mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 00:27:04 +09:00
Timofei Larkin
69b598a0be
The converted postgres chart reads each account's verifier from an account Secret the API writes, and nothing seeds those Secrets for the applications that exist before the chart switches: the API seeds only on a write of the application, and the old chart keeps serving the old passwords from <release>-credentials until the switch. Without a migration every existing account would stop logging in at the switch, since the operator leaves a role whose Secret is missing as it is but the chart no longer applies the old password either. Migration 60 runs in the pre-upgrade hook, before any component chart changes version, and writes the account Secrets with the verifiers of the chart-generated passwords, origin Migrated, so clients keep logging in at every point, and records the chart version of each release. A Job the platform release creates, not a hook so a long wait does not hold the upgrade and so it can be run again by hand, waits per release until the converted chart is Ready, removes any users.*.password left in the values and deletes <release>-credentials, which no platform account of postgres shares. It exits non-zero while a release is left out. The verifier is computed by the API's own format function, built into a CLI the migrations image carries, so a migrated release and a mint store the same form; the image is built from the repository root for that reason. Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
48 lines
1.8 KiB
Makefile
48 lines
1.8 KiB
Makefile
NAME=cozystack-platform
|
|
NAMESPACE=cozy-system
|
|
|
|
include ../../../hack/common-envs.mk
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
show:
|
|
cozyhr show --namespace $(NAMESPACE) $(NAME)
|
|
|
|
apply:
|
|
cozyhr apply --namespace $(NAMESPACE) $(NAME)
|
|
|
|
reconcile: apply
|
|
|
|
diff:
|
|
cozyhr diff --namespace $(NAMESPACE) $(NAME)
|
|
|
|
# Strip the platform.cozystack.io/no-delete label from every guarded object so
|
|
# `helm uninstall cozy-platform` (and ad-hoc deletes of protected resources)
|
|
# is no longer denied by the deletion-protection VAP. After this runs, the
|
|
# cluster has no guardrail until the next `helm upgrade` re-stamps the label.
|
|
# Intended for teardown / disaster-recovery, not routine use.
|
|
unprotect:
|
|
hack/unprotect.sh
|
|
|
|
image: image-migrations
|
|
|
|
image-migrations:
|
|
# Vendor the v1alpha2 CRDs into the build context so migration 50 can ensure
|
|
# they exist before adoption (the etcd-operator-crds HelmRelease only installs
|
|
# AFTER this pre-upgrade hook). Copied from the committed source of truth —
|
|
# no build-time network fetch, stays in lockstep with the chart. Removed again
|
|
# after the build; the leading rm reclaims a stale copy from a failed build.
|
|
rm -rf images/migrations/etcd-operator-crds
|
|
mkdir -p images/migrations/etcd-operator-crds
|
|
cp ../../system/etcd-operator-crds/templates/*.yaml images/migrations/etcd-operator-crds/
|
|
docker buildx build -f images/migrations/Dockerfile ../../.. \
|
|
$(call image-tags,platform-migrations,v$(COZYSTACK_VERSION)) \
|
|
$(call cache-args,platform-migrations) \
|
|
--metadata-file images/migrations.json \
|
|
$(BUILDX_ARGS)
|
|
rm -rf images/migrations/etcd-operator-crds
|
|
IMAGE="$(REGISTRY)/platform-migrations:$(IMAGE_TAG)@$$(yq -e -o json -r '.["containerimage.digest"]' images/migrations.json)" \
|
|
yq --inplace '.migrations.image = strenv(IMAGE)' values.yaml
|
|
rm -f images/migrations.json
|