[openfga] Configure CloudSQL datastore #15703
Conversation
easyCZ
changed the title
easyCZ
changed the base branch from
main
to
mp/openfga-cloud-sql-proxy-sidecar
easyCZ
force-pushed
the
mp/openfga-configure-datastore
branch
from
f9ff207 to
798ca4e
Compare
easyCZ
force-pushed
the
mp/openfga-configure-datastore
branch
from
798ca4e to
7458925
Compare
| @@ -28,75 +28,10 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) { | |||
| return nil, nil | |||
| } | |||
|
|
|||
| containers := []corev1.Container{ | |||
| { | |||
There was a problem hiding this comment.
The definition is moved below. If there's config for CloudSQL, we configure the sidecar first and based on that we inject extra envs to the openfga application.
| openfgaEnvVars = append(openfgaEnvVars, []corev1.EnvVar{ | ||
| { | ||
| Name: "OPENFGA_DATASTORE_ENGINE", | ||
| Value: "mysql", | ||
| }, | ||
| { | ||
| Name: "DB_PASSWORD", | ||
| ValueFrom: &corev1.EnvVarSource{SecretKeyRef: &corev1.SecretKeySelector{ | ||
| LocalObjectReference: corev1.LocalObjectReference{ | ||
| Name: cfg.CloudSQL.DatabaseSecretRef, | ||
| }, | ||
| Key: "password", | ||
| }}, | ||
| }, | ||
| { | ||
| Name: "DB_USERNAME", | ||
| ValueFrom: &corev1.EnvVarSource{SecretKeyRef: &corev1.SecretKeySelector{ | ||
| LocalObjectReference: corev1.LocalObjectReference{ | ||
| Name: cfg.CloudSQL.DatabaseSecretRef, | ||
| }, | ||
| Key: "user", | ||
| }}, | ||
| }, | ||
| { | ||
| Name: "OPENFGA_DATASTORE_URI", | ||
| Value: fmt.Sprintf("$(DB_USERNAME):$(DB_PASSWORD)@tcp(%s:%d)/%s?parseTime=true", dbHost, CloudSQLProxyPort, cfg.CloudSQL.Instance), | ||
| }, | ||
| }...) | ||
| } |
There was a problem hiding this comment.
This is the core of this PRs change, rest are moves to satisfy declaration dependencies.
|
/hold I want to validate the cloud-sql-proxy alone works correctly in staging before I land this change. |
|
Cloud sql has successfully deployed in staging, we can proceed with this /unhold |
| LocalObjectReference: corev1.LocalObjectReference{ | ||
| Name: cfg.CloudSQL.DatabaseSecretRef, | ||
| }, | ||
| Key: "password", |
There was a problem hiding this comment.
How will the real username and password be provided to the env var?
There was a problem hiding this comment.
Through a k8s secret, which has been added in this PR https://github.com/gitpod-io/ops/pull/7712
TF loads the secret from GCP into k8s, we reference it through the cfg.CloudSQL.DatabaseSecretRef config
roboquat
added
deployed: webapp
Description
Related Issue(s)
How to test
Release Notes
Documentation
Werft options:
If enabled this will build
install/previewValid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh