Introduce a read-only user for data-replication #4551
Conversation
TheOneFromNorway
had a problem deploying
to
qa
GitHub Actions
Failure
TheOneFromNorway
force-pushed
the
ro_user_for_data_replication
branch
from
287fe11 to
b07f54f
Compare
| @@ -124,6 +124,10 @@ locals { | |||
| { | |||
| name = "RAILS_MASTER_KEY" | |||
| valueFrom = var.rails_master_key_path | |||
| }, | |||
| { | |||
| name = "RO_DB_PASSWORD" | |||
There was a problem hiding this comment.
| name = "RO_DB_PASSWORD" | |
| name = "READ_ONLY_DB_PASSWORD" |
Is there any reason not to use the full name? It took me a while to work out what "ro" stood for reading this!
There was a problem hiding this comment.
ro is standard abbreviation for denoting read-only in the dba world but I have expanded it here for clarity (readonly_user was changed to grafana_ro to reflect reader scope more accurately)
There was a problem hiding this comment.
There are a few other places where we've still got ro (grafana_ro, ro_db_password, ro-db-password for example). I think it be worth updating these too for consistency.
TheOneFromNorway
force-pushed
the
ro_user_for_data_replication
branch
from
b07f54f to
5610a96
Compare
- User must be created within aws account due to database living in private subnet - For simplicity just create user on startup of application if does not already exist - Password is managed via terraform and injected into container
TheOneFromNorway
force-pushed
the
ro_user_for_data_replication
branch
from
5610a96 to
e50a8b4
Compare
|
| @@ -36,7 +36,7 @@ resource "aws_rds_cluster" "cluster" { | |||
| } | |||
|
|
|||
| lifecycle { | |||
| ignore_changes = [cluster_identifier] | |||
| ignore_changes = [cluster_identifier, snapshot_identifier] | |||
There was a problem hiding this comment.
Is that really what we want? I would imagine the cluster should be recreated if the snapshot_identifier changes
There was a problem hiding this comment.
As we have an option in the workflow to decide whether or not we actually want to recreate the database I would only want to trigger the recreation when that option is specified, otherwise we will recreate every deploy that is 12 hours apart regardless of this option.
Ticket: MAV-1941