wehub-resource-sync
295 lines
13 KiB
YAML
295 lines
13 KiB
YAML
{{- if .Values.supervisor.serviceAccount.create }}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ include "trigger-v4.supervisorServiceAccountName" . }}
|
|
labels:
|
|
{{- $component := "supervisor" }}
|
|
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
|
|
{{- with .Values.supervisor.serviceAccount.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
---
|
|
{{- if .Values.supervisor.rbac.create }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "trigger-v4.supervisorRoleName" . }}
|
|
namespace: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace }}
|
|
labels:
|
|
{{- $component := "supervisor" }}
|
|
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["create", "delete", "deletecollection", "get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "trigger-v4.supervisorRoleName" . }}-binding
|
|
namespace: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace }}
|
|
labels:
|
|
{{- $component := "supervisor" }}
|
|
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "trigger-v4.supervisorServiceAccountName" . }}
|
|
namespace: {{ default .Release.Namespace }}
|
|
roleRef:
|
|
kind: Role
|
|
name: {{ include "trigger-v4.supervisorRoleName" . }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "trigger-v4.fullname" . }}-supervisor
|
|
labels:
|
|
{{- $component := "supervisor" }}
|
|
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 8 }}
|
|
{{- with .Values.supervisor.podAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
serviceAccountName: {{ include "trigger-v4.supervisorServiceAccountName" . }}
|
|
securityContext:
|
|
fsGroup: 1000
|
|
{{- with .Values.supervisor.podSecurityContext }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- if not .Values.webapp.bootstrap.enabled }}
|
|
initContainers:
|
|
- name: init-shared
|
|
image: busybox:1.35
|
|
command: ['sh', '-c', 'mkdir -p /home/node/shared']
|
|
securityContext:
|
|
runAsUser: 1000
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /home/node/shared
|
|
{{- end }}
|
|
containers:
|
|
- name: supervisor
|
|
image: {{ include "trigger-v4.supervisor.image" . }}
|
|
imagePullPolicy: {{ .Values.supervisor.image.pullPolicy }}
|
|
ports:
|
|
- name: workload
|
|
containerPort: {{ .Values.supervisor.service.ports.workload }}
|
|
protocol: TCP
|
|
- name: metrics
|
|
containerPort: {{ .Values.supervisor.service.ports.metrics }}
|
|
protocol: TCP
|
|
{{- if .Values.supervisor.livenessProbe.enabled }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: workload
|
|
initialDelaySeconds: {{ .Values.supervisor.livenessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.supervisor.livenessProbe.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.supervisor.livenessProbe.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.supervisor.livenessProbe.failureThreshold }}
|
|
successThreshold: {{ .Values.supervisor.livenessProbe.successThreshold }}
|
|
{{- end }}
|
|
{{- if .Values.supervisor.readinessProbe.enabled }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: workload
|
|
initialDelaySeconds: {{ .Values.supervisor.readinessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.supervisor.readinessProbe.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.supervisor.readinessProbe.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.supervisor.readinessProbe.failureThreshold }}
|
|
successThreshold: {{ .Values.supervisor.readinessProbe.successThreshold }}
|
|
{{- end }}
|
|
{{- if .Values.supervisor.startupProbe.enabled }}
|
|
startupProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: workload
|
|
initialDelaySeconds: {{ .Values.supervisor.startupProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.supervisor.startupProbe.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.supervisor.startupProbe.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.supervisor.startupProbe.failureThreshold }}
|
|
successThreshold: {{ .Values.supervisor.startupProbe.successThreshold }}
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.supervisor.resources | nindent 12 }}
|
|
env:
|
|
# Core configuration
|
|
- name: TRIGGER_API_URL
|
|
value: "http://{{ include "trigger-v4.fullname" . }}-webapp:{{ .Values.webapp.service.port }}"
|
|
- name: TRIGGER_WORKER_TOKEN
|
|
{{- if .Values.webapp.bootstrap.enabled }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "trigger-v4.fullname" . }}-worker-token
|
|
key: token
|
|
{{- else if .Values.supervisor.bootstrap.workerToken.secret.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.supervisor.bootstrap.workerToken.secret.name }}
|
|
key: {{ .Values.supervisor.bootstrap.workerToken.secret.key }}
|
|
{{- else }}
|
|
value: {{ .Values.supervisor.bootstrap.workerToken.value | quote }}
|
|
{{- end }}
|
|
{{- if or .Values.secrets.enabled .Values.secrets.existingSecret }}
|
|
- name: MANAGED_WORKER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "trigger-v4.secretsName" . }}
|
|
key: MANAGED_WORKER_SECRET
|
|
{{- end }}
|
|
# Worker instance configuration
|
|
- name: TRIGGER_WORKER_INSTANCE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
# Kubernetes configuration
|
|
- name: KUBERNETES_NAMESPACE
|
|
value: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace | quote }}
|
|
- name: KUBERNETES_FORCE_ENABLED
|
|
value: {{ .Values.supervisor.config.kubernetes.forceEnabled | quote }}
|
|
- name: KUBERNETES_WORKER_NODETYPE_LABEL
|
|
value: {{ .Values.supervisor.config.kubernetes.workerNodetypeLabel | quote }}
|
|
{{- $registryAuthEnabled := false }}
|
|
{{- if .Values.registry.deploy }}
|
|
{{- $registryAuthEnabled = .Values.registry.auth.enabled }}
|
|
{{- else }}
|
|
{{- $registryAuthEnabled = .Values.registry.external.auth.enabled }}
|
|
{{- end }}
|
|
{{- if $registryAuthEnabled }}
|
|
- name: KUBERNETES_IMAGE_PULL_SECRETS
|
|
value: "{{ include "trigger-v4.fullname" . }}-registry-secret"
|
|
{{- end }}
|
|
- name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT
|
|
value: {{ default "10Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeLimit | quote }}
|
|
- name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST
|
|
value: {{ default "2Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeRequest | quote }}
|
|
# Pod cleaner configuration
|
|
- name: POD_CLEANER_ENABLED
|
|
value: {{ .Values.supervisor.config.podCleaner.enabled | quote }}
|
|
- name: POD_CLEANER_BATCH_SIZE
|
|
value: {{ .Values.supervisor.config.podCleaner.batchSize | quote }}
|
|
- name: POD_CLEANER_INTERVAL_MS
|
|
value: {{ .Values.supervisor.config.podCleaner.intervalMs | quote }}
|
|
# Failed pod handler
|
|
- name: FAILED_POD_HANDLER_ENABLED
|
|
value: {{ .Values.supervisor.config.failedPodHandler.enabled | quote }}
|
|
- name: FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS
|
|
value: {{ .Values.supervisor.config.failedPodHandler.reconnectIntervalMs | quote }}
|
|
# Workload API configuration
|
|
- name: TRIGGER_WORKLOAD_API_PROTOCOL
|
|
value: {{ .Values.supervisor.config.workloadApi.protocol | quote }}
|
|
- name: TRIGGER_WORKLOAD_API_DOMAIN
|
|
value: "{{ include "trigger-v4.fullname" . }}-supervisor.{{ .Release.Namespace }}.svc.cluster.local"
|
|
- name: TRIGGER_WORKLOAD_API_PORT_EXTERNAL
|
|
value: {{ .Values.supervisor.config.workloadApi.portExternal | quote }}
|
|
- name: TRIGGER_WORKLOAD_API_PORT_INTERNAL
|
|
value: {{ .Values.supervisor.config.workloadApi.portInternal | quote }}
|
|
- name: TRIGGER_WORKLOAD_API_HOST_INTERNAL
|
|
value: {{ .Values.supervisor.config.workloadApi.hostInternal | quote }}
|
|
- name: TRIGGER_WORKLOAD_API_ENABLED
|
|
value: {{ .Values.supervisor.config.workloadApi.enabled | quote }}
|
|
# Dequeue configuration
|
|
- name: TRIGGER_DEQUEUE_ENABLED
|
|
value: {{ .Values.supervisor.config.dequeue.enabled | quote }}
|
|
- name: TRIGGER_DEQUEUE_INTERVAL_MS
|
|
value: {{ .Values.supervisor.config.dequeue.intervalMs | quote }}
|
|
- name: TRIGGER_DEQUEUE_MAX_RUN_COUNT
|
|
value: {{ .Values.supervisor.config.dequeue.maxRunCount | quote }}
|
|
- name: TRIGGER_DEQUEUE_IDLE_INTERVAL_MS
|
|
value: {{ .Values.supervisor.config.dequeue.idleIntervalMs | quote }}
|
|
# Heartbeat configuration
|
|
- name: RUNNER_HEARTBEAT_INTERVAL_SECONDS
|
|
value: {{ .Values.supervisor.config.runner.heartbeatIntervalSeconds | quote }}
|
|
- name: RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS
|
|
value: {{ .Values.supervisor.config.runner.snapshotPollIntervalSeconds | quote }}
|
|
# Metrics configuration
|
|
- name: METRICS_ENABLED
|
|
value: {{ .Values.supervisor.config.metrics.enabled | quote }}
|
|
- name: METRICS_COLLECT_DEFAULTS
|
|
value: {{ .Values.supervisor.config.metrics.collectDefaults | quote }}
|
|
- name: METRICS_HOST
|
|
value: {{ .Values.supervisor.config.metrics.host | quote }}
|
|
- name: METRICS_PORT
|
|
value: {{ .Values.supervisor.config.metrics.port | quote }}
|
|
# Debug
|
|
- name: DEBUG
|
|
value: {{ .Values.supervisor.config.debug | quote }}
|
|
# OTEL
|
|
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
|
value: "http://{{ include "trigger-v4.fullname" . }}-webapp.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.webapp.service.port }}/otel"
|
|
{{- with .Values.supervisor.extraEnvVars }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if not .Values.webapp.bootstrap.enabled }}
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /home/node/shared
|
|
{{- end }}
|
|
{{- with .Values.supervisor.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if not .Values.webapp.bootstrap.enabled }}
|
|
volumes:
|
|
- name: shared
|
|
{{- if .Values.persistence.shared.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ include "trigger-v4.fullname" . }}-shared
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.supervisor.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.supervisor.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.supervisor.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ include "trigger-v4.fullname" . }}-supervisor
|
|
labels:
|
|
{{- $component := "supervisor" }}
|
|
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
|
|
spec:
|
|
type: {{ .Values.supervisor.service.type }}
|
|
ports:
|
|
- port: {{ .Values.supervisor.service.ports.workload }}
|
|
targetPort: workload
|
|
protocol: TCP
|
|
name: workload
|
|
- port: {{ .Values.supervisor.service.ports.metrics }}
|
|
targetPort: metrics
|
|
protocol: TCP
|
|
name: metrics
|
|
selector:
|
|
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }} |