Jørgen Stensrud
b713ec853c
## Summary
ArgoCD Applications + Keycloak clients + sealed secret for forte-drop **web + mcp** (PROD).
## What changed
- **forte-drop** + **forte-drop-mcp** ArgoCD Applications (two-source: forte-helm chart + helm-prod-values).
- **namespace.yaml** — explicit `forte-drop` Namespace at sync-wave -1, `Prune=false` (avoids first-sync race for namespaced resources; doesn't cascade-delete on base removal).
- **keycloak-client-forte-drop** + **keycloak-client-forte-drop-mcp** — labeled config Secrets; the registrar creates the OIDC clients in the `forte` realm within ~2 min.
- **forte-drop-secrets** SealedSecret — UpCloud S3 creds (existing drops bucket) + PG creds + PASSWORD_GATE_SECRET. Consumed by both deployments + the pg-backup CronJob.
- **forte-drop-web PDB** — minAvailable 1 (selector verified against the live forteapp chart's pod labels).
- Wired into `apps/overlays/upc-dev` (NOT base → stays out of upc-prod).
## Post-merge manual step (one-time)
`auth-oidc` SealedSecret for the web sidecar is still commented out — it needs the `client-secret` the Keycloak registrar writes to `forte-drop-oidc-credentials` after first sync:
```bash
CLIENT_SECRET=$(kubectl -n forte-drop get secret forte-drop-oidc-credentials -o jsonpath='{.data.client-secret}' | base64 -d)
kubectl create secret generic auth-oidc -n forte-drop \
--from-literal=client-secret="$CLIENT_SECRET" \
--from-literal=cookie-secret="$(openssl rand -hex 32)" \
--dry-run=client -o yaml > private/auth-oidc.yaml
kubeseal --format=yaml --controller-name=sealed-secrets-controller --controller-namespace=kube-system \
< private/auth-oidc.yaml > apps/base/forte-drop/auth-oidc-sealed.yaml
# uncomment in kustomization, commit, push
```
## Depends on
- launchpad PR #17 (postgres + namespace via CreateNamespace).
- helm-prod-values forte-drop PR (values).
## Review
- [x] codex: namespace first-sync race → fixed (explicit namespace, sync-wave -1).
- [x] Keycloak registrar unblocked (stale chibisafe/minio config secrets removed; registrar green).
🤖 Generated with Claude Code
Co-authored-by: Sten <sten@Sten-sin-MacBook-Pro.local>
Co-authored-by: Sten <sten@Mac.domain_not_set.invalid>
Co-authored-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Reviewed-on: #18
Reviewed-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
# Nightly logical backup of the forte-drop Postgres → UpCloud Managed Object Storage.
|
|
# Dumps to s3://drops/_pgbackups/ (the `_` prefix is collision-proof: app slugs match
|
|
# /^[a-z0-9][a-z0-9-]{0,62}$/ and can never start with `_`). Retains 30 days.
|
|
#
|
|
# Pod shape: initContainer pg_dump → shared emptyDir → mc upload + retention prune.
|
|
# Both images pinned. S3 creds reuse forte-drop-secrets (the app's UpCloud user has
|
|
# s3:* on the drops bucket). PG creds from forte-drop-pg-creds.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: forte-drop-pg-backup
|
|
namespace: forte-drop
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: forte-drop
|
|
app.kubernetes.io/component: backup
|
|
spec:
|
|
schedule: "0 2 * * *" # 02:00 UTC daily
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/instance: forte-drop
|
|
app.kubernetes.io/component: backup
|
|
spec:
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
fsGroup: 65532
|
|
volumes:
|
|
- name: work
|
|
emptyDir: {}
|
|
initContainers:
|
|
- name: dump
|
|
image: postgres:16-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
TS=$(date -u +%Y%m%dT%H%M%SZ)
|
|
echo "dumping to /work/forte-drop-${TS}.sql.gz"
|
|
PGPASSWORD="$PGPASSWORD" pg_dump \
|
|
-h forte-drop-postgresql.forte-drop.svc \
|
|
-p 5432 -U "$PGUSER" -d drops \
|
|
--no-owner --no-privileges \
|
|
| gzip -9 > "/work/forte-drop-${TS}.sql.gz"
|
|
echo "dump complete: $(ls -lh /work/)"
|
|
env:
|
|
- name: PGUSER
|
|
valueFrom:
|
|
secretKeyRef: { name: forte-drop-pg-creds, key: pgusername }
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef: { name: forte-drop-pg-creds, key: pgpassword }
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
containers:
|
|
- name: upload
|
|
image: quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
mc alias set obj "$S3_ENDPOINT" "$S3_KEY" "$S3_SECRET"
|
|
mc cp /work/*.sql.gz "obj/${S3_BUCKET}/_pgbackups/"
|
|
echo "uploaded. pruning backups older than 30d:"
|
|
mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
|
|
echo "backup retention pass complete"
|
|
env:
|
|
- name: S3_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }
|
|
- name: S3_BUCKET
|
|
value: "drops"
|
|
- name: S3_KEY
|
|
valueFrom:
|
|
secretKeyRef: { name: forte-drop-secrets, key: S3_KEY }
|
|
- name: S3_SECRET
|
|
valueFrom:
|
|
secretKeyRef: { name: forte-drop-secrets, key: S3_SECRET }
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|