cluster roles"

‎infra/clusterroles/templates/clusterrole-read-cm-secrets.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Roles to access configMaps and secrets in all namespaces.
2+
# This is a very dangerous role, only use it with care!
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: read-cm-secrets
7+
rules:
8+
- apiGroups: [""]
9+
resources: ["configmaps", "secrets"]
10+
verbs: ["get", "list"]

‎infra/mariadb/templates/init-database-with-user.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# =======================================
2+
# Jesus, what the fuck is happening here?
3+
# =======================================
4+
#
5+
# 1. Create a service account
6+
# 2. Permit it to read configmaps and secrets in the faf-apps namespace
7+
# 3. Iterate over the databasesAndUsers list and create a job for each database
8+
# a) initContainer: Load the configmap and secret into environment variables. This must happen via k8s api, as we can't directly reference cm/secrets cross-namespace.
9+
# b) actual container: Load the env from file and create the database and user
10+
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: init-apps
15+
16+
---
17+
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: RoleBinding
20+
metadata:
21+
name: allow-init-apps-read-app-config
22+
namespace: faf-apps
23+
subjects:
24+
- kind: ServiceAccount
25+
name: init-apps
26+
namespace: faf-infra
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: ClusterRole
30+
name: read-cm-secrets
31+
32+
---
33+
34+
{{- $wave := 1 }}
35+
{{- range .Values.databasesAndUsers }}
36+
---
37+
apiVersion: batch/v1
38+
kind: Job
39+
metadata:
40+
name: mariadb-sync-db-user-{{ $wave }}
41+
labels:
42+
app: mariadb-sync-db-user
43+
argocd.argoproj.io/instance: mariadb
44+
annotations:
45+
argocd.argoproj.io/hook: PostSync
46+
argocd.argoproj.io/hook-delete-policy: HookSucceeded
47+
argocd.argoproj.io/sync-wave: '{{ $wave }}'
48+
spec:
49+
backoffLimit: 1
50+
template:
51+
spec:
52+
serviceAccountName: init-apps
53+
volumes:
54+
- name: config # We will store the apps config for database, username and password here
55+
emptyDir: {}
56+
initContainers:
57+
- name: load-config
58+
image: alpine/kubectl
59+
command: ["/bin/sh", "-c"]
60+
args:
61+
- |
62+
mkdir -p /config
63+
64+
echo -n "SYNC_DATABASE=" > /config/env
65+
kubectl get cm {{ .configMapRef }} \
66+
-n faf-apps \
67+
-o jsonpath='{.data.{{ .databaseKey }}}' >> /config/env
68+
echo >> /config/env
69+
70+
echo -n "SYNC_USERNAME=" >> /config/env
71+
kubectl get cm {{ .configMapRef }} \
72+
-n faf-apps \
73+
-o jsonpath='{.data.{{ .usernameKey }}}' >> /config/env
74+
echo >> /config/env
75+
76+
echo -n "SYNC_PASSWORD=" >> /config/env
77+
kubectl get secret {{ .secretRef }} \
78+
-n faf-apps \
79+
-o jsonpath='{.data.{{ .passwordKey }}}' \
80+
| base64 -d >> /config/env
81+
echo >> /config/env
82+
volumeMounts:
83+
- name: config
84+
mountPath: /config
85+
containers:
86+
- name: mariadb-sync-db-user
87+
image: {{ $.Values.image.repository }}:{{ $.Values.image.tag }}
88+
imagePullPolicy: Always
89+
envFrom:
90+
- secretRef:
91+
name: mariadb
92+
command: ["/bin/sh", "-c"]
93+
args:
94+
- |
95+
set -a
96+
. /config/env
97+
set +a
98+
99+
mariadb --host=mariadb --user=root --password="${MARIADB_ROOT_PASSWORD}" -e "CREATE DATABASE IF NOT EXISTS \`${SYNC_DATABASE}\`;" 2>&1
100+
mariadb --host=mariadb --user=root --password="${MARIADB_ROOT_PASSWORD}" -e "CREATE USER IF NOT EXISTS '${SYNC_USERNAME}'@'%' IDENTIFIED BY '${SYNC_PASSWORD}';" 2>&1
101+
mariadb --host=mariadb --user=root --password="${MARIADB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON \`${SYNC_DATABASE}\`.* TO '${SYNC_USERNAME}'@'%';" 2>&1
102+
volumeMounts:
103+
- name: config
104+
mountPath: /config
105+
restartPolicy: Never
106+
{{- $wave = add $wave 1 }}
107+
{{- end }}

‎infra/mariadb/templates/statefulset.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
app: mariadb
1818
spec:
1919
containers:
20-
- image: mariadb:12.1
20+
- image: {{ $.Values.image.repository }}:{{ $.Values.image.tag }}
2121
imagePullPolicy: Always
2222
name: mariadb
2323
ports:

‎infra/mariadb/values.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,64 @@
1+
image:
2+
repository: "mariadb"
3+
tag: "12.1"
4+
15
infisical-secret:
26
name: mariadb
7+
8+
databasesAndUsers:
9+
# Main FAF database
10+
- configMapRef: faf-api
11+
secretRef: faf-api
12+
databaseKey: DATABASE_NAME
13+
usernameKey: DATABASE_USERNAME
14+
passwordKey: DATABASE_PASSWORD
15+
16+
- configMapRef: faf-user-service
17+
secretRef: faf-user-service
18+
databaseKey: DB_DATABASE
19+
usernameKey: DB_USERNAME
20+
passwordKey: DB_PASSWORD
21+
22+
- configMapRef: faf-lobby-server
23+
secretRef: faf-lobby-server
24+
databaseKey: DB_NAME
25+
usernameKey: DB_LOGIN
26+
passwordKey: DB_PASSWORD
27+
28+
- configMapRef: faf-replay-server
29+
secretRef: faf-replay-server
30+
databaseKey: RS_DB_DATABASE
31+
usernameKey: RS_DB_USERNAME
32+
passwordKey: RS_DB_PASSWORD
33+
34+
- configMapRef: faf-policy-server
35+
secretRef: faf-policy-server
36+
databaseKey: DATABASE_NAME
37+
usernameKey: DATABASE_USER
38+
passwordKey: DATABASE_PASSWORD
39+
40+
# League service database
41+
- configMapRef: faf-api
42+
secretRef: faf-api
43+
databaseKey: LEAGUE_DATABASE_NAME
44+
usernameKey: LEAGUE_DATABASE_USERNAME
45+
passwordKey: LEAGUE_DATABASE_PASSWORD
46+
47+
- configMapRef: faf-league-service
48+
secretRef: faf-league-service
49+
databaseKey: DB_NAME
50+
usernameKey: DB_LOGIN
51+
passwordKey: DB_PASSWORD
52+
53+
# Others
54+
- configMapRef: wordpress
55+
secretRef: wordpress
56+
databaseKey: WORDPRESS_DB_NAME
57+
usernameKey: WORDPRESS_DB_USER
58+
passwordKey: WORDPRESS_DB_PASSWORD
59+
60+
- configMapRef: ergochat
61+
secretRef: ergochat
62+
databaseKey: ERGO__DATASTORE__MYSQL__HISTORY_DATABASE
63+
usernameKey: ERGO__DATASTORE__MYSQL__USER
64+
passwordKey: ERGO__DATASTORE__MYSQL__PASSWORD

0 commit comments

Comments
 (0)