Run plugin job for Pixie Cloud on GKE envs

Summary: We want to run the plugin job every release, to ensure that we keep the plugins up-to-date. this job already runs for public cloud, but does not run for our GKE environments as they need a sidecar.

Test Plan: deploy to testing cloud through skaffold, watch the job run.

Reviewers: vihang

Reviewed By: vihang

Signed-off-by: Michelle Nguyen <michellenguyen@pixielabs.ai>

Differential Revision: https://phab.corp.pixielabs.ai/D11241

GitOrigin-RevId: a371153

k8s/cloud/BUILD.bazel

@@ -29,6 +29,7 @@ CLOUD_IMAGE_MAP = {
     "gcr.io/pixie-oss/pixie-dev/cloud/indexer_server_image": "//src/cloud/indexer:indexer_server_image",
     "gcr.io/pixie-oss/pixie-dev/cloud/job/create_admin_job_image": "//src/cloud/jobs/create_admin_user:create_admin_job_image",
     "gcr.io/pixie-oss/pixie-dev/cloud/metrics_server_image": "//src/cloud/metrics:metrics_server_image",
+    "gcr.io/pixie-oss/pixie-dev/cloud/plugin/load_db": "//src/cloud/plugin/load_db:plugin_db_updater_image",
     "gcr.io/pixie-oss/pixie-dev/cloud/plugin_server_image": "//src/cloud/plugin:plugin_server_image",
     "gcr.io/pixie-oss/pixie-dev/cloud/profile_server_image": "//src/cloud/profile:profile_server_image",
     "gcr.io/pixie-oss/pixie-dev/cloud/project_manager_server_image": "//src/cloud/project_manager:project_manager_server_image",

k8s/cloud/overlays/plugin_job/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+commonLabels:
+  app: pl-cloud
+resources:
+- plugin_job.yaml

k8s/cloud/overlays/plugin_job/plugin_job.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: plugin-db-updater-job
+  labels:
+    jobgroup: plugin-db-updater
+spec:
+  ttlSecondsAfterFinished: 10
+  template:
+    metadata:
+      name: plugin-db-updater-job
+      labels:
+        jobgroup: plugin-db-updater
+    spec:
+      containers:
+      - name: updater
+        image: gcr.io/pixie-oss/pixie-dev/cloud/plugin/load_db:latest
+        command: ["/busybox/sh", "-c"]
+        args:
+        - |
+            trap "touch /tmp/pod/terminated" EXIT
+            /plugin_db_updater/load_db
+        envFrom:
+        - configMapRef:
+            name: pl-db-config
+        volumeMounts:
+        - mountPath: /tmp/pod
+          name: tmp-pod
+        env:
+        - name: PL_POSTGRES_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: pl-db-secrets
+              key: PL_POSTGRES_USERNAME
+        - name: PL_POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: pl-db-secrets
+              key: PL_POSTGRES_PASSWORD
+        - name: PL_PLUGIN_REPO
+          value: "pixie-io/pixie-plugin"
+      - image: b.gcr.io/cloudsql-docker/gce-proxy:1.14
+        name: cloudsql-proxy
+        command: ["/bin/sh", "-c"]
+        envFrom:
+        - configMapRef:
+            name: pl-db-config
+        args:
+        - |
+            /cloud_sql_proxy \
+            -instances=${PL_POSTGRES_INSTANCE}=tcp:${PL_POSTGRES_PORT} \
+            -ip_address_types=PRIVATE \
+            -credential_file=/secrets/cloudsql/db_service_account.json & CHILD_PID=$!
+            (while true; do if [[ -f "/tmp/pod/terminated" ]]; then kill $CHILD_PID;
+            echo "Killed $CHILD_PID because the main container terminated."; fi; sleep 1; done) &
+            wait $CHILD_PID
+            if [[ -f "/tmp/pod/terminated" ]]; then exit 0; echo "Job completed. Exiting..."; fi
+        volumeMounts:
+        - name: pl-db-secrets
+          mountPath: /secrets/cloudsql
+          readOnly: true
+        - mountPath: /tmp/pod
+          name: tmp-pod
+          readOnly: true
+        securityContext:
+          runAsUser: 2  # non-root user
+          allowPrivilegeEscalation: false
+      restartPolicy: Never
+      volumes:
+      - name: pl-db-secrets
+        secret:
+          secretName: pl-db-secrets
+      - name: tmp-pod
+        emptyDir: {}
+  backoffLimit: 1
+  parallelism: 1
+  completions: 1

k8s/cloud/prod/kustomization.yaml

@@ -25,6 +25,7 @@ resources:
 - vzconn_backend_config.yaml
 - ../base
 - ../overlays/exposed_services_gclb
+- ../overlays/plugin_job
 patchesStrategicMerge:
 - support_access_config.yaml
 - analytics_config.yaml

k8s/cloud/staging/kustomization.yaml

@@ -23,6 +23,7 @@ resources:
 - vzconn_backend_config.yaml
 - ../base
 - ../overlays/exposed_services_gclb
+- ../overlays/plugin_job
 patchesStrategicMerge:
 - support_access_config.yaml
 - analytics_config.yaml

k8s/cloud/testing/kustomization.yaml

@@ -23,6 +23,7 @@ resources:
 - vzconn_backend_config.yaml
 - ../base
 - ../overlays/exposed_services_gclb
+- ../overlays/plugin_job
 patchesStrategicMerge:
 - bq_config.yaml
 - support_access_config.yaml