{{- if .Values.supervisor.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "trigger-v4.supervisorServiceAccountName" . }} labels: {{- $component := "supervisor" }} {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} {{- with .Values.supervisor.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} --- {{- if .Values.supervisor.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "trigger-v4.supervisorRoleName" . }} namespace: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace }} labels: {{- $component := "supervisor" }} {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} rules: - apiGroups: [""] resources: ["pods"] verbs: ["create", "delete", "deletecollection", "get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "trigger-v4.supervisorRoleName" . }}-binding namespace: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace }} labels: {{- $component := "supervisor" }} {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} subjects: - kind: ServiceAccount name: {{ include "trigger-v4.supervisorServiceAccountName" . }} namespace: {{ default .Release.Namespace }} roleRef: kind: Role name: {{ include "trigger-v4.supervisorRoleName" . }} apiGroup: rbac.authorization.k8s.io {{- end }} --- apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "trigger-v4.fullname" . }}-supervisor labels: {{- $component := "supervisor" }} {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} spec: replicas: 1 strategy: type: RollingUpdate rollingUpdate: maxUnavailable: 0 maxSurge: 1 selector: matchLabels: {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 6 }} template: metadata: labels: {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 8 }} {{- with .Values.supervisor.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} spec: serviceAccountName: {{ include "trigger-v4.supervisorServiceAccountName" . }} securityContext: fsGroup: 1000 {{- with .Values.supervisor.podSecurityContext }} {{- toYaml . | nindent 8 }} {{- end }} {{- if not .Values.webapp.bootstrap.enabled }} initContainers: - name: init-shared image: busybox:1.35 command: ['sh', '-c', 'mkdir -p /home/node/shared'] securityContext: runAsUser: 1000 volumeMounts: - name: shared mountPath: /home/node/shared {{- end }} containers: - name: supervisor image: {{ include "trigger-v4.supervisor.image" . }} imagePullPolicy: {{ .Values.supervisor.image.pullPolicy }} ports: - name: workload containerPort: {{ .Values.supervisor.service.ports.workload }} protocol: TCP - name: metrics containerPort: {{ .Values.supervisor.service.ports.metrics }} protocol: TCP {{- if .Values.supervisor.livenessProbe.enabled }} livenessProbe: httpGet: path: /health port: workload initialDelaySeconds: {{ .Values.supervisor.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.supervisor.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.supervisor.livenessProbe.timeoutSeconds }} failureThreshold: {{ .Values.supervisor.livenessProbe.failureThreshold }} successThreshold: {{ .Values.supervisor.livenessProbe.successThreshold }} {{- end }} {{- if .Values.supervisor.readinessProbe.enabled }} readinessProbe: httpGet: path: /health port: workload initialDelaySeconds: {{ .Values.supervisor.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.supervisor.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.supervisor.readinessProbe.timeoutSeconds }} failureThreshold: {{ .Values.supervisor.readinessProbe.failureThreshold }} successThreshold: {{ .Values.supervisor.readinessProbe.successThreshold }} {{- end }} {{- if .Values.supervisor.startupProbe.enabled }} startupProbe: httpGet: path: /health port: workload initialDelaySeconds: {{ .Values.supervisor.startupProbe.initialDelaySeconds }} periodSeconds: {{ .Values.supervisor.startupProbe.periodSeconds }} timeoutSeconds: {{ .Values.supervisor.startupProbe.timeoutSeconds }} failureThreshold: {{ .Values.supervisor.startupProbe.failureThreshold }} successThreshold: {{ .Values.supervisor.startupProbe.successThreshold }} {{- end }} resources: {{- toYaml .Values.supervisor.resources | nindent 12 }} env: # Core configuration - name: TRIGGER_API_URL value: "http://{{ include "trigger-v4.fullname" . }}-webapp:{{ .Values.webapp.service.port }}" - name: TRIGGER_WORKER_TOKEN {{- if .Values.webapp.bootstrap.enabled }} valueFrom: secretKeyRef: name: {{ include "trigger-v4.fullname" . }}-worker-token key: token {{- else if .Values.supervisor.bootstrap.workerToken.secret.name }} valueFrom: secretKeyRef: name: {{ .Values.supervisor.bootstrap.workerToken.secret.name }} key: {{ .Values.supervisor.bootstrap.workerToken.secret.key }} {{- else }} value: {{ .Values.supervisor.bootstrap.workerToken.value | quote }} {{- end }} {{- if or .Values.secrets.enabled .Values.secrets.existingSecret }} - name: MANAGED_WORKER_SECRET valueFrom: secretKeyRef: name: {{ include "trigger-v4.secretsName" . }} key: MANAGED_WORKER_SECRET {{- end }} # Worker instance configuration - name: TRIGGER_WORKER_INSTANCE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName # Kubernetes configuration - name: KUBERNETES_NAMESPACE value: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace | quote }} - name: KUBERNETES_FORCE_ENABLED value: {{ .Values.supervisor.config.kubernetes.forceEnabled | quote }} - name: KUBERNETES_WORKER_NODETYPE_LABEL value: {{ .Values.supervisor.config.kubernetes.workerNodetypeLabel | quote }} {{- $registryAuthEnabled := false }} {{- if .Values.registry.deploy }} {{- $registryAuthEnabled = .Values.registry.auth.enabled }} {{- else }} {{- $registryAuthEnabled = .Values.registry.external.auth.enabled }} {{- end }} {{- if $registryAuthEnabled }} - name: KUBERNETES_IMAGE_PULL_SECRETS value: "{{ include "trigger-v4.fullname" . }}-registry-secret" {{- end }} - name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT value: {{ default "10Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeLimit | quote }} - name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST value: {{ default "2Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeRequest | quote }} # Pod cleaner configuration - name: POD_CLEANER_ENABLED value: {{ .Values.supervisor.config.podCleaner.enabled | quote }} - name: POD_CLEANER_BATCH_SIZE value: {{ .Values.supervisor.config.podCleaner.batchSize | quote }} - name: POD_CLEANER_INTERVAL_MS value: {{ .Values.supervisor.config.podCleaner.intervalMs | quote }} # Failed pod handler - name: FAILED_POD_HANDLER_ENABLED value: {{ .Values.supervisor.config.failedPodHandler.enabled | quote }} - name: FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS value: {{ .Values.supervisor.config.failedPodHandler.reconnectIntervalMs | quote }} # Workload API configuration - name: TRIGGER_WORKLOAD_API_PROTOCOL value: {{ .Values.supervisor.config.workloadApi.protocol | quote }} - name: TRIGGER_WORKLOAD_API_DOMAIN value: "{{ include "trigger-v4.fullname" . }}-supervisor.{{ .Release.Namespace }}.svc.cluster.local" - name: TRIGGER_WORKLOAD_API_PORT_EXTERNAL value: {{ .Values.supervisor.config.workloadApi.portExternal | quote }} - name: TRIGGER_WORKLOAD_API_PORT_INTERNAL value: {{ .Values.supervisor.config.workloadApi.portInternal | quote }} - name: TRIGGER_WORKLOAD_API_HOST_INTERNAL value: {{ .Values.supervisor.config.workloadApi.hostInternal | quote }} - name: TRIGGER_WORKLOAD_API_ENABLED value: {{ .Values.supervisor.config.workloadApi.enabled | quote }} # Dequeue configuration - name: TRIGGER_DEQUEUE_ENABLED value: {{ .Values.supervisor.config.dequeue.enabled | quote }} - name: TRIGGER_DEQUEUE_INTERVAL_MS value: {{ .Values.supervisor.config.dequeue.intervalMs | quote }} - name: TRIGGER_DEQUEUE_MAX_RUN_COUNT value: {{ .Values.supervisor.config.dequeue.maxRunCount | quote }} - name: TRIGGER_DEQUEUE_IDLE_INTERVAL_MS value: {{ .Values.supervisor.config.dequeue.idleIntervalMs | quote }} # Heartbeat configuration - name: RUNNER_HEARTBEAT_INTERVAL_SECONDS value: {{ .Values.supervisor.config.runner.heartbeatIntervalSeconds | quote }} - name: RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS value: {{ .Values.supervisor.config.runner.snapshotPollIntervalSeconds | quote }} # Metrics configuration - name: METRICS_ENABLED value: {{ .Values.supervisor.config.metrics.enabled | quote }} - name: METRICS_COLLECT_DEFAULTS value: {{ .Values.supervisor.config.metrics.collectDefaults | quote }} - name: METRICS_HOST value: {{ .Values.supervisor.config.metrics.host | quote }} - name: METRICS_PORT value: {{ .Values.supervisor.config.metrics.port | quote }} # Debug - name: DEBUG value: {{ .Values.supervisor.config.debug | quote }} # OTEL - name: OTEL_EXPORTER_OTLP_ENDPOINT value: "http://{{ include "trigger-v4.fullname" . }}-webapp.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.webapp.service.port }}/otel" {{- with .Values.supervisor.extraEnvVars }} {{- toYaml . | nindent 12 }} {{- end }} {{- if not .Values.webapp.bootstrap.enabled }} volumeMounts: - name: shared mountPath: /home/node/shared {{- end }} {{- with .Values.supervisor.securityContext }} securityContext: {{- toYaml . | nindent 12 }} {{- end }} {{- if not .Values.webapp.bootstrap.enabled }} volumes: - name: shared {{- if .Values.persistence.shared.enabled }} persistentVolumeClaim: claimName: {{ include "trigger-v4.fullname" . }}-shared {{- else }} emptyDir: {} {{- end }} {{- end }} {{- with .Values.supervisor.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.supervisor.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.supervisor.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} --- apiVersion: v1 kind: Service metadata: name: {{ include "trigger-v4.fullname" . }}-supervisor labels: {{- $component := "supervisor" }} {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} spec: type: {{ .Values.supervisor.service.type }} ports: - port: {{ .Values.supervisor.service.ports.workload }} targetPort: workload protocol: TCP name: workload - port: {{ .Values.supervisor.service.ports.metrics }} targetPort: metrics protocol: TCP name: metrics selector: {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}