Access your teaching qualifications - Operations

Cluster access

Anything that talks to a cluster, including the Rails console below, needs the Azure CLI installed and a PIM (Privileged Identity Management) activation for production, preprod or test.

Activating PIM does not update credentials you already have, so kubectl and every make target that reaches a cluster keep being refused until you fetch them again. Do this after each activation:

make production get-cluster-credentials

Accessing the Rails console

We have a helpful command you can run that will connect you to the right Azure resource.

make test railsc
make preprod railsc
make production railsc
make review railsc PR_NUMBER=<PR_NUMBER>

The review app needs to be deployed first. You can do this manually by tagging a PR with the deploy label.

Running a rake task

Same access as the console above. railstask runs a task in a deployed pod rather than opening a shell.

make test railstask TASK=db:version
make production railstask TASK=db:version

Quote the task if it takes an argument, or zsh reads the brackets as a glob:

make production railstask TASK='some:task[an-argument]'

WORKER=1 runs against the sidekiq deployment instead of the web one, for when the web deployment is scaled to zero:

make production railstask WORKER=1 TASK=db:version

Updating keyvault secrets

Updating keyvault secrets is a manual process which will require elevated permissions via PIM for production access to Azure resources, the resource can be found in:

Review: s189t01-aytq-rv-app-kv
Test: s189t01-aytq-ts-app-kv
Preproduction: s189t01-aytq-pp-inf-kv
Production: s189p01-aytq-pd-app-kv