Andrew
4ff3048dd3
- _helpers.tpl: required guard on image.tag — silent empty deploys can no longer happen; helm fails fast with a clear message. - configmap-nginx: HTTPS fastcgi param uses if_not_empty, so PHP only sees HTTPS when X-Forwarded-Proto is actually present. - deployment-app: add startupProbe with 100s budget so first-boot cache warmup doesn't trip liveness. - deployment-horizon: failureThreshold=5 on the horizon:status probe; transient Valkey blips no longer cause restart loops. - job-migrate: mount oauth-keys so seeders that touch Passport clients don't silently fail. - statefulset-valkey: replace separate password Secret with a requirePassword toggle that reads REDIS_PASSWORD from the main chart Secret (same Secret app/horizon/scheduler already mount). Liveness probe authenticates with the password when set. - values-us-prod: enable valkey.requirePassword. - README: add REDIS_PASSWORD to bootstrap procedure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
59 lines
1.8 KiB
YAML
59 lines
1.8 KiB
YAML
{{- if .Values.migrate.enabled }}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ include "ezscale-website.fullname" . }}-migrate
|
|
labels:
|
|
{{- include "ezscale-website.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: migrate
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": before-hook-creation
|
|
spec:
|
|
backoffLimit: 1
|
|
ttlSecondsAfterFinished: 3600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: migrate
|
|
spec:
|
|
restartPolicy: Never
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: migrate
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
php artisan migrate --force --no-interaction
|
|
{{- if .Values.migrate.seed }}
|
|
php artisan db:seed --class={{ .Values.migrate.seedClass }} --force --no-interaction
|
|
{{- end }}
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "ezscale-website.fullname" . }}-env
|
|
- secretRef:
|
|
name: {{ include "ezscale-website.secretName" . }}
|
|
volumeMounts:
|
|
- name: oauth-keys
|
|
mountPath: /var/www/html/secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: oauth-keys
|
|
secret:
|
|
secretName: {{ include "ezscale-website.secretName" . }}
|
|
items:
|
|
- key: oauth-private.key
|
|
path: oauth-private.key
|
|
- key: oauth-public.key
|
|
path: oauth-public.key
|
|
optional: true
|
|
{{- end }}
|