bazel: migrate legacy postgres-12 dockerfile to rules_oci by Strum355 · Pull Request #61963 · sourcegraph/sourcegraph-public-snapshot

Strum355 · 2024-04-17T13:27:10Z

Test plan

Release team have tested a migration from the old database image to this new one

Tested
v5.3.3 -> candidate build standard upgrade
v4.5.1 -> candidate build multiversion upgrade

GitHub app weirdness.

willdollman · 2024-04-24T08:56:00Z

+    # Please review the changes in /usr/local/share/postgresql/postgresql.conf.sample
+    # If there is any change, you should ping @team/delivery
+    # And Delivery will make sure changes are reflected in our deploy repository
    oci_pull(
        name = "legacy_postgres-12-alpine_base",
-        digest = "sha256:dcc32a6d845356288186f2ced62346cf7e0120977ff1a0d6758f4e11120401f7",
-        image = "index.docker.io/sourcegraph/postgres-12-alpine",
+        # IMPORTANT: Only update to Postgres 12.X Alpine images, and update the tag below
+        # (Bazel doesn't allow both tags and hashes)
+        # postgres:12.18-alpine3.18


Added comment @Strum355

willdollman · 2024-04-24T14:29:02Z

This looks really good. I've fixed a couple of issues and checked:

No obvious major differences between old upstream and new upstream images
No major differences between image built with old Dockerfile (with new upstream image) and new bazel-based image
Bazel postgres-12-alpine and codeintel-db images are identical
Bazel codeintel-db and codeinsights-db images are identical execept for expected UID/GID differences

I've made a few changes to fix broken directory permissions. The side-effect of these is that /var/, /var/lib and /var/run are also owned by postgres and I couldn't get owners to work. I don't think there are any side-effects to this as the containers run as postgres.

I've also added the container structure tests and re-organised the BUILD.bazel files.

willdollman

I'm happy with these images from a security pov. For peace of mind I'd like to get the release team to test these images out by migrating an instance from the old db images to these ones. I'll tag them in the slack thread we have ongoing.

jhchabran

SGTM

Obvious, but just in case, need a description for the PR :P

jhchabran · 2024-04-25T14:50:25Z

-    )
-
+    # Please review the changes in /usr/local/share/postgresql/postgresql.conf.sample
+    # If there is any change, you should ping @team/delivery


team/delivery ? Are you talking about the release team?

Yes! I copied+pasted from the old Dockerfile. Fixing

Seeing error: index.docker.io/library/postgres is a multi-architecture image, so attribute 'platforms' is required

@jac

* Fix bedrock URL encoding to mimic AWS CLI (#62695) * Fix bedrock URL encoding to mimic AWS CLI * Update changelog * appliance: namespace scoping (#62663) Allow a namespace to be configured, defaulting to all namespaces. Without this setting, if an admin deploys the appliance with namespace-scoped RBAC, it would throw errors due to not being able to watch ConfigMaps in all namespaces. * bazel: migrate legacy postgres-12 dockerfile to rules_oci (#61963) * build-tracker: include error if failing to write to bigquery (#62699) Without this, this error won't be logged to Sentry, resulting in us missing it unless we check GCP ## Test plan Discussed with @jac * Svelte: Fix global header navigation layers (#62697) Fix global header navigation layers * msp/rollouts: remove Cloud Deploy target import (#62687) Now that #62644 (CORE-23) is rolled out, this import block is no longer needed (and may even be disruptive when provisioning new rollout pipelines). The change was rolled out in: - sourcegraph/managed-services#1416 - sourcegraph/managed-services#1417 - sourcegraph/managed-services#1403 ## Test plan n/a * msp/cloudrun: use GA launch stage (#62685) VPC direct egress is now GA: see example in https://registry.terraform.io/providers/hashicorp/google/5.29.0/docs/resources/cloud_run_v2_service#example-usage---cloudrunv2-service-directvpc and https://cloud.google.com/run/docs/configuring/vpc-direct-vpc This also fixes the infinite `GA` -> `BETA` drift we have in TFC * Symbols: new backend integration test (#62686) This PR creates a new GraphQL integration test file focused on symbol search. It exercises the same searches the web client uses for code navigation. In a follow-up, we will add cases for older commits and enable Rockskip. * fix: update search timeout docs (#62692) * update telemetry sensitivemetadataallowlist to filter based on keys * fix main merge * Update BUILD.bazel * Update teestore_test.go * add better code-comments and error messaging * add test coverage on non-string types getting redacted with proper error value return * fix spacing! --------- Co-authored-by: Rik <rik.nauta@sourcegraph.com> Co-authored-by: Craig Furman <craig.furman@sourcegraph.com> Co-authored-by: Noah S-C <noah@sourcegraph.com> Co-authored-by: Vova Kulikov <vovakulikov@icloud.com> Co-authored-by: Robert Lin <robert@bobheadxi.dev> Co-authored-by: Julie Tibshirani <julietibs@apache.org> Co-authored-by: Michael Bahr <1830132+bahrmichael@users.noreply.github.com>

cla-bot Bot added the cla-signed label Apr 17, 2024

Strum355 force-pushed the nsc/legacy-pgsql-image-bazel branch from 28dfa9a to 852a011 Compare April 17, 2024 13:27

Strum355 commented Apr 17, 2024

View reviewed changes

Comment thread docker-images/postgres-12-alpine/defs.bzl Outdated

evict previously approved these changes Apr 18, 2024

View reviewed changes

evict self-requested a review April 18, 2024 17:11

Strum355 force-pushed the nsc/legacy-pgsql-image-bazel branch 2 times, most recently from b40eecf to a49e021 Compare April 22, 2024 20:25

Strum355 marked this pull request as ready for review April 22, 2024 20:25

Strum355 requested review from a team and willdollman April 22, 2024 20:25

Strum355 self-assigned this Apr 22, 2024

Strum355 force-pushed the nsc/legacy-pgsql-image-bazel branch from a49e021 to fd509ef Compare April 22, 2024 20:27

willdollman reviewed Apr 23, 2024

View reviewed changes

Comment thread dev/oci_deps.bzl Outdated

willdollman reviewed Apr 23, 2024

View reviewed changes

Comment thread docker-images/postgres-12-alpine/BUILD.bazel Outdated

Strum355 force-pushed the nsc/legacy-pgsql-image-bazel branch from fd509ef to 652d0e6 Compare April 23, 2024 20:01

Strum355 requested a review from willdollman April 23, 2024 20:01

willdollman reviewed Apr 24, 2024

View reviewed changes

willdollman mentioned this pull request Apr 24, 2024

sec: Update postgres base image #61961

Closed

willdollman approved these changes Apr 24, 2024

View reviewed changes

jhchabran approved these changes Apr 25, 2024

View reviewed changes

Strum355 and others added 8 commits May 15, 2024 15:12

bazel: migrate legacy postgres-12 dockerfile to rules_oci

3cc6762

Add comments to oci_deps.bzl

d9d3349

Fix permissions for /var/lib/postgresql and /var/run/postgresql

b111544

Specify platform for oci_pull

db30248

Seeing error: index.docker.io/library/postgres is a multi-architecture image, so attribute 'platforms' is required

Fix external references in codeintel-db

ed20d5d

Fix typo

45b585a

Use linux/x86_64 postgres image

3ac5a3e

Apply container structure test to new image + add arch test

edaad8c

willdollman added 2 commits May 15, 2024 15:13

Reorganise files to move currently-shipped image configs to the top

ce76bdb

Fix team name

636753d

Strum355 force-pushed the nsc/legacy-pgsql-image-bazel branch from 100ac4c to 636753d Compare May 15, 2024 14:13

Strum355 merged commit 0c51c9b into main May 15, 2024

Strum355 deleted the nsc/legacy-pgsql-image-bazel branch May 15, 2024 14:22

Strum355 added a commit that referenced this pull request May 15, 2024

bazel: migrate legacy postgres-12 dockerfile to rules_oci (#61963)

0260dff

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bazel: migrate legacy postgres-12 dockerfile to rules_oci#61963

bazel: migrate legacy postgres-12 dockerfile to rules_oci#61963
Strum355 merged 10 commits into
mainfrom
nsc/legacy-pgsql-image-bazel

Strum355 commented Apr 17, 2024 •

edited by DaedalusG

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

willdollman Apr 24, 2024

Uh oh!

willdollman commented Apr 24, 2024

Uh oh!

willdollman left a comment

Uh oh!

jhchabran left a comment •

edited

Loading

Uh oh!

jhchabran Apr 25, 2024

Uh oh!

willdollman Apr 25, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Strum355 commented Apr 17, 2024 • edited by DaedalusG Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test plan

Uh oh!

Uh oh!

Uh oh!

Uh oh!

willdollman Apr 24, 2024

Choose a reason for hiding this comment

Uh oh!

willdollman commented Apr 24, 2024

Uh oh!

willdollman left a comment

Choose a reason for hiding this comment

Uh oh!

jhchabran left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jhchabran Apr 25, 2024

Choose a reason for hiding this comment

Uh oh!

willdollman Apr 25, 2024

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Strum355 commented Apr 17, 2024 •

edited by DaedalusG

Loading

jhchabran left a comment •

edited

Loading