collado-mike commented on code in PR #626:
URL: https://github.com/apache/polaris/pull/626#discussion_r1937641536
##########
helm/polaris/templates/job.yaml:
##########
@@ -43,71 +43,89 @@ spec:
{{- tpl (toYaml .Values.podLabels) . | nindent 8 }}
{{- end }}
spec:
- {{- if and .Values.persistenceConfigSecret (index
.Values.polarisServerConfig.metaStoreManager "conf-file") }}
- initContainers:
- - name: init-config
- image: "{{ tpl .Values.toolsImage.repository . }}:{{ tpl
.Values.toolsImage.tag . }}"
- imagePullPolicy: {{ tpl .Values.toolsImage.pullPolicy . }}
- command: ["jar"]
- args: ["-cf", "/eclipselink-config/conf.jar", "-C", "/secret",
"persistence.xml"]
- {{- if .Values.securityContext}}
- securityContext:
- {{- tpl (toYaml .Values.securityContext) . | nindent 12 }}
- {{- end }}
- volumeMounts:
- - name: eclipselink-config-volume
- mountPath: /eclipselink-config
- - name: secret-volume
- mountPath: /secret
- {{- end }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.imagePullSecrets }}
- name: {{ . | quote }}
{{- end }}
{{- end }}
serviceAccountName: {{ include "polaris.serviceAccountName" . }}
- {{- if .Values.podSecurityContext}}
+ {{- if .Values.podSecurityContext }}
securityContext:
{{- tpl (toYaml .Values.podSecurityContext) . | nindent 8 }}
{{- end }}
- containers:
- - name: {{ .Chart.Name }}
- {{- if .Values.securityContext}}
+ {{- if .Values.bootstrap.purge }}
+ initContainers:
+ - name: "polaris-purge"
+ {{- if .Values.containerSecurityContext }}
securityContext:
- {{- tpl (toYaml .Values.securityContext) . | nindent 12 }}
+ {{- tpl (toYaml .Values.containerSecurityContext) . | nindent 12 }}
{{- end }}
- image: "{{ tpl .Values.image.repository . }}:{{ tpl
.Values.image.tag . | default .Chart.Version }}"
- imagePullPolicy: {{ tpl .Values.image.pullPolicy . }}
- command: ["/app/bin/polaris-service"]
- args: ["bootstrap", "/app/config/polaris-server.yml"]
- {{- if .Values.bootstrapExtraEnv }}
+ image: "{{ tpl .Values.bootstrap.image.repository . }}:{{ tpl
.Values.bootstrap.image.tag . | default .Chart.Version }}"
+ imagePullPolicy: {{ tpl .Values.bootstrap.image.pullPolicy . }}
+ args:
+ - "purge"
+ {{- range $realm := .Values.bootstrap.realms }}
+ - --realm={{ tpl $realm $ }}
+ {{- end }}
env:
- {{- tpl (toYaml .Values.bootstrapExtraEnv) . | nindent 12 }}
- {{- end }}
+ {{- if .Values.bootstrap.extraEnv }}
+ {{- tpl (toYaml .Values.bootstrap.extraEnv) . | nindent 12 }}
+ {{- end }}
+ - name: "quarkus.log.file.enable"
+ value: "false"
volumeMounts:
- name: config-volume
- mountPath: /app/config/polaris-server.yml
- subPath: polaris-server.yml
- {{- if and .Values.persistenceConfigSecret (index
.Values.polarisServerConfig.metaStoreManager "conf-file") }}
- - name: eclipselink-config-volume
- mountPath: /eclipselink-config
+ mountPath: {{ trimSuffix "/" .Values.bootstrap.image.configDir }}
+ readOnly: true
+ - name: temp-dir
+ mountPath: /tmp
+ readOnly: false
+ {{- if .Values.resources }}
+ resources:
+ {{- tpl (toYaml .Values.resources) . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ containers:
+ - name: "polaris-bootstrap"
Review Comment:
I just want to go on record as saying I think a bootstrap container is a bad
idea. Bootstrapping is the kind of activity that ought to be invoked manually
by a person in most scenarios - or at the most by a terraform process that sets
up a region for the very first time. I worry that a k8s job could be
misconfigured and accidentally purge a deployment during a release. It feels to
me like one of those "don't leave a loaded gun in the drawer" scenarios.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
