https://authzed.com logo
Join Discord
Powered by
Does the SpiceDBCluster `patches`
# spicedb
t
Does the SpiceDBCluster 
patches
section also apply to migration jobs ?
v
I don't think it does. What are you trying to achieve?
t
I was trying to construct the datastore_uri env var, based on values from other configmaps/secrets. While it might work with the deployment pods, it's no good, if it doesnt work with the migration jobs.
v
The operator supports providing a secret for the datastore, but not if does not have the values the way it expects them
e
patches apply to jobs as well, you you write them as:
Copy code
- kind: Job
      patch:
         <thepatch>
t
Yes, i discovered that... Still struggling with how to append to env vars, though.
Got it:
Copy code
- kind: Job
      patch:
          op: add
          path: /spec/template/spec/containers/0/env/-
          value:
            name: PGHOST
            valueFrom:
                configMapKeyRef:
                  name: database
                  key: db.host
And just for reference. This enables me to compose the datastore_uri like this: (And similar for the deployment) It israhter verbose, but useful, when the database credentials is provided by another team, and we dont know their actual values.
Copy code
- kind: Job
      patch:
        op: test
        # Ensure that the index of the CONN_URI env var is correct
        path: /spec/template/spec/containers/0/env/1/name
        value: SPICEDB_DATASTORE_CONN_URI
    - kind: Job
      patch:
        op: remove
        # Delete the original CONN_URI env var, so we can re-add it, as the last one with varialble substitution
        path: /spec/template/spec/containers/0/env/1
    - kind: Job
      patch:
        op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: SPICEDB_DATASTORE_CONN_URI
          value: "postgres://$(PGUSER):$(PGPASSWORD)@$(PGHOST):$(PGPORT)/$(PGDATABASE)?sslmode=require"
e
We do have an issue filed to make it easier to specify credentials in different ways, but I'm glad you were able to make it work just with patches
FWIW I think you could probably make it simpler with just a 
merge
patch, like:
Copy code
- kind: Job
      patch:
        template:
          spec:
            containers:
            - name: migrate
              env:
              - name: SPICEDB_DATASTORE_CONN_URI
                value: "postgres://$(PGUSER):$(PGPASSWORD)@$(PGHOST):$(PGPORT)/$(PGDATABASE)?sslmode=require"
which should avoid the need for the test/remove operations you have (but warning: I didn't test this, I may have made some typos)
6 Views
PreviousNext
Powered by