bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(cassandra): deploy 0.8.42 ephemeral generator

Browse Source
This commit is contained in:
jenkins 2026-07-27 23:44:02 -03:00
parent 28db04296c
commit 15c9ed9c50
4 changed files with 17 additions and 123 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
services/cassandra/configmap.yaml
View File

@ -19,19 +19,30 @@ data:
CASSANDRA_OIDC_ADMIN_GROUPS: admin
CASSANDRA_NAMESPACE: cassandra
CASSANDRA_OWNER_USER_ID_ALIASES: veles-dev=d357688e-e3e4-4f18-9491-a4ed5622deb6;a21a286c-6c82-4180-9243-7c916442ecf0=d357688e-e3e4-4f18-9491-a4ed5622deb6
CASSANDRA_SIM_IMAGE: registry.bstein.dev/cassandra/cassandra-sim-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-sim-worker"}
CASSANDRA_GENERATOR_WORKER_IMAGE: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
CASSANDRA_SIM_IMAGE: registry.bstein.dev/cassandra/cassandra-sim-worker:0.8.42 # {"$imagepolicy": "cassandra:cassandra-sim-worker"}
CASSANDRA_GENERATOR_WORKER_IMAGE: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.42 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
CASSANDRA_SIM_SERVICE_ACCOUNT: cassandra-sim
CASSANDRA_GENERATOR_WORKER_SERVICE_ACCOUNT: cassandra-generator
CASSANDRA_SIM_PRIORITY_CLASS: cassandra-sim
CASSANDRA_GENERATOR_WORKER_PRIORITY_CLASS: cassandra-core
CASSANDRA_SIM_NODE_SELECTOR: cassandra.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
CASSANDRA_GENERATOR_WORKER_NODE_SELECTOR: cassandra.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
CASSANDRA_SIM_TOLERATIONS: veles.bstein.dev/simulation=true:NoSchedule
CASSANDRA_GENERATOR_WORKER_TOLERATIONS: veles.bstein.dev/simulation=true:NoSchedule
CASSANDRA_SIM_ACTIVE_DEADLINE_SECONDS: "7200"
CASSANDRA_GENERATOR_WORKER_ACTIVE_DEADLINE_SECONDS: "1800"
CASSANDRA_SIM_TTL_SECONDS: "3600"
CASSANDRA_GENERATOR_WORKER_TTL_SECONDS: "600"
CASSANDRA_SIM_CPU_REQUEST: 500m
CASSANDRA_SIM_CPU_LIMIT: "2"
CASSANDRA_SIM_MEMORY_REQUEST: 1Gi
CASSANDRA_SIM_MEMORY_LIMIT: 4Gi
CASSANDRA_GENERATOR_WORKER_CPU_REQUEST: 100m
CASSANDRA_GENERATOR_WORKER_CPU_LIMIT: "1"
CASSANDRA_GENERATOR_WORKER_MEMORY_REQUEST: 512Mi
CASSANDRA_GENERATOR_WORKER_MEMORY_LIMIT: 2Gi
CASSANDRA_SIM_FS_GROUP: "10001"
CASSANDRA_GENERATOR_WORKER_FS_GROUP: "10001"
CASSANDRA_MAX_ACTIVE_SIMS_PER_USER: "32"
CASSANDRA_MAX_ACTIVE_SIMS_GLOBAL: "32"
CASSANDRA_RETENTION_DAYS: "30"
@ -43,3 +54,6 @@ data:
CASSANDRA_SIM_CODEX_CLI_SECRET_PROVIDER_CLASS: cassandra-codex-cli
CASSANDRA_SIM_CODEX_CLI_MOUNT_PATH: /var/run/cassandra-codex-cli
CASSANDRA_SIM_CODEX_CLI_HOME: /home/cassandra/.codex
CASSANDRA_GENERATOR_WORKER_CODEX_CLI_SECRET_PROVIDER_CLASS: cassandra-generator-codex-cli
CASSANDRA_GENERATOR_WORKER_CODEX_CLI_MOUNT_PATH: /var/run/cassandra-codex-cli
CASSANDRA_GENERATOR_WORKER_CODEX_CLI_HOME: /home/cassandra/.codex

2
services/cassandra/frontend-deployment.yaml
View File

@ -48,7 +48,7 @@ spec:
type: RuntimeDefault
containers:
- name: frontend
image: registry.bstein.dev/cassandra/cassandra-frontend:0.8.41 # {"$imagepolicy": "cassandra:cassandra-frontend"}
image: registry.bstein.dev/cassandra/cassandra-frontend:0.8.42 # {"$imagepolicy": "cassandra:cassandra-frontend"}
imagePullPolicy: Always
ports:
- name: http

119
services/cassandra/generator-deployment.yaml
View File

@ -1,119 +0,0 @@
# services/cassandra/generator-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: cassandra-generator-worker
namespace: cassandra
labels:
app: cassandra-generator-worker
spec:
replicas: 1
revisionHistoryLimit: 2
selector:
matchLabels:
app: cassandra-generator-worker
template:
metadata:
labels:
app: cassandra-generator-worker
annotations:
cassandra.bstein.dev/redeploy: "2026-07-25-0.8.2-builder-spine"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/role: "cassandra"
vault.hashicorp.com/agent-inject-secret-cassandra-env.sh: "kv/data/atlas/cassandra/cassandra-db"
vault.hashicorp.com/agent-inject-template-cassandra-env.sh: |
{{- with secret "kv/data/atlas/cassandra/cassandra-db" }}
unset DATABASE_URL
export CASSANDRA_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
export CASSANDRA_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
export CASSANDRA_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
export CASSANDRA_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
export CASSANDRA_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
export CASSANDRA_DATABASE_SSLMODE="disable"
{{- end }}
{{- with secret "kv/data/atlas/cassandra/app-secrets" }}
export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
{{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
{{- end }}
{{- end }}
spec:
serviceAccountName: cassandra-generator
priorityClassName: cassandra-core
nodeSelector:
cassandra.bstein.dev/node-pool: oceanus
kubernetes.io/arch: amd64
tolerations:
- key: veles.bstein.dev/simulation
operator: Equal
value: "true"
effect: NoSchedule
securityContext:
fsGroup: 10001
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
containers:
- name: generator
image: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
imagePullPolicy: Always
command: ["/bin/sh", "-c"]
args:
- |
set -eu
if [ -f /vault/secrets/cassandra-env.sh ]; then
. /vault/secrets/cassandra-env.sh
fi
exec cassandra-generation-worker --loop --idle-sleep-seconds 5
envFrom:
- configMapRef:
name: cassandra-config
env:
- name: CASSANDRA_STRATEGY_SPEC_USE_CODEX
value: "1"
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_BIN
value: codex
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_MODEL
value: gpt-5.3-codex-spark
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_REASONING
value: low
- name: CASSANDRA_STRATEGY_SPEC_TIMEOUT
value: "900"
- name: CASSANDRA_CODEX_CLI_AUTH_MOUNT_PATH
value: /var/run/cassandra-codex-cli
- name: CASSANDRA_CODEX_CLI_LOGIN_FILE
value: login.json
- name: CODEX_HOME
value: /home/cassandra/.codex
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
cpu: "1"
memory: 2Gi
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
volumeMounts:
- name: codex-cli
mountPath: /var/run/cassandra-codex-cli
readOnly: true
- name: codex-home
mountPath: /home/cassandra/.codex
volumes:
- name: codex-cli
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: cassandra-generator-codex-cli
- name: codex-home
emptyDir: {}

1
services/cassandra/kustomization.yaml
View File

@ -16,7 +16,6 @@ resources:
- postgres-statefulset.yaml
- services.yaml
- backend-deployment.yaml
- generator-deployment.yaml
- frontend-deployment.yaml
- retention-cronjob.yaml
- image.yaml