migrations-job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: migration-job
  labels:
    tier: startup
  annotations:
    # This is what defines this resource as a hook. Without this line, the
    # job is considered part of the release.
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "0"
    # The next line is used for development so that you can see the logs
    # from this job, as the job will not be deleted upon completion.
    # In a non-prod env, consider 'hook-succeeded' instead.
    "helm.sh/hook-delete-policy": before-hook-creation
spec:
  # Helm hooks are not managed with their associated release. This setting tells the system to delete the job and all
  # associated resources 60 seconds after it's done. Practically, this means that if you need to check the logs on the
  # job, you get this long.
  ttlSecondsAfterFinished: 60
  template:
    metadata:
      name: migration-job
      labels:
        tier: startup
    spec:
      restartPolicy: Never
      volumes:
        - name: host-project
          hostPath:
            path: "{{ .Values.projectDir }}"
        - name: database-secrets
          secret:
            secretName: database-credentials
        - name: app-secrets
          secret:
            secretName: app-secrets
      containers:
        - name: migration-job
          image: "{{ .Values.imageTag }}"
          imagePullPolicy: "{{ .Values.imagePullPolicy }}"
          workingDir: /opt/project/server
          command: ["python"]
          args: ["manage.py", "migrate", "--noinput"]
          env:
            - name: SECRETS_ROOTPATH
              value: "{{ .Values.secrets.rootPath }}"
          volumeMounts:
            - name: host-project
              mountPath: /opt/project/
            - name: database-secrets
              mountPath: "{{ .Values.secrets.rootPath }}/database-secrets"
              readOnly: true
            - name: app-secrets
              mountPath: "{{ .Values.secrets.rootPath }}/app-secrets"
              readOnly: true