103 lines
4.3 KiB
YAML
103 lines
4.3 KiB
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: kc-sync-users
|
|
namespace: django
|
|
spec:
|
|
schedule: "*/10 * * * *"
|
|
concurrencyPolicy: Forbid
|
|
startingDeadlineSeconds: 300
|
|
successfulJobsHistoryLimit: 1
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
activeDeadlineSeconds: 540
|
|
ttlSecondsAfterFinished: 3600
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
sidecar.istio.io/inject: "false"
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/auth-path: auth/kubernetes
|
|
vault.hashicorp.com/role: django
|
|
vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
|
|
vault.hashicorp.com/agent-inject-template-django-postgresql: |-
|
|
{{- with secret "secrets/data/apps/django/postgres" -}}
|
|
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
|
|
DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
|
|
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
|
|
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
|
|
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
|
|
{{- end -}}
|
|
vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
|
|
vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
|
|
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
|
|
{{ index .Data.data "private_key" }}
|
|
{{- end -}}
|
|
vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
|
|
vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
|
|
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
|
|
{{ index .Data.data "public_key" }}
|
|
{{- end -}}
|
|
vault.hashicorp.com/agent-inject-secret-kc-admin: secrets/data/camunda/keycloak-admin
|
|
vault.hashicorp.com/agent-inject-template-kc-admin: |-
|
|
{{- with secret "secrets/data/camunda/keycloak-admin" -}}
|
|
{{ index .Data.data "admin-password" }}
|
|
{{- end -}}
|
|
spec:
|
|
serviceAccountName: django-vault
|
|
automountServiceAccountToken: true
|
|
restartPolicy: Never
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
containers:
|
|
- name: kc-sync
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
|
|
imagePullPolicy: IfNotPresent
|
|
workingDir: /opt/sarex
|
|
command: ["/bin/sh", "-ec"]
|
|
args:
|
|
- |
|
|
exec python manage.py synchronization_keycloak --username "$KC_ADMIN_USERNAME" --password "$(cat /vault/secrets/kc-admin)" --sync-users-def-company-id 1
|
|
env:
|
|
- name: DJANGO_SETTINGS_MODULE
|
|
value: config.settings.kc_sync
|
|
- name: DJANGO_HOST
|
|
value: https://sarex.local.uralkali.com
|
|
- name: ISOLATED
|
|
value: "1"
|
|
- name: KC_ADMIN_USERNAME
|
|
value: admin
|
|
- name: KC_BASE_URL
|
|
value: http://camunda-keycloak.camunda.svc.cluster.local/auth
|
|
- name: KC_REALM
|
|
value: master
|
|
- name: KC_STAFF
|
|
value: GL_sarex-staff
|
|
- name: KC_SUPERUSER
|
|
value: GL_sarex-admins
|
|
- name: KC_SYNC_ADMIN
|
|
value: "True"
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
volumeMounts:
|
|
- name: django-configmap
|
|
mountPath: /opt/sarex/config/settings/production.py
|
|
subPath: production.py
|
|
readOnly: true
|
|
- name: kc-sync-configmap
|
|
mountPath: /opt/sarex/config/settings/kc_sync.py
|
|
subPath: kc_sync.py
|
|
readOnly: true
|
|
volumes:
|
|
- name: django-configmap
|
|
configMap:
|
|
name: django-configmap
|
|
- name: kc-sync-configmap
|
|
configMap:
|
|
name: kc-sync-configmap
|