如何在Kubernetes中用Hasura元数据JSON自动配置Docker容器

要实现Pod创建时自动完成数据库连接、角色权限、事件触发器等预配置，核心是让Hasura容器启动后自动导入你导出的元数据文件，下面是两种可靠的实现方式：

一、先将元数据文件存入Kubernetes ConfigMap #

首先把本地的元数据文件导入K8s ConfigMap，让Pod可以挂载访问：

kubectl create configmap hasura-metadata --from-file=hasura_metadata_2023_02_23_16_59_45_407.json

二、方法1：使用Init Container完成元数据导入 #

Init Container会在Hasura主容器就绪后运行，专门负责元数据导入操作。推荐用官方hasura/graphql-engine-cli镜像，自带Hasura命令行工具，操作更便捷：

Deployment示例YAML #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hasura
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hasura
  template:
    metadata:
      labels:
        app: hasura
    spec:
      containers:
      - name: hasura
        image: hasura/graphql-engine:latest
        ports:
        - containerPort: 8080
        env:
        - name: HASURA_GRAPHQL_ADMIN_SECRET
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: admin-secret
        - name: HASURA_GRAPHQL_DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: db-url
        - name: HASURA_GRAPHQL_ENABLE_METADATA_API
          value: "true"
      initContainers:
      - name: import-metadata
        image: hasura/graphql-engine-cli:latest
        command: ["/bin/sh", "-c"]
        args:
        - |
          # 循环等待Hasura服务就绪
          until curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/healthz -H "X-Hasura-Admin-Secret: ${HASURA_GRAPHQL_ADMIN_SECRET}" | grep -q 200; do
            echo "Waiting for Hasura to be ready..."
            sleep 5
          done
          # 执行元数据导入
          hasura metadata import --endpoint http://localhost:8080 --admin-secret ${HASURA_GRAPHQL_ADMIN_SECRET} --file /metadata/hasura_metadata_2023_02_23_16_59_45_407.json
        env:
        - name: HASURA_GRAPHQL_ADMIN_SECRET
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: admin-secret
        volumeMounts:
        - name: metadata-volume
          mountPath: /metadata
      volumes:
      - name: metadata-volume
        configMap:
          name: hasura-metadata

前置准备 #

先创建hasura-secrets Secret存储管理员密钥和数据库连接字符串：

kubectl create secret generic hasura-secrets --from-literal=admin-secret=your-admin-password --from-literal=db-url=postgres://user:pass@db-host:5432/db-name

三、方法2：修改Hasura容器启动命令，内置导入逻辑 #

如果不想用额外的Init Container，可以直接在Hasura容器的启动命令中串联启动和导入操作，用curl直接调用元数据API：

Deployment核心片段 #

containers:
- name: hasura
  image: hasura/graphql-engine:latest
  ports:
  - containerPort: 8080
  command: ["/bin/sh", "-c"]
  args:
  - |
    # 后台启动Hasura服务
    graphql-engine serve &
    # 等待服务就绪
    until curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/healthz -H "X-Hasura-Admin-Secret: ${HASURA_GRAPHQL_ADMIN_SECRET}" | grep -q 200; do
      echo "Waiting for Hasura to start..."
      sleep 3
    done
    # 调用API导入元数据
    curl -X POST http://localhost:8080/v1/metadata \
      -H "Content-Type: application/json" \
      -H "X-Hasura-Admin-Secret: ${HASURA_GRAPHQL_ADMIN_SECRET}" \
      -d @/metadata/hasura_metadata_2023_02_23_16_59_45_407.json
    # 保持前台进程，避免Pod退出
    wait
  env:
  - name: HASURA_GRAPHQL_ADMIN_SECRET
    valueFrom:
      secretKeyRef:
        name: hasura-secrets
        key: admin-secret
  - name: HASURA_GRAPHQL_DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: hasura-secrets
        key: db-url
  volumeMounts:
  - name: metadata-volume
    mountPath: /metadata
volumes:
- name: metadata-volume
  configMap:
    name: hasura-metadata

四、验证导入结果 #

Pod启动后，执行以下命令检查元数据是否成功导入：

kubectl exec -it <hasura-pod-name> -- curl -X GET http://localhost:8080/v1/metadata \
  -H "X-Hasura-Admin-Secret: your-admin-password"

返回的JSON应包含你导出的数据库连接、角色权限、事件触发器等所有配置。

内容的提问来源于stack exchange，提问作者Jackk-Doe