From 6112b15f487bbb396b681ca905b3aaad3cfcbf0f Mon Sep 17 00:00:00 2001 From: Ethan Foss Date: Thu, 15 Apr 2021 14:47:10 -0300 Subject: [PATCH 1/6] Initial implementation of one-off jobs directory and README --- app/jobs/README.md | 7 +++++++ app/jobs/core-job.yaml | 12 ++++++++++++ app/jobs/scan-job.yaml | 12 ++++++++++++ 3 files changed, 31 insertions(+) create mode 100644 app/jobs/README.md create mode 100644 app/jobs/core-job.yaml create mode 100644 app/jobs/scan-job.yaml diff --git a/app/jobs/README.md b/app/jobs/README.md new file mode 100644 index 0000000000..8e85314d64 --- /dev/null +++ b/app/jobs/README.md @@ -0,0 +1,7 @@ +This directory contains manifests for the execution of one-off tasks that shouldn't be scheduled. + +E.g. Initiation of scans or core service outside of regularly scheduled execution. + +Deploying each file using kubectl -n -f will create a Kubernetes job which will only be performed once. + +The naming scheme for these manifests should be -job.yaml. diff --git a/app/jobs/core-job.yaml b/app/jobs/core-job.yaml new file mode 100644 index 0000000000..6e9916ec88 --- /dev/null +++ b/app/jobs/core-job.yaml @@ -0,0 +1,12 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: core-job +spec: + template: + spec: + containers: + - name: scan + image: gcr.io/track-compliance/services/core + restartPolicy: Never + backoffLimit: 4 diff --git a/app/jobs/scan-job.yaml b/app/jobs/scan-job.yaml new file mode 100644 index 0000000000..20c2f478e9 --- /dev/null +++ b/app/jobs/scan-job.yaml @@ -0,0 +1,12 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: scan-job +spec: + template: + spec: + containers: + - name: scan + image: gcr.io/track-compliance/services/autoscan:master-05b22b2-1615242767 # {"$imagepolicy": "flux-system:autoscan"} + restartPolicy: Never + backoffLimit: 4 From 30885509e5d175374bd98698252595f947cc051d Mon Sep 17 00:00:00 2001 From: Ethan Date: Thu, 15 Apr 2021 14:52:53 -0300 Subject: [PATCH 2/6] Update README.md --- app/jobs/README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/app/jobs/README.md b/app/jobs/README.md index 8e85314d64..4c8f24fb15 100644 --- a/app/jobs/README.md +++ b/app/jobs/README.md @@ -1,7 +1,15 @@ +# One-off Jobs + This directory contains manifests for the execution of one-off tasks that shouldn't be scheduled. E.g. Initiation of scans or core service outside of regularly scheduled execution. -Deploying each file using kubectl -n -f will create a Kubernetes job which will only be performed once. +Deploying each file using: + +``` +kubectl -n -f +``` + +will create a Kubernetes job which will only be performed once. The naming scheme for these manifests should be -job.yaml. From 9295bb3e36a1e58ad1616ddf64872315f190ec76 Mon Sep 17 00:00:00 2001 From: Ethan Date: Thu, 15 Apr 2021 14:56:25 -0300 Subject: [PATCH 3/6] Update README.md --- app/jobs/README.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/app/jobs/README.md b/app/jobs/README.md index 4c8f24fb15..6562267c2c 100644 --- a/app/jobs/README.md +++ b/app/jobs/README.md @@ -4,12 +4,6 @@ This directory contains manifests for the execution of one-off tasks that should E.g. Initiation of scans or core service outside of regularly scheduled execution. -Deploying each file using: - -``` -kubectl -n -f -``` - -will create a Kubernetes job which will only be performed once. +Deploying each file using `kubectl -n -f ` will create a Kubernetes job which will only be performed once. The naming scheme for these manifests should be -job.yaml. From a4db6976481fc18e8b42848e762fd0ec78eb6454 Mon Sep 17 00:00:00 2001 From: Ethan Date: Thu, 15 Apr 2021 15:02:50 -0300 Subject: [PATCH 4/6] Update scan-job.yaml --- app/jobs/scan-job.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/jobs/scan-job.yaml b/app/jobs/scan-job.yaml index 20c2f478e9..f70fe150e1 100644 --- a/app/jobs/scan-job.yaml +++ b/app/jobs/scan-job.yaml @@ -7,6 +7,6 @@ spec: spec: containers: - name: scan - image: gcr.io/track-compliance/services/autoscan:master-05b22b2-1615242767 # {"$imagepolicy": "flux-system:autoscan"} + image: gcr.io/track-compliance/services/autoscan:master-05b22b2-1615242767 restartPolicy: Never backoffLimit: 4 From 646b5c630b2a06ddfadbb1a2e4f22e45b9ffed76 Mon Sep 17 00:00:00 2001 From: Ethan Date: Thu, 15 Apr 2021 15:07:23 -0300 Subject: [PATCH 5/6] Update README.md --- app/jobs/README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/app/jobs/README.md b/app/jobs/README.md index 6562267c2c..8908b466c1 100644 --- a/app/jobs/README.md +++ b/app/jobs/README.md @@ -6,4 +6,9 @@ E.g. Initiation of scans or core service outside of regularly scheduled executio Deploying each file using `kubectl -n -f ` will create a Kubernetes job which will only be performed once. + +## Additional considerations + The naming scheme for these manifests should be -job.yaml. + +The image tagging for manifests within this directory is not updated/managed by flux, so tags may be out of date and require periodic updates to ensure proper functionality. From 99710cb42664eedaea6302e885d97a4dbe4fbd67 Mon Sep 17 00:00:00 2001 From: Ethan Foss Date: Thu, 15 Apr 2021 15:36:57 -0300 Subject: [PATCH 6/6] core.py fix and .yaml update to include secrets --- app/jobs/core-job.yaml | 34 ++++++++++++++++++++++++++++++++++ app/jobs/scan-job.yaml | 23 +++++++++++++++++++++++ services/core/core.py | 2 +- 3 files changed, 58 insertions(+), 1 deletion(-) diff --git a/app/jobs/core-job.yaml b/app/jobs/core-job.yaml index 6e9916ec88..25737e94ac 100644 --- a/app/jobs/core-job.yaml +++ b/app/jobs/core-job.yaml @@ -8,5 +8,39 @@ spec: containers: - name: scan image: gcr.io/track-compliance/services/core + env: + - name: DB_USER + valueFrom: + secretKeyRef: + name: scanners + key: DB_USER + - name: DB_PASS + valueFrom: + secretKeyRef: + name: scanners + key: DB_PASS + - name: DB_HOST + valueFrom: + secretKeyRef: + name: scanners + key: DB_HOST + - name: DB_PORT + value: "8529" + - name: DB_NAME + valueFrom: + secretKeyRef: + name: scanners + key: DB_NAME + - name: REPO_NAME + value: "tracker" + - name: REPO_OWNER + value: "canada-ca" + - name: GUIDANCE_DIR + value: "guidance" + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: scanners + key: GITHUB_TOKEN restartPolicy: Never backoffLimit: 4 diff --git a/app/jobs/scan-job.yaml b/app/jobs/scan-job.yaml index f70fe150e1..9da0bdf0ca 100644 --- a/app/jobs/scan-job.yaml +++ b/app/jobs/scan-job.yaml @@ -8,5 +8,28 @@ spec: containers: - name: scan image: gcr.io/track-compliance/services/autoscan:master-05b22b2-1615242767 + env: + - name: DB_USER + valueFrom: + secretKeyRef: + name: scanners + key: DB_USER + - name: DB_PASS + valueFrom: + secretKeyRef: + name: scanners + key: DB_PASS + - name: DB_HOST + valueFrom: + secretKeyRef: + name: scanners + key: DB_HOST + - name: DB_PORT + value: "8529" + - name: DB_NAME + valueFrom: + secretKeyRef: + name: scanners + key: DB_NAME restartPolicy: Never backoffLimit: 4 diff --git a/services/core/core.py b/services/core/core.py index 48a9b7ff4a..452ca9f294 100644 --- a/services/core/core.py +++ b/services/core/core.py @@ -16,7 +16,7 @@ DB_PASS = os.getenv("DB_PASS") DB_PORT = os.getenv("DB_PORT") DB_NAME = os.getenv("DB_NAME") -DB_HOST = "10.108.14.82" +DB_HOST = os.getenv("DB_HOST") REPO_NAME = os.getenv("REPO_NAME") REPO_OWNER = os.getenv("REPO_OWNER") GUIDANCE_DIR = os.getenv("GUIDANCE_DIR")