Before I can run Keystone in a container, I need to initialize the database. This is as true for running in Kubernetes as it was using podman. Here’s how I got keystone-db-init to work.
The general steps were:
- use oc new-app to generate the build-config and build
- delete the deployment config generated by new-app
- upload a secret containing keystone.conf
- deploy a pod that uses the image built above and the secret version of keystone.conf to run keystone-manage db_init
oc delete deploymentconfig.apps.openshift.io/keystone-db-in |
To upload the secret.
kubectl create secret generic keystone-conf --from-file=../keystone-db-init/keystone.conf |
Here is the yaml definition for the pod
apiVersion: v1
kind: Pod
metadata:
name: keystone-db-init-pod
labels:
app: myapp
spec:
containers:
- image: image-registry.openshift-image-registry.svc:5000/keystone/keystone-db-init
imagePullPolicy: Always
name: keystone-db-init
volumeMounts:
- name: keystone-conf
mountPath: "/etc/keystone/"
volumes:
- name: keystone-conf
secret:
secretName: keystone-conf
items:
- key: keystone.conf
path: keystone.conf
mode: 511
command: ['sh', '-c', 'cat /etc/keystone/keystone.conf'] |
While this is running as the keystone unix account, I am not certain how that happened. I did use the patch command I talked about earlier on the deployment config, but you can see I am not using that in this pod. That is something I need to straighten out.
To test that the database was initialized:
$ oc get pods -l app=mariadb-keystone NAME READY STATUS RESTARTS AGE mariadb-keystone-1-rxgvs 1/1 Running 0 9d $ oc rsh mariadb-keystone-1-rxgvs sh-4.2$ mysql -h mariadb-keystone -u keystone -pkeystone keystone Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 908 Server version: 10.2.22-MariaDB MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [keystone]> show tables; +------------------------------------+ | Tables_in_keystone | +------------------------------------+ | access_rule | | access_token | .... +------------------------------------+ 46 rows in set (0.00 sec) |
I’ve fooled myself in the past thinking that things have worked when they have note. To make sure I am not doing that now, I dropped the keystone database and recreated it from insider the mysql monitor program. I then re-ran the pod, and was able to see all of the tables.