Simplify dev/test environment deployment #509
Conversation
gl-johnson
force-pushed
the
cleanup-deployment-scripts
branch
from
2449ad1 to
d7593dc
Compare
gl-johnson
changed the title
|
Code Climate has analyzed commit d7593dc and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 89.2% (0.0% change). View more on Code Climate. |
| name: test-app | ||
| command: ["sleep"] | ||
| args: ["infinity"] | ||
| volumeMounts: | ||
| - mountPath: /opt/secrets/conjur | ||
| name: conjur-secrets | ||
| readOnly: true | ||
| - image: '${PULL_DOCKER_REGISTRY_PATH}/${APP_NAMESPACE_NAME}/secrets-provider:latest' |
There was a problem hiding this comment.
With this change where are we pulling the images from? Is is the same for GKE and Openshift?
There was a problem hiding this comment.
These manifests are only used when running ./bin/start with the --dev flag, so I think we can assume that the image already exists locally per the docs to deploy a local dev environment, the first step of which is to run ./bin/build.
There was a problem hiding this comment.
OK, if it's only the dev image that's fine.
| - image: '${PULL_DOCKER_REGISTRY_PATH}/${APP_NAMESPACE_NAME}/secrets-provider:latest' | ||
| imagePullPolicy: Always | ||
| - image: 'secrets-provider-for-k8s:latest' | ||
| imagePullPolicy: Never |
There was a problem hiding this comment.
With the imagePullPolicy to Never is it possible that a cached image will be used and not the build image?
There was a problem hiding this comment.
Hmm I'm not sure on this. This change is largely based on the existing dev manifests for K8s secrets mode, both of which omitted the registry path variables and use an imagePullPolicy of Never.
I think the assumption once again is that ./bin/build was run prior to the start script, which tags the locally built secrets-provider image as latest and dev
Edit: ./bin/start --dev actually fails unless you have run the build script first even with a cached secrets-provider:latest image, since it is expecting the dev tag here
There was a problem hiding this comment.
I guess my concern is if I rebuild a dev image with a small change, and redeploy the pod will the latest build be picked up?
There was a problem hiding this comment.
Yes it should still be picked up as far as I can tell. Each time you run ./bin/build it overwrites dev/latest tags for the image locally, which is what will be used in the deployment when the imagePullPolicy is 'Never'.
I tested it with ./bin/start --dev and ./bin/start --dev --reload and it picks up code changes
Desired Outcome
Clean up some redundancies in the deployment scripts, and make it simpler to specify which mode to run Secrets Provider in.
Implemented Changes
SECRETS_MODEto set the mode for deploymentDefinition of Done
At least 1 todo must be completed in the sections below for the PR to be
merged.
Changelog
CHANGELOG update
Test coverage
changes, or
Documentation
READMEs) were updated in this PRBehavior
Security