mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: separate HWLAB migration database URL

Browse Source
This commit is contained in:
Codex
2026-07-17 00:08:29 +02:00
parent 283ef29a2a
commit 278ecac8cb
4 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hwlab-node-lanes.yaml
+2
View File
@@ -344,6 +344,8 @@ lanes:
secretName: hwlab-cloud-api-production-db
sourceRef: hwlab/nc01-production-cloud-api-db.env
role: hwlab_nc01_production_app
migrationSecretKey: migration-database-url
migrationEnvKey: MIGRATION_DATABASE_URL
openfga:
secretName: hwlab-production-openfga
sourceRef: hwlab/nc01-production-openfga-db.env
config/platform-db/postgres-nc01.yaml
+16 -1
View File
@@ -500,7 +500,7 @@ exports:
sourceSecretRef: platform-db/hwlab-nc01-production-db.env
render:
envKey: DATABASE_URL
format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true
format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require
variables:
PGHOST: 10.42.0.1
writeToSecretSource:
@@ -511,6 +511,21 @@ exports:
- scope: hwlab-production
secret: hwlab-cloud-api-production-db
key: DATABASE_URL
- name: hwlab-nc01-production-migration-database-url
sourceSecretRef: platform-db/hwlab-nc01-production-db.env
render:
envKey: MIGRATION_DATABASE_URL
format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true
variables:
PGHOST: 10.42.0.1
writeToSecretSource:
sourceRef: hwlab/nc01-production-cloud-api-db.env
key: MIGRATION_DATABASE_URL
mode: update-or-insert
consumers:
- scope: hwlab-production
secret: hwlab-cloud-api-production-db
key: MIGRATION_DATABASE_URL
- name: hwlab-nc01-production-openfga-datastore-uri
sourceSecretRef: platform-db/hwlab-nc01-production-db.env
render:
scripts/src/hwlab-node-lanes.ts
+4
View File
@@ -72,6 +72,8 @@ export interface HwlabRuntimeExternalPostgresComponentSpec {
readonly role: string;
readonly authnKey?: string;
readonly schema?: string;
readonly migrationSecretKey?: string;
readonly migrationEnvKey?: string;
}
export interface HwlabRuntimeExternalPostgresRuntimeAccessSpec {
@@ -1402,6 +1404,8 @@ function externalPostgresComponentConfig(value: unknown, path: string): HwlabRun
role: stringField(raw, "role", path),
authnKey: optionalStringField(raw, "authnKey", path),
schema: optionalStringField(raw, "schema", path),
migrationSecretKey: optionalStringField(raw, "migrationSecretKey", path),
migrationEnvKey: optionalStringField(raw, "migrationEnvKey", path),
};
}
scripts/src/hwlab-node/web-probe.ts
+9 -1
View File
@@ -548,9 +548,13 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR
if (pg === undefined) return null;
const secretRoot = externalPostgresSecretSourceRoot(spec);
const cloudApi = readSecretSourceValue(secretRoot, pg.cloudApi.sourceRef, pg.cloudApi.envKey);
const migration = pg.cloudApi.migrationEnvKey === undefined
? null
: readSecretSourceValue(secretRoot, pg.cloudApi.sourceRef, pg.cloudApi.migrationEnvKey);
const openfga = readSecretSourceValue(secretRoot, pg.openfga.sourceRef, pg.openfga.envKey);
const missing = [
...(cloudApi.ok ? [] : [`${pg.cloudApi.sourceRef}:${pg.cloudApi.envKey}`]),
...(migration === null || migration.ok ? [] : [`${pg.cloudApi.sourceRef}:${pg.cloudApi.migrationEnvKey}`]),
...(openfga.ok ? [] : [`${pg.openfga.sourceRef}:${pg.openfga.envKey}`]),
];
if (missing.length > 0) {
@@ -598,7 +602,10 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR
kind: "Secret",
metadata: { name: pg.cloudApi.secretName, namespace: spec.runtimeNamespace },
type: "Opaque",
stringData: { [pg.cloudApi.secretKey]: cloudApi.value },
stringData: {
[pg.cloudApi.secretKey]: cloudApi.value,
...(migration === null || pg.cloudApi.migrationSecretKey === undefined ? {} : { [pg.cloudApi.migrationSecretKey]: migration.value }),
},
},
{
apiVersion: "v1",
@@ -631,6 +638,7 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR
sourceRoot: secretRoot,
secrets: [
{ name: pg.cloudApi.secretName, key: pg.cloudApi.secretKey, sourceRef: pg.cloudApi.sourceRef, envKey: pg.cloudApi.envKey },
...(migration === null || pg.cloudApi.migrationSecretKey === undefined ? [] : [{ name: pg.cloudApi.secretName, key: pg.cloudApi.migrationSecretKey, sourceRef: pg.cloudApi.sourceRef, envKey: pg.cloudApi.migrationEnvKey }]),
{ name: pg.openfga.secretName, key: pg.openfga.secretKey, sourceRef: pg.openfga.sourceRef, envKey: pg.openfga.envKey, authnKey: pg.openfga.authnKey ?? null },
],
setup: compactRuntimeCommand(setup),