fix: Run migrations with service accounts (#325)

Sovietaced · web-flow · commit c05bd2f982e2 · 2024-09-07T23:35:56.000+02:00
* Run migrations with service accounts

Signed-off-by: Jason Parraga &lt;sovietaced@gmail.com&gt;

* update unit tests

Signed-off-by: Jason Parraga &lt;sovietaced@gmail.com&gt;

---------

Signed-off-by: Jason Parraga &lt;sovietaced@gmail.com&gt;
diff --git a/internal/controller/install/lookout_controller.go b/internal/controller/install/lookout_controller.go
@@ -237,7 +237,7 @@ func generateLookoutInstallComponents(lookout *installv1alpha1.Lookout, scheme *
 		}
 	}
 
-	job, err := createLookoutMigrationJob(lookout)
+	job, err := createLookoutMigrationJob(lookout, serviceAccountName)
 	if err != nil {
 		return nil, err
 	}
@@ -440,7 +440,7 @@ func createLookoutIngressHttp(lookout *installv1alpha1.Lookout) (*networking.Ing
 }
 
 // createLookoutMigrationJob returns a batch Job or an error if the app config is not correct
-func createLookoutMigrationJob(lookout *installv1alpha1.Lookout) (*batchv1.Job, error) {
+func createLookoutMigrationJob(lookout *installv1alpha1.Lookout, serviceAccountName string) (*batchv1.Job, error) {
 	runAsUser := int64(1000)
 	runAsGroup := int64(2000)
 	var terminationGracePeriodSeconds int64
@@ -483,6 +483,7 @@ func createLookoutMigrationJob(lookout *installv1alpha1.Lookout) (*batchv1.Job,
 					Labels:    AllLabels(lookout.Name, lookout.Labels),
 				},
 				Spec: corev1.PodSpec{
+					ServiceAccountName:            serviceAccountName,
 					RestartPolicy:                 "Never",
 					TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
 					SecurityContext: &corev1.PodSecurityContext{
diff --git a/internal/controller/install/lookout_controller_test.go b/internal/controller/install/lookout_controller_test.go
@@ -491,6 +491,7 @@ func Test_createLookoutMigrationJob(t *testing.T) {
 				assert.Equal(t, "postgres3000", job.Spec.Template.Spec.InitContainers[0].Env[0].Value)
 				assert.Equal(t, "PGPORT", job.Spec.Template.Spec.InitContainers[0].Env[1].Name)
 				assert.Equal(t, "4000", job.Spec.Template.Spec.InitContainers[0].Env[1].Value)
+				assert.Equal(t, "sa", job.Spec.Template.Spec.ServiceAccountName)
 			},
 			wantErr: false,
 		},
@@ -508,6 +509,7 @@ func Test_createLookoutMigrationJob(t *testing.T) {
 				assert.Equal(t, "", job.Spec.Template.Spec.InitContainers[0].Env[0].Value)
 				assert.Equal(t, "PGPORT", job.Spec.Template.Spec.InitContainers[0].Env[1].Name)
 				assert.Equal(t, "", job.Spec.Template.Spec.InitContainers[0].Env[1].Value)
+				assert.Equal(t, "sa", job.Spec.Template.Spec.ServiceAccountName)
 			},
 			wantErr: false,
 		},
@@ -532,7 +534,7 @@ func Test_createLookoutMigrationJob(t *testing.T) {
 			if tt.modifyInput != nil {
 				tt.modifyInput(&cr)
 			}
-			rslt, err := createLookoutMigrationJob(&cr)
+			rslt, err := createLookoutMigrationJob(&cr, "sa")
 
 			if tt.wantErr {
 				assert.Error(t, err)
diff --git a/internal/controller/install/scheduler_controller.go b/internal/controller/install/scheduler_controller.go
@@ -231,7 +231,7 @@ func generateSchedulerInstallComponents(scheduler *installv1alpha1.Scheduler, sc
 		}
 	}
 
-	job, err := createSchedulerMigrationJob(scheduler)
+	job, err := createSchedulerMigrationJob(scheduler, serviceAccountName)
 	if err != nil {
 		return nil, err
 	}
@@ -431,7 +431,7 @@ func createSchedulerIngressGrpc(scheduler *installv1alpha1.Scheduler) (*networki
 }
 
 // createSchedulerMigrationJob returns a batch Job or an error if the app config is not correct
-func createSchedulerMigrationJob(scheduler *installv1alpha1.Scheduler) (*batchv1.Job, error) {
+func createSchedulerMigrationJob(scheduler *installv1alpha1.Scheduler, serviceAccountName string) (*batchv1.Job, error) {
 	runAsUser := int64(1000)
 	runAsGroup := int64(2000)
 	var terminationGracePeriodSeconds int64
@@ -474,6 +474,7 @@ func createSchedulerMigrationJob(scheduler *installv1alpha1.Scheduler) (*batchv1
 					Labels:    AllLabels(scheduler.Name, scheduler.Labels),
 				},
 				Spec: corev1.PodSpec{
+					ServiceAccountName:            serviceAccountName,
 					RestartPolicy:                 "Never",
 					TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
 					SecurityContext: &corev1.PodSecurityContext{
diff --git a/internal/controller/install/scheduler_controller_test.go b/internal/controller/install/scheduler_controller_test.go
@@ -713,6 +713,7 @@ func Test_createSchedulerMigrationJob(t *testing.T) {
 				assert.Equal(t, "postgres3000", job.Spec.Template.Spec.InitContainers[0].Env[0].Value)
 				assert.Equal(t, "PGPORT", job.Spec.Template.Spec.InitContainers[0].Env[1].Name)
 				assert.Equal(t, "4000", job.Spec.Template.Spec.InitContainers[0].Env[1].Value)
+				assert.Equal(t, "sa", job.Spec.Template.Spec.ServiceAccountName)
 			},
 			wantErr: false,
 		},
@@ -730,6 +731,7 @@ func Test_createSchedulerMigrationJob(t *testing.T) {
 				assert.Equal(t, "", job.Spec.Template.Spec.InitContainers[0].Env[0].Value)
 				assert.Equal(t, "PGPORT", job.Spec.Template.Spec.InitContainers[0].Env[1].Name)
 				assert.Equal(t, "", job.Spec.Template.Spec.InitContainers[0].Env[1].Value)
+				assert.Equal(t, "sa", job.Spec.Template.Spec.ServiceAccountName)
 			},
 			wantErr: false,
 		},
@@ -754,7 +756,7 @@ func Test_createSchedulerMigrationJob(t *testing.T) {
 			if tt.modifyInput != nil {
 				tt.modifyInput(&cr)
 			}
-			rslt, err := createSchedulerMigrationJob(&cr)
+			rslt, err := createSchedulerMigrationJob(&cr, "sa")
 
 			if tt.wantErr {
 				assert.Error(t, err)

Original file line number	Diff line number	Diff line change
`@@ -237,7 +237,7 @@ func generateLookoutInstallComponents(lookout installv1alpha1.Lookout, scheme `
`237`	`237`	`}`
`238`	`238`	`}`
`239`	`239`
`240`		`- job, err := createLookoutMigrationJob(lookout)`
	`240`	`+ job, err := createLookoutMigrationJob(lookout, serviceAccountName)`
`241`	`241`	`if err != nil {`
`242`	`242`	`return nil, err`
`243`	`243`	`}`
`@@ -440,7 +440,7 @@ func createLookoutIngressHttp(lookout installv1alpha1.Lookout) (networking.Ing`
`440`	`440`	`}`
`441`	`441`
`442`	`442`	`// createLookoutMigrationJob returns a batch Job or an error if the app config is not correct`
`443`		`-func createLookoutMigrationJob(lookout installv1alpha1.Lookout) (batchv1.Job, error) {`
	`443`	`+func createLookoutMigrationJob(lookout installv1alpha1.Lookout, serviceAccountName string) (batchv1.Job, error) {`
`444`	`444`	`runAsUser := int64(1000)`
`445`	`445`	`runAsGroup := int64(2000)`
`446`	`446`	`var terminationGracePeriodSeconds int64`
`@@ -483,6 +483,7 @@ func createLookoutMigrationJob(lookout installv1alpha1.Lookout) (batchv1.Job,`
`483`	`483`	`Labels: AllLabels(lookout.Name, lookout.Labels),`
`484`	`484`	`},`
`485`	`485`	`Spec: corev1.PodSpec{`
	`486`	`+ ServiceAccountName: serviceAccountName,`
`486`	`487`	`RestartPolicy: "Never",`
`487`	`488`	`TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,`
`488`	`489`	`SecurityContext: &corev1.PodSecurityContext{`
Original file line number	Diff line number	Diff line change
`@@ -231,7 +231,7 @@ func generateSchedulerInstallComponents(scheduler *installv1alpha1.Scheduler, sc`
`231`	`231`	`}`
`232`	`232`	`}`
`233`	`233`
`234`		`- job, err := createSchedulerMigrationJob(scheduler)`
	`234`	`+ job, err := createSchedulerMigrationJob(scheduler, serviceAccountName)`
`235`	`235`	`if err != nil {`
`236`	`236`	`return nil, err`
`237`	`237`	`}`
`@@ -431,7 +431,7 @@ func createSchedulerIngressGrpc(scheduler installv1alpha1.Scheduler) (networki`
`431`	`431`	`}`
`432`	`432`
`433`	`433`	`// createSchedulerMigrationJob returns a batch Job or an error if the app config is not correct`
`434`		`-func createSchedulerMigrationJob(scheduler installv1alpha1.Scheduler) (batchv1.Job, error) {`
	`434`	`+func createSchedulerMigrationJob(scheduler installv1alpha1.Scheduler, serviceAccountName string) (batchv1.Job, error) {`
`435`	`435`	`runAsUser := int64(1000)`
`436`	`436`	`runAsGroup := int64(2000)`
`437`	`437`	`var terminationGracePeriodSeconds int64`
`@@ -474,6 +474,7 @@ func createSchedulerMigrationJob(scheduler installv1alpha1.Scheduler) (batchv1`
`474`	`474`	`Labels: AllLabels(scheduler.Name, scheduler.Labels),`
`475`	`475`	`},`
`476`	`476`	`Spec: corev1.PodSpec{`
	`477`	`+ ServiceAccountName: serviceAccountName,`
`477`	`478`	`RestartPolicy: "Never",`
`478`	`479`	`TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,`
`479`	`480`	`SecurityContext: &corev1.PodSecurityContext{`