From 5d46ccf93b679e9577e39e7542e4b7040e095793 Mon Sep 17 00:00:00 2001
From: akshat5302 <akshatjain9782@gmail.com>
Date: Wed, 8 Jul 2026 12:45:19 +0530
Subject: [PATCH] chore: add opensearch-index-job component and enable it in
 phoenix overlay

Mirrors makeplane/internal-scripts#44: a one-off Job that rebuilds the
OpenSearch document index (manage_search_index document index --force
--parallel) on the backend-commercial image, referenced before
nonroot-security-context and custom-ca so it receives their patches.
---
 .../components/opensearch-index-job/job.yaml  | 53 +++++++++++++++++++
 .../opensearch-index-job/kustomization.yaml   | 10 ++++
 kustomize/overlays/phoenix/kustomization.yaml |  8 +++
 3 files changed, 71 insertions(+)
 create mode 100644 kustomize/components/opensearch-index-job/job.yaml
 create mode 100644 kustomize/components/opensearch-index-job/kustomization.yaml

diff --git a/kustomize/components/opensearch-index-job/job.yaml b/kustomize/components/opensearch-index-job/job.yaml
new file mode 100644
index 0000000..ed6ffa2
--- /dev/null
+++ b/kustomize/components/opensearch-index-job/job.yaml
@@ -0,0 +1,53 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: plane-opensearch-index
+  namespace: plane
+  labels:
+    app.kubernetes.io/name: plane-enterprise
+    app.kubernetes.io/component: opensearch-index
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 7200  # Auto-cleanup after 2 hours
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plane-enterprise
+        app.kubernetes.io/component: opensearch-index
+      annotations:
+        # Update this timestamp to force a new job creation
+        # Use: date +%Y%m%d-%H%M%S
+        run-timestamp: "20250209-000000"
+    spec:
+      restartPolicy: OnFailure
+      serviceAccountName: plane-srv-account
+      containers:
+        - name: opensearch-index
+          image: makeplane/backend-commercial:v2.3.4
+          imagePullPolicy: Always
+          command:
+            - python
+            - manage.py
+            - manage_search_index
+            - document
+            - index
+            - --force
+            - --parallel
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+            - secretRef:
+                name: plane-app-secrets
+            - secretRef:
+                name: plane-doc-store-secrets
+            - secretRef:
+                name: plane-opensearch-secrets
+            - secretRef:
+                name: plane-silo-secrets
+          resources:
+            requests:
+              memory: 4Gi
+              cpu: "2"
+            limits:
+              memory: 8Gi
+              cpu: "4"
diff --git a/kustomize/components/opensearch-index-job/kustomization.yaml b/kustomize/components/opensearch-index-job/kustomization.yaml
new file mode 100644
index 0000000..80c44b5
--- /dev/null
+++ b/kustomize/components/opensearch-index-job/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+# Optional one-off Job that (re)builds the OpenSearch document index by running
+#   python manage.py manage_search_index document index --force --parallel
+# on the API (backend-commercial) image. Uses the same ConfigMap/Secrets as the
+# API deployment (incl. OpenSearch). Disabled by default — enable it from the
+# overlay's `components:` list when a reindex is needed.
+resources:
+  - job.yaml
diff --git a/kustomize/overlays/phoenix/kustomization.yaml b/kustomize/overlays/phoenix/kustomization.yaml
index 0f912a9..fe638db 100644
--- a/kustomize/overlays/phoenix/kustomization.yaml
+++ b/kustomize/overlays/phoenix/kustomization.yaml
@@ -40,6 +40,14 @@ components:
   - ../../components/external-api
   # Worker importers (celery.importer queue)
   - ../../components/worker-importers
+  # One-off Job: rebuild the OpenSearch document index
+  # (manage_search_index document index --force --parallel) on the API image.
+  # Enabled to run a reindex; bump the Job's run-timestamp to re-trigger, and
+  # re-comment (or remove) once the reindex has completed so it does not re-fire
+  # on the next bundle deploy. MUST stay before nonroot-security-context and
+  # custom-ca so those components patch the Job (security context + CA init
+  # container) like every other workload.
+  - ../../components/opensearch-index-job
   # Optional: enable non-root security context on all workload Deployments (recommended for hardened environments)
   # Keep this AFTER pi-service and mcp-server so it patches all workloads.
   - ../../components/nonroot-security-context