jklein
d9267b2180
Second install-test run, three findings, all measured: - Readiness on "/" failed with "http: server gave HTTP response to HTTPS client" on a pod that was answering correctly. The kubelet's HTTP prober follows redirects to the same host, and with RAILS_ASSUME_SSL=true the app builds its redirect as https://<pod-ip>:3000/registration/new, which Puma does not speak. The probe now runs curl without -L and accepts 2xx-3xx itself. The same log also proves what the probe is for: against an empty database the redirect target was /registration/new, the branch User.count decides, so the path really does reach Postgres. - The pod was evicted within two minutes of every start: "ephemeral local storage usage exceeds the total limit of containers 60Mi". emptyDirs and the stdout log both count there, and the image rebuilds its Bootsnap cache under /rails/tmp on every start because the emptyDir hides the one baked into the image. The request is now 256Mi (limit 768Mi) per app container - headroom, not a measurement. - /home/rails is read-only, so Bundler created a throwaway home under TMPDIR on every invocation, worker probe included. HOME now points at a directory the init container creates. The CI postgres fixture gets -d sure on its readiness probe, so the server stops logging a missing database that nothing asked for.
130 lines
3.3 KiB
YAML
130 lines
3.3 KiB
YAML
# Fixtures for the sure install-test: throwaway PostgreSQL 16 (the version
|
|
# upstream's compose file uses) and Redis, plus the secrets the 1Password
|
|
# operator would otherwise materialize (release name: ci).
|
|
#
|
|
# Both are mandatory for this chart, and for different reasons: the web
|
|
# container migrates the schema at start and its readiness probe runs a query,
|
|
# while all three probes of the worker container ask Redis whether the Sidekiq
|
|
# process still has a heartbeat. A missing Redis therefore does not show up as
|
|
# "a background job is late" but as a pod that never turns Ready.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-sure-secret
|
|
stringData:
|
|
# 64 bytes hex, as upstream's "openssl rand -hex 64" produces. Any value
|
|
# works for a throwaway database - it is the key the app derives its Active
|
|
# Record encryption keys from, and nothing here survives the run.
|
|
secret-key-base: 3f786850e387550fdab836ed7e6dc881de23001b3f786850e387550fdab836ed7e6dc881de23001b3f786850e387550fdab836ed7e6dc881de23001b3f786850
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-sure-db-secret
|
|
stringData:
|
|
host: postgres
|
|
port: "5432"
|
|
database: sure
|
|
username: ci
|
|
password: ci
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-sure-redis-secret
|
|
stringData:
|
|
connection-url: redis://:cipass@redis:6379/0
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: public.ecr.aws/docker/library/postgres:16-alpine
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: ci
|
|
- name: POSTGRES_PASSWORD
|
|
value: ci
|
|
- name: POSTGRES_DB
|
|
value: sure
|
|
ports:
|
|
- containerPort: 5432
|
|
readinessProbe:
|
|
# -d names the database the chart actually uses. Without it
|
|
# pg_isready asks for a database named after the user and the
|
|
# server logs 'FATAL: database "ci" does not exist' every five
|
|
# seconds - noise that reads like a chart problem in the diagnostics
|
|
# dump when something else fails.
|
|
exec:
|
|
command: ["pg_isready", "-U", "ci", "-d", "sure"]
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: redis
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: redis
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
containers:
|
|
- name: redis
|
|
image: public.ecr.aws/docker/library/redis:7-alpine
|
|
args: ["redis-server", "--requirepass", "cipass"]
|
|
ports:
|
|
- containerPort: 6379
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 6379
|
|
periodSeconds: 5
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: redis
|
|
spec:
|
|
selector:
|
|
app: redis
|
|
ports:
|
|
- port: 6379
|
|
targetPort: 6379
|