Merge pull request #266 from AmpersandTarski/feature/delete_student_r…

…esources_cronjob

Feature/delete student resources cronjob

RAP4/customizations/bootstrap/files/student-manifest-template.yaml

@@ -4,6 +4,9 @@ kind: Deployment
 metadata:
   name: {{student}}
   namespace: {{namespace}}
+  labels:
+    app: {{student}}
+    container-image: student-prototype
 spec:
   replicas: 1
   selector:
@@ -13,6 +16,7 @@ spec:
     metadata:
       labels:
         app: {{student}}
+        container-image: student-prototype
     spec:
       containers:
         - name: {{student}}

deployment/resources/elevated-rights-service-account.yaml

@@ -3,45 +3,45 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: rap4svcaccount
+  name: elevated-rights-service-account
   namespace: rap
 ---
 # # Role that is used to give a pod elevated rights in the Kubernetes cluster
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: modify-pods
+  name: elevated-rights-role
   namespace: rap
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["create", "delete", "get", "watch", "list"]
+    verbs: ["get", "watch", "list", "create", "delete", "patch"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
-    verbs: ["get", "watch", "list", "create"]
+    verbs: ["get", "watch", "list", "create", "delete", "patch"]
   - apiGroups: [""]
     resources: ["services"]
-    verbs: ["get", "watch", "list", "create"]
+    verbs: ["get", "watch", "list", "create", "delete", "patch"]
   - apiGroups: [""]
     resources: ["configmaps"]
-    verbs: ["get", "watch", "list", "create"]
+    verbs: ["get", "watch", "list", "create", "delete", "patch"]
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    verbs: ["get", "watch", "list", "create"]
+    verbs: ["get", "watch", "list", "create", "delete", "patch"]
 
 ---
 # # Role that is used to give a pod elevated rights in the Kubernetes cluster
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: modifypods
+  name: elevated-rights-rolebinding
   namespace: rap
 subjects:
   - kind: ServiceAccount
-    name: rap4svcaccount
+    name: elevated-rights-service-account
     namespace: rap
 roleRef:
   kind: Role
-  name: modify-pods
+  name: elevated-rights-role
   apiGroup: rbac.authorization.k8s.io

deployment/resources/rap-deployment.yaml

@@ -18,7 +18,7 @@ spec:
       labels:
         app: rap
     spec:
-      serviceAccountName: rap4svcaccount
+      serviceAccountName: elevated-rights-service-account
       containers:
         - image: ampersandrap.azurecr.io/ampersand-rap:2023-22-03-v5
           name: ampersand-rap

deployment/resources/student-prototype-cleanup.yaml

@@ -0,0 +1,40 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: student-prototype-cleanup
+  namespace: rap
+spec:
+  schedule: "0 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: elevated-rights-service-account
+          containers:
+            - name: student-prototype-cleanup
+              image: bitnami/kubectl:latest
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  # loop all deployments with label: container-image=student-prototype
+                  for deployment in $(kubectl get deployment -n rap -l container-image=student-prototype -o jsonpath='{.items[*].metadata.name}'); do
+                    # calculate age in seconds
+                    deployment_age=$(($(date +%s) - $(date +%s -d $(kubectl get deployment $deployment -n rap -o jsonpath='{.metadata.creationTimestamp}'))))
+                    # delete deployment, service and ingress if age > 1 hour
+                    if [ $deployment_age -gt 3600 ]; then
+                      echo "Deleting deployment $deployment"
+                      kubectl delete deployment $deployment -n rap
+                      kubectl delete service $deployment -n rap
+                      kubectl delete ingress $deployment-ingress -n rap
+                      # TODO: delete database tables?
+                    else
+                      echo "Deployment $deployment is not older than 1 hour"
+                    fi
+                  done
+              envFrom:
+                - secretRef:
+                    name: db-secrets
+          restartPolicy: OnFailure