SOPs - Standard Operation Procedures¶

Day 0¶

In order for Constellation to be deployed, the following resources and settings are either not codified or are managed outside of Terraform:

Constellation AWS Accounts including SSO -> Managed by constellation/aws-management
Constellation Roles (Engineering & Admin) -> Managed by constellation/aws-management
S3 Bucket for TF state; currently done here -> Will move to constellation/aws-management
Azure App Registrations (Constellation-ArgoCD & Constellation-Grafana); Secrets in AWS SM -> Should be done using the Azure Provider; requires an SP with appropriate RBAC
clear-route/constellation-iac GHA IAM role for TF provisioning; currently here -> Will be done by constellation/aws-management
Constellation Github App created manually (used by ArgoCD)

Postgres Snapshot Creation & Restore¶

Snapshot Creation¶

The RDS DB instances are isolated and not accessible from localhost or outside the cluster.

If you need a Postgres dump, you can apply the following manifests and execute the commands below to create a dump and copy it to your local machine:

apiVersion: v1
kind: Pod
metadata:
  name: pg-sleeper
  labels:
    app: pg-sleeper
    allow-egress-rds: "true"
spec:
  containers:
    - name: postgres
      image: postgres:17
      command: ["sleep", "infinity"]
      envFrom:
        - secretRef:
            name: secrets
      imagePullPolicy: IfNotPresent
      stdin: true
      tty: true
  restartPolicy: Never

kubectl apply -f postgres-dump.yml -n app-atlas # Change to your app namespace
kubectl exec -it -n app-atlas pg-sleeper -- sh -c 'PGDATABASE=$DB_NAME pg_dump > /tmp/$DB_NAME.dump'
kubectl cp -n app-atlas pg-sleeper:/tmp/atlas.dump atlas.dump # Change to your app namespace specific DB_NAME, usually the app name
less atlas.dump # Inspect the dump
kubectl delete -f postgres-dump.yml -n app-atlas # Change to your app namespace

Snapshot Restore¶

tbd.

Running an Arbitrary Postgres Query¶

The RDS DB instances are isolated and not accessible from localhost or outside the cluster, so queries must be run from a pod in the app namespace. Reuse the pg-sleeper pod from Snapshot Creation (it has the DB credentials via envFrom: secretRef: secrets, which provides DB_NAME and the standard PG* connection vars).

kubectl apply -f postgres-dump.yml -n app-atlas   # Change to your app namespace

Open an interactive psql REPL:

kubectl exec -it -n app-atlas pg-sleeper -- sh -c 'PGDATABASE=$DB_NAME psql'

Run a single query non-interactively with -c:

kubectl exec -n app-atlas pg-sleeper -- \
  sh -c 'PGDATABASE=$DB_NAME psql -c "select count(*) from picks;"'

Export a query result to a local CSV with --csv and redirecting stdout:

kubectl exec -n app-atlas pg-sleeper -- \
  sh -c 'PGDATABASE=$DB_NAME psql --csv -c "select user_id, match_id, created_at from picks;"' \
  > picks.csv

Clean up when done:

kubectl delete -f postgres-dump.yml -n app-atlas   # Change to your app namespace