mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: isolate OpenFGA migration from Argo sync

Browse Source
This commit is contained in:
root
2026-07-21 10:18:59 +02:00
parent 9f876ae42a
commit f680984c69
2 changed files with 16 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.test.ts
+7 -3
View File
@@ -583,16 +583,20 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
const openfga = JSON.parse(await readFile(path.join(outDir, "runtime-v02", "openfga.yaml"), "utf8"));
const openfgaDeployment = openfga.items.find((item) => item.kind === "Deployment" && item.metadata?.name === "hwlab-openfga");
const openfgaService = openfga.items.find((item) => item.kind === "Service" && item.metadata?.name === "hwlab-openfga");
const openfgaMigrate = openfga.items.find((item) => item.kind === "Job" && item.metadata?.name === "hwlab-openfga-migrate");
assert.ok(openfgaDeployment, "expected v02 OpenFGA deployment");
assert.ok(openfgaService, "expected v02 OpenFGA ClusterIP service");
assert.ok(openfgaMigrate, "expected v02 OpenFGA migration job");
assert.equal(openfga.items.some((item) => item.kind === "Job" && item.metadata?.name === "hwlab-openfga-migrate"), false);
assert.equal(openfgaService.spec.type, "ClusterIP");
assert.equal(openfga.items.some((item) => item.kind === "Ingress"), false);
assert.equal(openfgaDeployment.spec.template.spec.containers[0].image, "127.0.0.1:5000/hwlab/openfga:v1.17.0");
assert.deepEqual(openfgaDeployment.spec.template.spec.containers[0].args, ["run"]);
assert.deepEqual(openfgaMigrate.spec.template.spec.containers[0].args, ["migrate"]);
const openfgaEnv = openfgaDeployment.spec.template.spec.containers[0].env;
const openfgaMigrate = openfgaDeployment.spec.template.spec.initContainers[0];
assert.equal(openfgaMigrate.name, "openfga-migrate");
assert.equal(openfgaMigrate.image, "127.0.0.1:5000/hwlab/openfga:v1.17.0");
assert.deepEqual(openfgaMigrate.args, ["migrate"]);
assert.deepEqual(openfgaMigrate.env, openfgaEnv.filter((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" || entry.name === "OPENFGA_DATASTORE_URI"));
assert.deepEqual(openfgaMigrate.resources, { requests: { cpu: "50m", memory: "64Mi" }, limits: { cpu: "500m", memory: "256Mi" } });
assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" && entry.value === "postgres"));
assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_DATASTORE_URI" && entry.valueFrom?.secretKeyRef?.name === "hwlab-v02-openfga" && entry.valueFrom?.secretKeyRef?.key === "datastore-uri"));
assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_AUTHN_METHOD" && entry.value === "preshared"));
scripts/src/gitops-render/runtime-manifests.mjs
+9 -25
View File
@@ -908,37 +908,13 @@ function v02OpenFgaManifest({ profile = "v02", source, deploy = null }) {
{ name: "OPENFGA_HTTP_ADDR", value: "0.0.0.0:8080" },
{ name: "OPENFGA_GRPC_ADDR", value: "0.0.0.0:8081" }
];
const migrationEnv = env.filter((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" || entry.name === "OPENFGA_DATASTORE_URI");
const templateLabels = { ...labels, ...selector };
const runtimeAnnotations = { ...annotations, "argocd.argoproj.io/sync-wave": "2" };
return {
apiVersion: "v1",
kind: "List",
items: [
{
apiVersion: "batch/v1",
kind: "Job",
metadata: {
name: `${name}-migrate`,
namespace,
labels,
annotations: {
...annotations,
"argocd.argoproj.io/hook": "Sync",
"argocd.argoproj.io/sync-wave": "1",
"argocd.argoproj.io/hook-delete-policy": "BeforeHookCreation,HookSucceeded"
}
},
spec: {
backoffLimit: 3,
template: {
metadata: { labels: templateLabels, annotations },
spec: {
restartPolicy: "OnFailure",
containers: [{ name: "openfga-migrate", image, imagePullPolicy: "IfNotPresent", args: ["migrate"], env }]
}
}
}
},
{
apiVersion: "apps/v1",
kind: "Deployment",
@@ -949,6 +925,14 @@ function v02OpenFgaManifest({ profile = "v02", source, deploy = null }) {
template: {
metadata: { labels: templateLabels, annotations },
spec: {
initContainers: [{
name: "openfga-migrate",
image,
imagePullPolicy: "IfNotPresent",
args: ["migrate"],
env: migrationEnv,
resources: { requests: { cpu: "50m", memory: "64Mi" }, limits: { cpu: "500m", memory: "256Mi" } }
}],
containers: [{
name: "openfga",
image,