mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
23f3f14b7f
Follow-up to 0f2fe93. Live post-deploy diagnostics showed that even
though helm upgrade rewrote the supabase-kong ConfigMap with the new
/healthz route, the existing Kong pod kept serving the old config: the
Deployment spec itself never changed, so no rolling restart happened.
Kong loads /usr/local/kong/kong.yml at startup and doesn't watch the
file, so the healthcheck probe against /healthz got 404 and the GCE
backend stayed UNHEALTHY. api.0.knoe.dev stayed broken.
Standard helm workaround: annotate the pod template with a sha256 of
the ConfigMap template. Any content change bumps the hash, which
changes the Deployment spec, which triggers a rolling restart. Pattern
matches what vector/deployment.yaml in this chart already does and is
widely used in the bitnami / ingress-nginx charts.
Studio has no ConfigMap volume mount (verified via grep), so no
equivalent annotation is needed there.
This lands the permanent B.1 fix from the plan. Whether the live Kong
pod needs a manual `kubectl rollout restart` to pick up the current
REVISION 2 config -- or whether the /healthz service URL itself is
tripping Kong's parser -- is still to be determined from Part A
diagnostics before any B.2 / B.3 edits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
146 lines
6.1 KiB
YAML
146 lines
6.1 KiB
YAML
{{- if .Values.deployment.kong.enabled -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "supabase.kong.fullname" . }}
|
|
labels:
|
|
{{- include "supabase.labels" . | nindent 4 }}
|
|
spec:
|
|
{{- if not .Values.autoscaling.kong.enabled }}
|
|
replicas: {{ .Values.deployment.kong.replicaCount }}
|
|
{{- end }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "supabase.kong.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
# Tie pod spec to the ConfigMap content hash so `helm upgrade` triggers
|
|
# a rolling restart whenever kong/config.yaml changes. Without this,
|
|
# ConfigMap-only changes (like adding a new route) land silently: the
|
|
# file in /usr/local/kong/template.yml updates via the ConfigMap
|
|
# volume mount, but Kong loaded declarative config at startup and
|
|
# doesn't re-read the file on its own -- old pods keep serving stale
|
|
# config and the new route (e.g. /healthz) is never live. Learned this
|
|
# the hard way when `helm upgrade` added /healthz but the GCE LB
|
|
# health check kept getting 404 because live Kong didn't have it.
|
|
checksum/config: {{ include (print $.Template.BasePath "/kong/config.yaml") . | sha256sum }}
|
|
{{- with .Values.deployment.kong.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "supabase.kong.selectorLabels" . | nindent 8 }}
|
|
spec:
|
|
{{- with .Values.image.kong.pullSecrets}}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "supabase.kong.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.deployment.kong.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ include "supabase.kong.name" $ }}
|
|
securityContext:
|
|
{{- toYaml .Values.deployment.kong.securityContext | nindent 12 }}
|
|
image: "{{ .Values.image.kong.repository }}:{{ .Values.image.kong.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.image.kong.pullPolicy }}
|
|
command: ["/bin/bash"]
|
|
args: ["/scripts/wrapper.sh"]
|
|
env:
|
|
{{- range $key, $value := .Values.environment.kong }}
|
|
- name: {{ $key }}
|
|
value: {{ $value | quote }}
|
|
{{- end }}
|
|
- name: SUPABASE_ANON_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if .Values.secret.jwt.secretRef }}
|
|
name: {{ .Values.secret.jwt.secretRef }}
|
|
key: {{ .Values.secret.jwt.secretRefKey.anonKey | default "anonKey" }}
|
|
{{- else }}
|
|
name: {{ include "supabase.secret.jwt" . }}
|
|
key: anonKey
|
|
{{- end }}
|
|
- name: SUPABASE_SERVICE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if .Values.secret.jwt.secretRef }}
|
|
name: {{ .Values.secret.jwt.secretRef }}
|
|
key: {{ .Values.secret.jwt.secretRefKey.serviceKey | default "serviceKey" }}
|
|
{{- else }}
|
|
name: {{ include "supabase.secret.jwt" . }}
|
|
key: serviceKey
|
|
{{- end }}
|
|
{{- if .Values.secret.dashboard }}
|
|
- name: DASHBOARD_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if .Values.secret.dashboard.secretRef }}
|
|
name: {{ .Values.secret.dashboard.secretRef }}
|
|
key: {{ .Values.secret.dashboard.secretRefKey.username | default "username" }}
|
|
{{- else }}
|
|
name: {{ include "supabase.secret.dashboard" . }}
|
|
key: username
|
|
{{- end }}
|
|
- name: DASHBOARD_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if .Values.secret.dashboard.secretRef }}
|
|
name: {{ .Values.secret.dashboard.secretRef }}
|
|
key: {{ .Values.secret.dashboard.secretRefKey.password | default "password" }}
|
|
{{- else }}
|
|
name: {{ include "supabase.secret.dashboard" . }}
|
|
key: password
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.deployment.kong.livenessProbe }}
|
|
livenessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.deployment.kong.readinessProbe }}
|
|
readinessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8000
|
|
protocol: TCP
|
|
{{- with .Values.deployment.kong.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- mountPath: /usr/local/kong/template.yml
|
|
name: config
|
|
subPath: template.yml
|
|
- mountPath: /scripts
|
|
name: wrapper
|
|
{{- with .Values.deployment.kong.volumeMounts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- include "supabase.enforcedGeneralNodeSelector" (dict "nodeSelector" .Values.deployment.kong.nodeSelector "enforceGeneralNodeRole" .Values.scheduling.enforceGeneralNodeRole) | nindent 6 }}
|
|
{{- include "supabase.enforcedGeneralAffinity" (dict "affinity" .Values.deployment.kong.affinity "enforceGeneralNodeRole" .Values.scheduling.enforceGeneralNodeRole) | nindent 6 }}
|
|
{{- with .Values.deployment.kong.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ include "supabase.kong.fullname" $ }}
|
|
defaultMode: 0777
|
|
items:
|
|
- key: template.yml
|
|
path: template.yml
|
|
- name: wrapper
|
|
configMap:
|
|
name: {{ include "supabase.kong.fullname" $ }}
|
|
defaultMode: 0777
|
|
items:
|
|
- key: wrapper.sh
|
|
path: wrapper.sh
|
|
{{- with .Values.deployment.kong.volumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|