From acdc526d1bca9605622963d61be7877ba0385cce Mon Sep 17 00:00:00 2001
From: Robert Fairburn <8029478+rfairburn@users.noreply.github.com>
Date: Wed, 18 Dec 2024 11:44:32 -0600
Subject: [PATCH] Initial support for helm cloudsql proxy in migrations
 (#24412)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
---
 changes/24033-helm-customization-options  |  1 +
 charts/fleet/Chart.yaml                   |  2 +-
 charts/fleet/templates/job-migration.yaml | 40 +++++++++++++++++++++--
 charts/fleet/templates/rbac.yaml          |  8 +++++
 charts/fleet/templates/sa.yaml            |  5 ++-
 5 files changed, 52 insertions(+), 4 deletions(-)
 create mode 100644 changes/24033-helm-customization-options

diff --git a/changes/24033-helm-customization-options b/changes/24033-helm-customization-options
new file mode 100644
index 0000000000..1aafbedcde
--- /dev/null
+++ b/changes/24033-helm-customization-options
@@ -0,0 +1 @@
+Helm chart: Supported customization options such as the Google cloud_sql_proxy in the fleet-migration job.
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index 5ddc8cd562..c8e2ee9e5d 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -4,7 +4,7 @@ name: fleet
 keywords:
   - fleet
   - osquery
-version: v6.2.4
+version: v6.3.0
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
diff --git a/charts/fleet/templates/job-migration.yaml b/charts/fleet/templates/job-migration.yaml
index cd2e963712..96737d07e7 100644
--- a/charts/fleet/templates/job-migration.yaml
+++ b/charts/fleet/templates/job-migration.yaml
@@ -33,10 +33,16 @@ spec:
         release: {{ .Release.Name }}
     spec:
       restartPolicy: Never
+      shareProcessNamespace: true
       containers:
       - name: fleet-migration
-        command: [/usr/bin/fleet]
-        args: ["prepare","db","--no-prompt"]
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            /usr/bin/fleet prepare db --no-prompt;
+            {{- if .Values.gke.cloudSQL.enableProxy }}
+            sql_proxy_pid=$(pgrep cloud_sql_proxy) && kill -INT $sql_proxy_pid;
+            {{- end }}
         image: "{{ .Values.imageRepository }}:{{ .Values.imageTag }}"
         resources:
           limits:
@@ -117,7 +123,12 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
+            {{- if .Values.gke.cloudSQL.enableProxy }}
+            add:
+              - SYS_PTRACE
+            {{- else }}
             drop: [ALL]
+            {{- end }}
           privileged: false
           readOnlyRootFilesystem: true
           runAsGroup: 3333
@@ -129,6 +140,31 @@ spec:
             readOnly: true
             mountPath: /secrets/mysql
           {{- end }}
+      {{- if .Values.gke.cloudSQL.enableProxy }}
+      - name: cloudsql-proxy
+        image: "{{ .Values.gke.cloudSQL.imageRepository }}:{{ .Values.gke.cloudSQL.imageTag }}"
+        command:
+        - "/cloud_sql_proxy"
+        - "-verbose={{ .Values.gke.cloudSQL.verbose}}"
+        - "-instances={{ .Values.gke.cloudSQL.instanceName }}=tcp:3306"
+        resources:
+          limits:
+            cpu: 0.5 # 500Mhz
+            memory: 150Mi
+          requests:
+            cpu: 0.1 # 100Mhz
+            memory: 50Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 3333
+          runAsUser: 3333
+          runAsNonRoot: true
+      {{- end }}
+      serviceAccountName: fleet
       volumes:
         {{- if .Values.database.tls.enabled }}
         - name: mysql-tls
diff --git a/charts/fleet/templates/rbac.yaml b/charts/fleet/templates/rbac.yaml
index fc689d1a2f..a0a43f5d43 100644
--- a/charts/fleet/templates/rbac.yaml
+++ b/charts/fleet/templates/rbac.yaml
@@ -1,6 +1,10 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
   labels:
     app: fleet
     chart: fleet
@@ -24,6 +28,10 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
   labels:
     app: fleet
     chart: fleet
diff --git a/charts/fleet/templates/sa.yaml b/charts/fleet/templates/sa.yaml
index 67fba2c97b..351ab3f3f2 100644
--- a/charts/fleet/templates/sa.yaml
+++ b/charts/fleet/templates/sa.yaml
@@ -1,8 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-{{- if or .Values.serviceAccountAnnotations .Values.gke.workloadIdentityEmail }}
   annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-weight": "-1"
+  {{- if or .Values.serviceAccountAnnotations .Values.gke.workloadIdentityEmail }}
   {{- with .Values.serviceAccountAnnotations}}
   {{ toYaml . | trim | indent 2}}
   {{- end }}