Badges: extract the rules repo

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

playbooks/openshift-apps/badges.yml

@@ -21,7 +21,7 @@
         password: "{{ (env == 'production')|ternary(tahrirDBPassword, tahrirstgDBPassword) }}"
     - name: Database creation
       postgresql_db:
-        name: "tahrir"
+        name: "{{ badges_db_name }}"
         owner: "{{ tahrirDBUser }}"
         encoding: UTF-8
 
@@ -97,6 +97,11 @@
       file: service.yml
       objectname: service.yml
 
+    - role: openshift/object
+      app: badges
+      file: storage.yml
+      objectname: storage.yml
+
     # Routes
     - role: openshift/route
       app: badges
@@ -144,6 +149,10 @@
       app: badges
       template: cron-award.yml
       objectname: cron-award.yml
+    - role: openshift/object
+      app: badges
+      template: cron-update-rules.yml
+      objectname: cron-update-rules.yml
 
     - role: openshift/start-build
       app: badges

roles/openshift-apps/badges/files/deploymentconfig.yml

@@ -36,6 +36,9 @@ spec:
             - name: etc-badges
               mountPath: "/etc/badges"
               readOnly: true
+            - name: rules
+              mountPath: "/var/lib/badges"
+              readOnly: true
             - name: ipa-config-volume
               mountPath: /etc/ipa
               readOnly: true
@@ -86,6 +89,9 @@ spec:
         - name: etc-badges
           configMap:
             name: badges
+        - name: rules
+          persistentVolumeClaim:
+            claimName: rules
         - name: ipa-config-volume
           configMap:
             name: ipa-client-config
@@ -149,6 +155,9 @@ spec:
             - name: etc-badges
               mountPath: "/etc/badges"
               readOnly: true
+            - name: rules
+              mountPath: "/var/lib/badges"
+              readOnly: true
             - name: ipa-config-volume
               mountPath: /etc/ipa
               readOnly: true
@@ -173,6 +182,9 @@ spec:
         - name: etc-badges
           configMap:
             name: badges
+        - name: rules
+          persistentVolumeClaim:
+            claimName: rules
         - name: ipa-config-volume
           configMap:
             name: ipa-client-config

roles/openshift-apps/badges/files/storage.yml

@@ -0,0 +1,13 @@
+---
+# The fedora-badges repo
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rules
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: ocs-storagecluster-cephfs

roles/openshift-apps/badges/templates/checkout-rules-repo.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+set -x
+
+DIR=/var/lib/badges
+
+if [ ! -d "$DIR/.git" ]; then
+	git clone https://pagure.io/fedora-badges.git $DIR
+fi
+
+git pull -C $DIR

roles/openshift-apps/badges/templates/configmap.yml

@@ -15,3 +15,5 @@ items:
       {{ load_file('fm-tahrir.toml') | indent(6) }}
     fm-fedbadges.toml: |-
       {{ load_file('fm-fedbadges.toml') | indent(6) }}
+    checkout-rules-repo.sh: |-
+      {{ load_file('checkout-rules-repo.sh') | indent(6) }}

roles/openshift-apps/badges/templates/cron-award.yml

@@ -26,6 +26,9 @@ spec:
               - name: etc-badges
                 mountPath: "/etc/badges"
                 readOnly: true
+              - name: rules
+                mountPath: "/var/lib/badges"
+                readOnly: true
               - name: ipa-config-volume
                 mountPath: /etc/ipa
                 readOnly: true
@@ -36,6 +39,9 @@ spec:
             - name: etc-badges
               configMap:
                 name: badges
+            - name: rules
+              persistentVolumeClaim:
+                claimName: rules
             - name: ipa-config-volume
               configMap:
                 name: ipa-client-config

roles/openshift-apps/badges/templates/cron-update-rules.yml

@@ -0,0 +1,49 @@
+#
+### Update the rules repo
+#
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: update-rules
+spec:
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  concurrencyPolicy: Forbid
+  schedule: "*/15 * * * *"
+  startingDeadlineSeconds: 500
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+          - name: badges
+            image: image-registry.openshift-image-registry.svc:5000/badges/fedbadges:latest
+            command: ["bash", "/etc/badges/checkout-rules-repo.sh"]
+            volumeMounts:
+              - name: etc-badges
+                mountPath: "/etc/badges"
+                readOnly: true
+              - name: rules
+                mountPath: "/var/lib/badges"
+                readOnly: true
+              - name: ipa-config-volume
+                mountPath: /etc/ipa
+                readOnly: true
+              - name: keytab-volume
+                mountPath: /etc/keytabs
+                readOnly: true
+          volumes:
+            - name: etc-badges
+              configMap:
+                name: badges
+            - name: rules
+              persistentVolumeClaim:
+                claimName: rules
+            - name: ipa-config-volume
+              configMap:
+                name: ipa-client-config
+            - name: keytab-volume
+              secret:
+                secretName: keytab