chore(cassandra): deploy 0.8.42 ephemeral generator

services/cassandra/configmap.yaml

@@ -19,19 +19,30 @@ data:
   CASSANDRA_OIDC_ADMIN_GROUPS: admin
   CASSANDRA_NAMESPACE: cassandra
   CASSANDRA_OWNER_USER_ID_ALIASES: veles-dev=d357688e-e3e4-4f18-9491-a4ed5622deb6;a21a286c-6c82-4180-9243-7c916442ecf0=d357688e-e3e4-4f18-9491-a4ed5622deb6
-  CASSANDRA_SIM_IMAGE: registry.bstein.dev/cassandra/cassandra-sim-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-sim-worker"}
+  CASSANDRA_SIM_IMAGE: registry.bstein.dev/cassandra/cassandra-sim-worker:0.8.42 # {"$imagepolicy": "cassandra:cassandra-sim-worker"}
-  CASSANDRA_GENERATOR_WORKER_IMAGE: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
+  CASSANDRA_GENERATOR_WORKER_IMAGE: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.42 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
   CASSANDRA_SIM_SERVICE_ACCOUNT: cassandra-sim
+  CASSANDRA_GENERATOR_WORKER_SERVICE_ACCOUNT: cassandra-generator
   CASSANDRA_SIM_PRIORITY_CLASS: cassandra-sim
+  CASSANDRA_GENERATOR_WORKER_PRIORITY_CLASS: cassandra-core
   CASSANDRA_SIM_NODE_SELECTOR: cassandra.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
+  CASSANDRA_GENERATOR_WORKER_NODE_SELECTOR: cassandra.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
   CASSANDRA_SIM_TOLERATIONS: veles.bstein.dev/simulation=true:NoSchedule
+  CASSANDRA_GENERATOR_WORKER_TOLERATIONS: veles.bstein.dev/simulation=true:NoSchedule
   CASSANDRA_SIM_ACTIVE_DEADLINE_SECONDS: "7200"
+  CASSANDRA_GENERATOR_WORKER_ACTIVE_DEADLINE_SECONDS: "1800"
   CASSANDRA_SIM_TTL_SECONDS: "3600"
+  CASSANDRA_GENERATOR_WORKER_TTL_SECONDS: "600"
   CASSANDRA_SIM_CPU_REQUEST: 500m
   CASSANDRA_SIM_CPU_LIMIT: "2"
   CASSANDRA_SIM_MEMORY_REQUEST: 1Gi
   CASSANDRA_SIM_MEMORY_LIMIT: 4Gi
+  CASSANDRA_GENERATOR_WORKER_CPU_REQUEST: 100m
+  CASSANDRA_GENERATOR_WORKER_CPU_LIMIT: "1"
+  CASSANDRA_GENERATOR_WORKER_MEMORY_REQUEST: 512Mi
+  CASSANDRA_GENERATOR_WORKER_MEMORY_LIMIT: 2Gi
   CASSANDRA_SIM_FS_GROUP: "10001"
+  CASSANDRA_GENERATOR_WORKER_FS_GROUP: "10001"
   CASSANDRA_MAX_ACTIVE_SIMS_PER_USER: "32"
   CASSANDRA_MAX_ACTIVE_SIMS_GLOBAL: "32"
   CASSANDRA_RETENTION_DAYS: "30"
@@ -43,3 +54,6 @@ data:
   CASSANDRA_SIM_CODEX_CLI_SECRET_PROVIDER_CLASS: cassandra-codex-cli
   CASSANDRA_SIM_CODEX_CLI_MOUNT_PATH: /var/run/cassandra-codex-cli
   CASSANDRA_SIM_CODEX_CLI_HOME: /home/cassandra/.codex
+  CASSANDRA_GENERATOR_WORKER_CODEX_CLI_SECRET_PROVIDER_CLASS: cassandra-generator-codex-cli
+  CASSANDRA_GENERATOR_WORKER_CODEX_CLI_MOUNT_PATH: /var/run/cassandra-codex-cli
+  CASSANDRA_GENERATOR_WORKER_CODEX_CLI_HOME: /home/cassandra/.codex

services/cassandra/frontend-deployment.yaml

@@ -48,7 +48,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: frontend
-          image: registry.bstein.dev/cassandra/cassandra-frontend:0.8.41 # {"$imagepolicy": "cassandra:cassandra-frontend"}
+          image: registry.bstein.dev/cassandra/cassandra-frontend:0.8.42 # {"$imagepolicy": "cassandra:cassandra-frontend"}
           imagePullPolicy: Always
           ports:
             - name: http

services/cassandra/generator-deployment.yaml

@@ -1,119 +0,0 @@
-# services/cassandra/generator-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cassandra-generator-worker
-  namespace: cassandra
-  labels:
-    app: cassandra-generator-worker
-spec:
-  replicas: 1
-  revisionHistoryLimit: 2
-  selector:
-    matchLabels:
-      app: cassandra-generator-worker
-  template:
-    metadata:
-      labels:
-        app: cassandra-generator-worker
-      annotations:
-        cassandra.bstein.dev/redeploy: "2026-07-25-0.8.2-builder-spine"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/role: "cassandra"
-        vault.hashicorp.com/agent-inject-secret-cassandra-env.sh: "kv/data/atlas/cassandra/cassandra-db"
-        vault.hashicorp.com/agent-inject-template-cassandra-env.sh: |
-          {{- with secret "kv/data/atlas/cassandra/cassandra-db" }}
-          unset DATABASE_URL
-          export CASSANDRA_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
-          export CASSANDRA_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
-          export CASSANDRA_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
-          export CASSANDRA_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
-          export CASSANDRA_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
-          export CASSANDRA_DATABASE_SSLMODE="disable"
-          {{- end }}
-          {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
-          export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
-          export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
-          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
-          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
-          {{- end }}
-          {{- end }}
-    spec:
-      serviceAccountName: cassandra-generator
-      priorityClassName: cassandra-core
-      nodeSelector:
-        cassandra.bstein.dev/node-pool: oceanus
-        kubernetes.io/arch: amd64
-      tolerations:
-        - key: veles.bstein.dev/simulation
-          operator: Equal
-          value: "true"
-          effect: NoSchedule
-      securityContext:
-        fsGroup: 10001
-        fsGroupChangePolicy: OnRootMismatch
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: generator
-          image: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.41 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
-          imagePullPolicy: Always
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -eu
-              if [ -f /vault/secrets/cassandra-env.sh ]; then
-                . /vault/secrets/cassandra-env.sh
-              fi
-              exec cassandra-generation-worker --loop --idle-sleep-seconds 5
-          envFrom:
-            - configMapRef:
-                name: cassandra-config
-          env:
-            - name: CASSANDRA_STRATEGY_SPEC_USE_CODEX
-              value: "1"
-            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_BIN
-              value: codex
-            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_MODEL
-              value: gpt-5.3-codex-spark
-            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_REASONING
-              value: low
-            - name: CASSANDRA_STRATEGY_SPEC_TIMEOUT
-              value: "900"
-            - name: CASSANDRA_CODEX_CLI_AUTH_MOUNT_PATH
-              value: /var/run/cassandra-codex-cli
-            - name: CASSANDRA_CODEX_CLI_LOGIN_FILE
-              value: login.json
-            - name: CODEX_HOME
-              value: /home/cassandra/.codex
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-            limits:
-              cpu: "1"
-              memory: 2Gi
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 10001
-            runAsGroup: 10001
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - name: codex-cli
-              mountPath: /var/run/cassandra-codex-cli
-              readOnly: true
-            - name: codex-home
-              mountPath: /home/cassandra/.codex
-      volumes:
-        - name: codex-cli
-          csi:
-            driver: secrets-store.csi.k8s.io
-            readOnly: true
-            volumeAttributes:
-              secretProviderClass: cassandra-generator-codex-cli
-        - name: codex-home
-          emptyDir: {}

services/cassandra/kustomization.yaml

@@ -16,7 +16,6 @@ resources:
   - postgres-statefulset.yaml
   - services.yaml
   - backend-deployment.yaml
-  - generator-deployment.yaml
   - frontend-deployment.yaml
   - retention-cronjob.yaml
   - image.yaml