openova/platform/wordpress-tenant/chart/templates/database-secret-sync-job.yaml

{{- if and .Values.wordpress.enabled .Values.database.cluster.enabled }}
{{- /*
Helm post-install Job that copies the CNPG-emitted `<cluster>-app`
Secret into `wordpress-database-secret` so the WordPress Pod's
WORDPRESS_DB_PASSWORD env binding finds the expected `password` key.

WHY A JOB INSTEAD OF RELYING ON RELFLECTOR ALONE
────────────────────────────────────────────────
The Reflector-based path can race when CNPG creates
`<cluster>-app` AFTER `wordpress-database-secret` is processed; on
otech30 (caught live, see bp-gitea database-secret-sync-job.yaml)
Reflector logged "Source could not be found" once and never retried.
The post-install Job waits for CNPG to provision the source Secret,
then PATCHes the destination, eliminating the watcher race.

Pattern lifted from platform/gitea/chart/templates/database-secret-
sync-job.yaml (canonical seam — see ADR-0001 §11.3 anti-duplication).
*/}}
{{- $ns := include "bp-wordpress-tenant.cnpgNamespace" . }}
{{- $clusterName := .Values.database.cnpgClusterName }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
  namespace: {{ $ns }}
  labels:
    {{- include "bp-wordpress-tenant.labels" . | nindent 4 }}
    catalyst.openova.io/component: wordpress-database-secret-sync
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "5"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
spec:
  backoffLimit: 6
  ttlSecondsAfterFinished: 300
  template:
    metadata:
      labels:
        app.kubernetes.io/name: wordpress-database-secret-sync
        catalyst.openova.io/blueprint: bp-wordpress-tenant
    spec:
      restartPolicy: OnFailure
      serviceAccountName: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
      containers:
        - name: sync
          # curlimages/curl matches bp-gitea (no kubectl image
          # required — we talk to the apiserver via the in-pod
          # ServiceAccount token).
          image: curlimages/curl:8.10.1
          imagePullPolicy: IfNotPresent
          env:
            - name: SOURCE_SECRET
              value: {{ printf "%s-app" $clusterName | quote }}
            - name: DEST_SECRET
              value: {{ .Values.database.secretName | quote }}
            - name: NAMESPACE
              value: {{ $ns | quote }}
          command:
            - /bin/sh
            - -c
            - |
              set -eu
              APISERVER="https://kubernetes.default.svc"
              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
              echo "Waiting for ${SOURCE_SECRET} in ${NAMESPACE}..."
              for i in $(seq 1 120); do
                code=$(curl -s -o /tmp/src.json -w '%{http_code}' --cacert "${CA}" \
                  -H "Authorization: Bearer ${TOKEN}" \
                  "${APISERVER}/api/v1/namespaces/${NAMESPACE}/secrets/${SOURCE_SECRET}")
                if [ "${code}" = "200" ]; then
                  echo "Found ${SOURCE_SECRET}"; break
                fi
                if [ "$i" = "120" ]; then
                  echo "Timeout: ${SOURCE_SECRET} not present after 10 min" >&2
                  exit 1
                fi
                sleep 5
              done
              PWD_B64=$(tr -d '\n' < /tmp/src.json | grep -oE '"password"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')
              if [ -z "${PWD_B64}" ]; then
                echo "Source ${SOURCE_SECRET} has empty password" >&2
                exit 1
              fi
              PATCH=$(printf '{"data":{"password":"%s"}}' "${PWD_B64}")
              code=$(curl -s -o /tmp/patch.json -w '%{http_code}' --cacert "${CA}" \
                -H "Authorization: Bearer ${TOKEN}" \
                -H "Content-Type: application/strategic-merge-patch+json" \
                -X PATCH --data "${PATCH}" \
                "${APISERVER}/api/v1/namespaces/${NAMESPACE}/secrets/${DEST_SECRET}")
              if [ "${code}" != "200" ] && [ "${code}" != "201" ]; then
                echo "PATCH ${DEST_SECRET} returned HTTP ${code}:" >&2
                cat /tmp/patch.json >&2
                exit 1
              fi
              echo "Synced ${DEST_SECRET} from ${SOURCE_SECRET}"              
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 64Mi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
  namespace: {{ $ns }}
  labels:
    {{- include "bp-wordpress-tenant.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": "before-hook-creation"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
  namespace: {{ $ns }}
  labels:
    {{- include "bp-wordpress-tenant.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": "before-hook-creation"
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "create", "update", "patch", "apply"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
  namespace: {{ $ns }}
  labels:
    {{- include "bp-wordpress-tenant.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": "before-hook-creation"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
subjects:
  - kind: ServiceAccount
    name: {{ include "bp-wordpress-tenant.fullname" . }}-db-secret-sync
    namespace: {{ $ns }}
{{- end }}