Forte/launchpad
6
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

feat(infra): forte-drop in-cluster postgres + nightly backup (prod) #17

Closed
jorgen.stensrud wants to merge 7 commits from feat/forte-drop-infra into main
pull from: feat/forte-drop-infra
merge into: Forte:main
Conversation 26 Commits 7 Files Changed 8 +10 -3
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 69848e42f0 - Show all commits

6
infra/overlays/upc-dev/forte-drop-minio/resources/minio.yaml
View File

@@ -45,7 +45,7 @@ spec:
spec:
containers:
- name: minio
image: quay.io/minio/minio:latest
image: quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z
jorgen.stensrud marked this conversation as resolved Outdated
gitea_admin commented 2026-05-28 13:55:36 +00:00
Outdated
Review
Copy Link

Using ':latest' tag is discouraged as it can lead to unpredictable deployments; pin to a specific version.

        image: quay.io/minio/minio:RELEASE.2024-03-15T01-07-19Z

#ai-review-inline

Using ':latest' tag is discouraged as it can lead to unpredictable deployments; pin to a specific version. ```suggestion image: quay.io/minio/minio:RELEASE.2024-03-15T01-07-19Z ``` #ai-review-inline
args:
- server
- /data
@@ -121,7 +121,7 @@ spec:
restartPolicy: OnFailure
containers:
- name: mc
image: quay.io/minio/mc:latest
image: quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z
jorgen.stensrud marked this conversation as resolved Outdated
gitea_admin commented 2026-05-28 13:55:36 +00:00
Outdated
Review
Copy Link

Using ':latest' tag is discouraged as it can lead to unpredictable deployments; pin to a specific version.

        image: quay.io/minio/mc:RELEASE.2024-03-15T01-07-19Z

#ai-review-inline

Using ':latest' tag is discouraged as it can lead to unpredictable deployments; pin to a specific version. ```suggestion image: quay.io/minio/mc:RELEASE.2024-03-15T01-07-19Z ``` #ai-review-inline
env:
- name: MINIO_ROOT_USER
valueFrom:
@@ -137,7 +137,7 @@ spec:
- sh
- -c
- |
set -e
set -euo pipefail
jorgen.stensrud marked this conversation as resolved Outdated
gitea_admin commented 2026-05-28 13:55:36 +00:00
Outdated
Review
Copy Link

Shell script should include 'set -uo pipefail' for better error handling and safer execution.

          set -euo pipefail

#ai-review-inline

Shell script should include 'set -uo pipefail' for better error handling and safer execution. ```suggestion set -euo pipefail ``` #ai-review-inline
until mc alias set local http://forte-drop-minio:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" 2>/dev/null; do
echo "waiting for minio..."
sleep 2

7
infra/overlays/upc-dev/forte-drop-postgresql/resources/postgresql.yaml
View File

@@ -43,6 +43,13 @@ spec:
containers:
jorgen.stensrud marked this conversation as resolved
gitea_admin commented 2026-05-28 13:55:37 +00:00
Review
Copy Link

Container is missing securityContext which should be set for security best practices.

      containers:
      - name: postgresql
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false

#ai-review-inline

Container is missing securityContext which should be set for security best practices. ```suggestion containers: - name: postgresql securityContext: runAsNonRoot: true runAsUser: 999 allowPrivilegeEscalation: false readOnlyRootFilesystem: false ``` #ai-review-inline
- name: postgresql
image: postgres:16-alpine
jorgen.stensrud marked this conversation as resolved
gitea_admin commented 2026-05-28 13:55:37 +00:00
Review
Copy Link

Container image should use a pinned digest or exact tag instead of 'postgres:16-alpine' for better security and reproducibility.

        image: postgres:16.1-alpine

#ai-review-inline

Container image should use a pinned digest or exact tag instead of 'postgres:16-alpine' for better security and reproducibility. ```suggestion image: postgres:16.1-alpine ``` #ai-review-inline
securityContext:
runAsNonRoot: true
runAsUser: 999
runAsGroup: 999
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
ports:
- name: tcp-postgresql
containerPort: 5432