Deploy Cassandra 0.7.65 generator worker

2026-07-24 02:02:27 -03:00 · 2026-07-24 02:02:27 -03:00 · 21798ca992
commit 21798ca992
parent 029a1b5137
10 changed files with 127 additions and 10 deletions
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@ -253,7 +253,7 @@ write_policy_and_role "health" "health" "health-vault-sync" \
  "health/*" ""
 write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
  "game-stream/*" ""
-write_policy_and_role "veles" "veles" "veles-backend,veles-postgres,veles-vault-sync" \
+write_policy_and_role "veles" "veles" "veles-backend,veles-generator,veles-postgres,veles-vault-sync" \
  "veles/* shared/harbor-pull shared/postmark-relay" ""
 write_policy_and_role "veles-sim" "veles" "veles-sim" \
  "veles/codex-cli" ""
--- a/services/veles/backend-deployment.yaml
+++ b/services/veles/backend-deployment.yaml
@ -22,7 +22,7 @@ spec:
      labels:
        app: veles-backend
      annotations:
-        veles.bstein.dev/redeploy: "2026-07-23-0.7.64-source-hygiene"
+        veles.bstein.dev/redeploy: "2026-07-24-0.7.65-hygiene-generator-worker"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
@ -63,7 +63,7 @@ spec:
          type: RuntimeDefault
      initContainers:
        - name: database-init
-          image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
          imagePullPolicy: Always
          command: ["/bin/sh", "-c"]
          args:
@ -85,7 +85,7 @@ spec:
              memory: 512Mi
      containers:
        - name: backend
-          image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
          imagePullPolicy: Always
          command: ["/bin/sh", "-c"]
          args:
--- a/services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
+++ b/services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
@ -1,4 +1,4 @@
-# services/veles/oneoffs/veles-secrets-ensure-job.yaml
+# services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
 # One-off job for veles/veles-secrets-ensure-2.
 # Purpose: seed Veles Vault paths before app/Postgres pods are scaled up.
 # Keep suspended until the veles Vault role has reconciled, then unsuspend once.
--- a/services/veles/configmap.yaml
+++ b/services/veles/configmap.yaml
@ -18,8 +18,9 @@ data:
  VELES_OIDC_REQUIRED_GROUPS: alpha,veles-tester,admin
  VELES_OIDC_ADMIN_GROUPS: admin
  VELES_NAMESPACE: veles
-  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.7.64 # {"$imagepolicy": "veles:veles-sim-worker"}
-  VELES_SIM_WORKER_VERSION: "0.7.64"
+  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.7.65 # {"$imagepolicy": "veles:veles-sim-worker"}
+  VELES_SIM_WORKER_VERSION: "0.7.65"
+  VELES_GENERATOR_WORKER_VERSION: "0.7.65"
  VELES_SIM_SERVICE_ACCOUNT: veles-sim
  VELES_SIM_PRIORITY_CLASS: veles-sim
  VELES_SIM_NODE_SELECTOR: veles.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
--- a/services/veles/frontend-deployment.yaml
+++ b/services/veles/frontend-deployment.yaml
@ -48,7 +48,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: frontend
-          image: registry.bstein.dev/veles/veles-frontend:0.7.64 # {"$imagepolicy": "veles:veles-frontend"}
+          image: registry.bstein.dev/veles/veles-frontend:0.7.65 # {"$imagepolicy": "veles:veles-frontend"}
          imagePullPolicy: Always
          ports:
            - name: http
--- a/services/veles/generator-deployment.yaml
+++ b/services/veles/generator-deployment.yaml
@ -0,0 +1,84 @@
+# services/veles/generator-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+  labels:
+    app: veles-generator-worker
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: veles-generator-worker
+  template:
+    metadata:
+      labels:
+        app: veles-generator-worker
+      annotations:
+        veles.bstein.dev/redeploy: "2026-07-24-0.7.65-hygiene-generator-worker"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/role: "veles"
+        vault.hashicorp.com/agent-inject-secret-veles-env.sh: "kv/data/atlas/veles/veles-db"
+        vault.hashicorp.com/agent-inject-template-veles-env.sh: |
+          {{- with secret "kv/data/atlas/veles/veles-db" }}
+          unset DATABASE_URL
+          export VELES_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
+          export VELES_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
+          export VELES_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
+          export VELES_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
+          export VELES_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
+          export VELES_DATABASE_SSLMODE="disable"
+          {{- end }}
+          {{- with secret "kv/data/atlas/veles/app-secrets" }}
+          export VELES_SESSION_SECRET="{{ .Data.data.VELES_SESSION_SECRET }}"
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
+    spec:
+      serviceAccountName: veles-generator
+      priorityClassName: veles-core
+      nodeSelector:
+        veles.bstein.dev/node-pool: oceanus
+        kubernetes.io/arch: amd64
+      tolerations:
+        - key: veles.bstein.dev/simulation
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: generator
+          image: registry.bstein.dev/veles/veles-generator-worker:0.7.65 # {"$imagepolicy": "veles:veles-generator-worker"}
+          imagePullPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -eu
+              if [ -f /vault/secrets/veles-env.sh ]; then
+                . /vault/secrets/veles-env.sh
+              fi
+              exec veles-generation-worker --loop --idle-sleep-seconds 5
+          envFrom:
+            - configMapRef:
+                name: veles-config
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
--- a/services/veles/image.yaml
+++ b/services/veles/image.yaml
@ -47,6 +47,29 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+spec:
+  image: registry.bstein.dev/veles/veles-generator-worker
+  interval: 1m0s
+  secretRef:
+    name: harbor-regcred
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+spec:
+  imageRepositoryRef:
+    name: veles-generator-worker
+  policy:
+    semver:
+      range: ">=0.1.0-0"
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
 metadata:
  name: veles-sim-worker
  namespace: veles
--- a/services/veles/kustomization.yaml
+++ b/services/veles/kustomization.yaml
@ -16,8 +16,9 @@ resources:
  - postgres-statefulset.yaml
  - services.yaml
  - backend-deployment.yaml
+  - generator-deployment.yaml
  - frontend-deployment.yaml
  - retention-cronjob.yaml
  - image.yaml
  - ingress.yaml
-  - oneoffs/veles-secrets-ensure-job.yaml
+  - bootstrap-jobs/veles-secrets-ensure-job.yaml
--- a/services/veles/retention-cronjob.yaml
+++ b/services/veles/retention-cronjob.yaml
@ -37,7 +37,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: retention
-              image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+              image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
              imagePullPolicy: IfNotPresent
              command: ["veles-hygiene"]
              args: ["--prune-artifacts"]
--- a/services/veles/serviceaccounts.yaml
+++ b/services/veles/serviceaccounts.yaml
@ -9,6 +9,14 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
+metadata:
+  name: veles-generator
+  namespace: veles
+imagePullSecrets:
+  - name: harbor-regcred
+---
+apiVersion: v1
+kind: ServiceAccount
 metadata:
  name: veles-frontend
  namespace: veles