Initial support for helm cloudsql proxy in migrations (#24412)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.

changes/24033-helm-customization-options

@@ -0,0 +1 @@
+Helm chart: Supported customization options such as the Google cloud_sql_proxy in the fleet-migration job.

charts/fleet/Chart.yaml

@@ -4,7 +4,7 @@ name: fleet
 keywords:
   - fleet
   - osquery
-version: v6.2.4
+version: v6.3.0
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git

charts/fleet/templates/job-migration.yaml

@@ -33,10 +33,16 @@ spec:
         release: {{ .Release.Name }}
     spec:
       restartPolicy: Never
+      shareProcessNamespace: true
       containers:
       - name: fleet-migration
-        command: [/usr/bin/fleet]
-        args: ["prepare","db","--no-prompt"]
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            /usr/bin/fleet prepare db --no-prompt;
+            {{- if .Values.gke.cloudSQL.enableProxy }}
+            sql_proxy_pid=$(pgrep cloud_sql_proxy) && kill -INT $sql_proxy_pid;
+            {{- end }}
         image: "{{ .Values.imageRepository }}:{{ .Values.imageTag }}"
         resources:
           limits:
@@ -117,7 +123,12 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
+            {{- if .Values.gke.cloudSQL.enableProxy }}
+            add:
+              - SYS_PTRACE
+            {{- else }}
             drop: [ALL]
+            {{- end }}
           privileged: false
           readOnlyRootFilesystem: true
           runAsGroup: 3333
@@ -129,6 +140,31 @@ spec:
             readOnly: true
             mountPath: /secrets/mysql
           {{- end }}
+      {{- if .Values.gke.cloudSQL.enableProxy }}
+      - name: cloudsql-proxy
+        image: "{{ .Values.gke.cloudSQL.imageRepository }}:{{ .Values.gke.cloudSQL.imageTag }}"
+        command:
+        - "/cloud_sql_proxy"
+        - "-verbose={{ .Values.gke.cloudSQL.verbose}}"
+        - "-instances={{ .Values.gke.cloudSQL.instanceName }}=tcp:3306"
+        resources:
+          limits:
+            cpu: 0.5 # 500Mhz
+            memory: 150Mi
+          requests:
+            cpu: 0.1 # 100Mhz
+            memory: 50Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 3333
+          runAsUser: 3333
+          runAsNonRoot: true
+      {{- end }}
+      serviceAccountName: fleet
       volumes:
         {{- if .Values.database.tls.enabled }}
         - name: mysql-tls

charts/fleet/templates/rbac.yaml

@@ -1,6 +1,10 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
   labels:
     app: fleet
     chart: fleet
@@ -24,6 +28,10 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
   labels:
     app: fleet
     chart: fleet

charts/fleet/templates/sa.yaml

@@ -1,8 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-{{- if or .Values.serviceAccountAnnotations .Values.gke.workloadIdentityEmail }}
   annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
+  {{- if or .Values.serviceAccountAnnotations .Values.gke.workloadIdentityEmail }}
   {{- with .Values.serviceAccountAnnotations}}
   {{ toYaml . | trim | indent 2}}
   {{- end }}