Skip to content

Commit 2ac141e

Browse files
HeloiseJoffealdbr
HeloiseJoffe
authored and
aldbr
committed
refactor: integrate cleanup-authdb cronjob into helm deployment
1 parent 86c9ca5 commit 2ac141e

9 files changed

Lines changed: 103 additions & 75 deletions

File tree

‎diracx/templates/_helpers.tpl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,3 +205,10 @@ reduce collisions.
205205
{{- $rand := randAlphaNum 3 | lower }}
206206
{{- printf "%s-%d-%s" $name .Release.Revision $rand | trunc 63 | trimSuffix "-" -}}
207207
{{- end -}}
208+
209+
{{/*
210+
Return the fullname template for the cleanupAuthDB cronjob.
211+
*/}}
212+
{{- define "cleanupAuthDB.fullname" -}}
213+
{{- printf "%s-cleanup-authdb" .Release.Name -}}
214+
{{- end -}}

‎diracx/templates/diracx/cleanup-authdb/_cleanup-authdb.sh.tpl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
4+
5+
python -m diracx.logic cleanup-authdb --db-url "${DIRACX_DB_URL_AUTHDB}"

‎diracx/templates/diracx/cleanup-authdb/configmap.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if .Values.cleanupAuthDB.enabled -}}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ template "cleanupAuthDB.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
data:
8+
cleanup-authdb: |
9+
{{- include (print $.Template.BasePath "/diracx/cleanup-authdb/_cleanup-authdb.sh.tpl") . | nindent 4 }}
10+
{{- end -}}

‎diracx/templates/diracx/cleanup-authdb/cronjob.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{{- if .Values.cleanupAuthDB.enabled -}}
2+
3+
{{/* Define common volume mounts for reusability */}}
4+
{{- $commonVolumeMounts := list }}
5+
{{- $commonVolumeMounts = append $commonVolumeMounts (dict "mountPath" "/entrypoint.sh" "name" "container-entrypoint" "subPath" "entrypoint.sh") }}
6+
{{- if and .Values.developer.enabled .Values.developer.mountedPythonModulesToInstall }}
7+
{{- $commonVolumeMounts = append $commonVolumeMounts (dict "mountPath" .Values.developer.sourcePath "name" "diracx-code-mount" "readOnly" true) }}
8+
{{- range $module := .Values.developer.mountedPythonModulesToInstall }}
9+
{{- if $.Values.developer.editableMountedPythonModules }}
10+
{{- $commonVolumeMounts = append $commonVolumeMounts (dict "mountPath" (printf "%s/%s/src/%s.egg-info" $.Values.developer.sourcePath $module (replace "-" "_" (base $module))) "name" (printf "%s-editable-install" (base $module | lower)) "readOnly" false) }}
11+
{{- else }}
12+
{{- $commonVolumeMounts = append $commonVolumeMounts (dict "mountPath" (printf "%s/%s/build" $.Values.developer.sourcePath $module (replace "-" "_" (base $module))) "name" (printf "%s-editable-install" (base $module | lower)) "readOnly" false) }}
13+
{{- end }}
14+
{{- end }}
15+
{{- end }}
16+
17+
apiVersion: batch/v1
18+
kind: CronJob
19+
metadata:
20+
name: {{ template "cleanupAuthDB.fullname" . }}
21+
namespace: {{ .Release.Namespace }}
22+
spec:
23+
schedule: {{ $.Values.cleanupAuthDB.schedule }}
24+
jobTemplate:
25+
spec:
26+
template:
27+
spec:
28+
restartPolicy: OnFailure
29+
containers:
30+
- name: {{ .Chart.Name }}-cleanup
31+
image: "{{ include "diracx.servicesImage" . }}"
32+
command: ["/bin/bash", "/entrypoint.sh"]
33+
args: ["/bin/bash", "/scripts/cleanup-authdb"]
34+
envFrom:
35+
- secretRef:
36+
name: diracx-secrets
37+
- secretRef:
38+
name: diracx-sql-connection-urls
39+
- secretRef:
40+
name: diracx-dynamic-secrets
41+
volumeMounts:
42+
{{ toYaml $commonVolumeMounts | nindent 16 }}
43+
- name: keystore
44+
mountPath: /keystore/jwks.json
45+
subPath: jwks.json
46+
- name: scripts
47+
mountPath: /scripts
48+
volumes:
49+
- name: keystore
50+
secret:
51+
secretName: diracx-jwks
52+
items:
53+
- key: jwks.json
54+
path: jwks.json
55+
- name: scripts
56+
configMap:
57+
name: {{ template "cleanupAuthDB.fullname" . }}
58+
{{- if and .Values.developer.enabled .Values.developer.mountedPythonModulesToInstall }}
59+
- name: diracx-code-mount
60+
persistentVolumeClaim:
61+
claimName: pvc-diracx-code
62+
{{- range $module := .Values.developer.mountedPythonModulesToInstall }}
63+
- name: {{ base $module | lower }}-editable-install
64+
emptyDir:
65+
sizeLimit: 5Mi
66+
{{- end }}
67+
{{- end }}
68+
- name: container-entrypoint
69+
configMap:
70+
name: diracx-container-entrypoint
71+
{{- end -}}

‎diracx/values.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ initOs:
104104
initKeyStore:
105105
enabled: true
106106

107+
cleanupAuthDB:
108+
enabled: true
109+
schedule: "0 0 1 * *"
110+
107111
developer:
108112
enabled: false
109113
# -- Make it possible to launch the demo without having an internet connection
@@ -150,6 +154,10 @@ diracx:
150154
DIRACX_SERVICE_AUTH_TOKEN_KEYSTORE: "file:///keystore/jwks.json"
151155
DIRACX_SERVICE_AUTH_ALLOWED_REDIRECTS: '["http://anything:8000/docs/oauth2-redirect"]'
152156

157+
# -- Tune the AuthDB cleanup cronjob retention periods
158+
# -- DIRACX_SERVICE_AUTH_REVOKED_REFRESH_TOKEN_RETENTION_DAYS: <days>
159+
# -- DIRACX_SERVICE_AUTH_COMPLETED_FLOW_RETENTION_MINUTES: <minutes>
160+
153161
# -- legacy exchange key for DIRAC legacy (see https://github.com/DIRACGrid/diracx/blob/7f766158a674fde0eed011cd2745d359e507f846/diracx-routers/src/diracx/routers/auth/token.py#L264)
154162
# -- DIRACX_LEGACY_EXCHANGE_HASHED_API_KEY: <sha256>
155163

‎docs/admin/how-to/install/installing.md‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -363,11 +363,3 @@ helm install --timeout 3600s <release-name> ./diracx-charts/diracx/ -f my_values
363363
!!! success "Congrats, you have installed DiracX"
364364

365365
However, it does not do anything so far... See the [following steps](register-the-admin-vo.md)
366-
367-
## AuthDB Cleanup CronJob
368-
369-
Expired refresh tokens and device flows will accumulate in the AuthDB over time.
370-
This CronJob must be deployed to periodically remove them on the 1st of every month:
371-
```bash
372-
kubectl apply -f ./diracx-charts/k3s/manifests/cleanup-authdb-cronjob.yaml
373-
```

‎docs/admin/reference/values.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
| cert-manager.enabled | bool | `true` | |
2525
| cert-manager.installCRDs | bool | `true` | |
2626
| cert-manager.startupapicheck.enabled | bool | `true` | |
27+
| cleanupAuthDB.enabled | bool | `true` | |
28+
| cleanupAuthDB.schedule | string | `"0 0 1 * *"` | |
2729
| developer.autoReload | bool | `true` | Enable automatic reloading inside uvicorn when the sources change Used by the integration tests for running closer to prod setup |
2830
| developer.editableMountedPythonModules | bool | `true` | Use pip install -e for mountedPythonModulesToInstall This is used by the integration tests because editable install might behave differently |
2931
| developer.enableCoverage | bool | `false` | Enable collection of coverage reports (intended for CI usage only) |

‎k3s/README.md‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -263,13 +263,6 @@ git add default.yml
263263
git commit -m 'Initial config'
264264
```
265265

266-
## AuthDB Cleanup CronJob
267-
268-
Expired refresh tokens and device flows will accumulate in the AuthDB over time.
269-
This CronJob must be deployed to periodically remove them on the 1st of every month:
270-
```bash
271-
kubectl apply -f ./manifest/cleanup-authdb-cronjob.yaml
272-
```
273266

274267
## Post-install tips
275268

‎k3s/manifest/cleanup-authdb-cronjob.yaml‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

0 commit comments

Comments
 (0)