create application-db user from master password #24
Conversation
davidcheung
force-pushed
the
create-db-user
branch
3 times, most recently
from
d4b1e03 to
84c467d
Compare
db-ops/create-db-user.sh
Outdated
| # docker image with postgres client only | ||
| DOCKER_IMAGE_TAG=governmentpaas/psql:latest | ||
|
|
||
| DB_ENDPOINT=$(aws rds describe-db-instances --region=$REGION --query "DBInstances[?DBName=='$PROJECT_NAME'].Endpoint.Address" | jq '.[0]' | sed "s/\"//g") |
There was a problem hiding this comment.
Another alternative we may want to explore here which would make this easier to use is in the aws-eks repo we could create an "externalname" service in the cluster which points to the database, then we could refer to it by a static name rather than having to get the RDS hostname.
Also if you use jq -r you don't need that sed at the end.
bmonkman
left a comment
bmonkman
left a comment
There was a problem hiding this comment.
Nice! Requested a couple changes.
db-ops/create-db-user.sh
Outdated
|
|
||
| # Deleting the entire db-ops namespace, leaving ONLY application-namespace's secret behind | ||
| kubectl wait --for=condition=complete --timeout=10s job db-create-users | ||
| kubectl delete namespace db-ops |
There was a problem hiding this comment.
If the intent is for the previous command to kill the script if it fails you should use set -e at the top but it's probably a better ideal to check if the return value of the previous command is zero and then delete the namespace. We probably want to keep the namespace if the job failed to debug.
There was a problem hiding this comment.
somelike like?
| kubectl delete namespace db-ops | |
| EXIT_CODE=$? | |
| if [ $EXIT_CODE -eq 0 ] | |
| then | |
| kubectl delete namespace db-ops | |
| if |
There was a problem hiding this comment.
Yeah! (Though needs syntax fix, and you could just have $? in the comparison without assigning it.)
And you could have an else in there with a nicer message like "Failed to create an application user in the database - you can find out more by running kubectl -n db-ops get logs blahblah"
db-ops/create-db-user.sh
Outdated
| then | ||
| kubectl delete namespace db-ops | ||
| else | ||
| POD_NAME=$(kubectl -n db-ops get po | grep db-create-users |awk '{print $1}') |
There was a problem hiding this comment.
You could clean this up a bit by giving the pod spec in the job a label like app: db-create-users and then a user could run kubectl logs -n db-ops -l app=db-create-users
There was a problem hiding this comment.
oh nice, didnt know it supports labels 👁️
There was a problem hiding this comment.
looks like they come with a job-name label, gonna use that instead
davidcheung
force-pushed
the
create-db-user
branch
from
6cf5c93 to
cec177a
Compare
The backend service expects a sercet with
DB_PASSWORDandDB_USERNAMECurrently we provision an RDS with a master password, and its a horrible idea for application to use master password to connect to db, this PR creates an extra step during
applyto create a application specific user in the db and a k8s-secretdb-opsnamespace leaving only theSecret in Application namespacebehind