jobs: prefer arm64 workers

infrastructure/cert-manager/cleanup/cert-manager-cleanup-job.yaml

@@ -10,6 +10,20 @@ spec:
     spec:
       serviceAccountName: cert-manager-cleanup
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: cleanup
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131

infrastructure/longhorn/adopt/longhorn-helm-adopt-job.yaml

@@ -10,6 +10,20 @@ spec:
     spec:
       serviceAccountName: longhorn-helm-adopt
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: adopt
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131

services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml

@@ -30,6 +30,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: bstein-dev-home
       containers:
         - name: test

services/comms/bstein-force-leave-job.yaml

@@ -17,6 +17,20 @@ spec:
           {{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: comms-vault
       volumes:
       containers:
@@ -186,4 +200,4 @@ spec:
               print(json.dumps(results, indent=2, sort_keys=True))
               if failures:
                   raise SystemExit(f"failed to leave/forget rooms: {', '.join(failures)}")
-              PY
+              PY

services/comms/comms-secrets-ensure-job.yaml

@@ -11,6 +11,20 @@ spec:
     spec:
       serviceAccountName: comms-secrets-ensure
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: ensure
           image: registry.bstein.dev/bstein/kubectl:1.35.0

services/comms/mas-admin-client-secret-ensure-job.yaml

@@ -46,6 +46,20 @@ spec:
     spec:
       serviceAccountName: mas-admin-client-secret-writer
       restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       volumes:
         - name: work
           emptyDir: {}

services/comms/mas-db-ensure-job.yaml

@@ -11,6 +11,20 @@ spec:
     spec:
       serviceAccountName: mas-db-ensure
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: ensure
           image: registry.bstein.dev/bstein/kubectl:1.35.0

services/comms/mas-local-users-ensure-job.yaml

@@ -48,6 +48,20 @@ spec:
           {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: comms-vault
       volumes:
         - name: vault-scripts
@@ -187,4 +201,4 @@ spec:
               token = admin_token()
               ensure_user(token, os.environ["SEEDER_USER"], os.environ["SEEDER_PASS"])
               ensure_user(token, os.environ["BOT_USER"], os.environ["BOT_PASS"])
-              PY
+              PY

services/comms/othrys-kick-numeric-job.yaml

@@ -47,6 +47,20 @@ spec:
           {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: comms-vault
       containers:
         - name: kick
@@ -156,4 +170,4 @@ spec:
         - name: vault-scripts
           configMap:
             name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555

services/comms/synapse-seeder-admin-ensure-job.yaml

@@ -47,6 +47,20 @@ spec:
           {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
     spec:
       restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: comms-vault
       containers:
         - name: psql
@@ -77,4 +91,4 @@ spec:
         - name: vault-scripts
           configMap:
             name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555

services/comms/synapse-signingkey-ensure-job.yaml

@@ -10,6 +10,20 @@ spec:
     spec:
       serviceAccountName: othrys-synapse-signingkey-job
       restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       volumes:
         - name: work
           emptyDir: {}

services/comms/synapse-user-seed-job.yaml

@@ -48,6 +48,20 @@ spec:
           {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: comms-vault
       containers:
         - name: seed
@@ -151,4 +165,4 @@ spec:
         - name: vault-scripts
           configMap:
             name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555

services/keycloak/logs-oidc-secret-ensure-job.yaml

@@ -23,6 +23,20 @@ spec:
     spec:
       serviceAccountName: mas-secrets-ensure
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: apply
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131

services/keycloak/portal-admin-client-secret-ensure-job.yaml

@@ -23,6 +23,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: configure

services/keycloak/portal-e2e-client-job.yaml

@@ -39,6 +39,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: configure
@@ -258,4 +272,4 @@ spec:
                       raise SystemExit(f"Role mapping update failed (status={status}) resp={resp}")
               PY
           volumeMounts:
-      volumes:
+      volumes:

services/keycloak/portal-e2e-execute-actions-email-test-job.yaml

@@ -39,6 +39,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: test

services/keycloak/portal-e2e-target-client-job.yaml

@@ -39,6 +39,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: configure
@@ -159,4 +173,4 @@ spec:
               print(f"OK: ensured token exchange enabled on client {target_client_id}")
               PY
           volumeMounts:
-      volumes:
+      volumes:

services/keycloak/portal-e2e-token-exchange-permissions-job.yaml

@@ -39,6 +39,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: configure
@@ -291,4 +305,4 @@ spec:
 
               print("OK: configured token exchange permissions for portal E2E client")
               PY
-          volumeMounts:
+          volumeMounts:

services/keycloak/portal-e2e-token-exchange-test-job.yaml

@@ -40,6 +40,20 @@ spec:
           {{ end }}
     spec:
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: sso-vault
       containers:
         - name: test
@@ -71,4 +85,4 @@ spec:
         - name: tests
           configMap:
             name: portal-e2e-tests
-            defaultMode: 0555
+            defaultMode: 0555

services/keycloak/synapse-oidc-secret-ensure-job.yaml

@@ -23,6 +23,20 @@ spec:
     spec:
       serviceAccountName: mas-secrets-ensure
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: apply
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131

services/mailu/mailu-sync-job.yaml

@@ -28,6 +28,20 @@ spec:
           {{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-secret" }}{{- end -}}
     spec:
       restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: mailu-vault-sync
       containers:
         - name: mailu-sync
@@ -75,4 +89,4 @@ spec:
         - name: vault-scripts
           configMap:
             name: mailu-vault-env
-            defaultMode: 0555
+            defaultMode: 0555

services/maintenance/k3s-traefik-cleanup-job.yaml

@@ -10,6 +10,20 @@ spec:
     spec:
       serviceAccountName: k3s-traefik-cleanup
       restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       containers:
         - name: cleanup
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131

services/monitoring/grafana-org-bootstrap.yaml

@@ -20,6 +20,20 @@ spec:
           {{- end -}}
     spec:
       restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
       serviceAccountName: monitoring-vault-sync
       containers:
         - name: bootstrap