jobs: prefer arm64 workers

2026-01-17 01:47:53 -03:00 · 2026-01-17 01:47:53 -03:00 · 6ec0414fcd
commit 6ec0414fcd
parent 33e35193fb
23 changed files with 332 additions and 10 deletions
--- a/infrastructure/cert-manager/cleanup/cert-manager-cleanup-job.yaml
+++ b/infrastructure/cert-manager/cleanup/cert-manager-cleanup-job.yaml
@ -10,6 +10,20 @@ spec:
    spec:
      serviceAccountName: cert-manager-cleanup
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: cleanup
          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
--- a/infrastructure/longhorn/adopt/longhorn-helm-adopt-job.yaml
+++ b/infrastructure/longhorn/adopt/longhorn-helm-adopt-job.yaml
@ -10,6 +10,20 @@ spec:
    spec:
      serviceAccountName: longhorn-helm-adopt
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: adopt
          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
--- a/services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml
+++ b/services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml
@ -30,6 +30,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: bstein-dev-home
      containers:
        - name: test
--- a/services/comms/bstein-force-leave-job.yaml
+++ b/services/comms/bstein-force-leave-job.yaml
@ -17,6 +17,20 @@ spec:
          {{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: comms-vault
      volumes:
      containers:
@ -186,4 +200,4 @@ spec:
              print(json.dumps(results, indent=2, sort_keys=True))
              if failures:
                  raise SystemExit(f"failed to leave/forget rooms: {', '.join(failures)}")
-              PY
+              PY
--- a/services/comms/comms-secrets-ensure-job.yaml
+++ b/services/comms/comms-secrets-ensure-job.yaml
@ -11,6 +11,20 @@ spec:
    spec:
      serviceAccountName: comms-secrets-ensure
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: ensure
          image: registry.bstein.dev/bstein/kubectl:1.35.0
--- a/services/comms/mas-admin-client-secret-ensure-job.yaml
+++ b/services/comms/mas-admin-client-secret-ensure-job.yaml
@ -46,6 +46,20 @@ spec:
    spec:
      serviceAccountName: mas-admin-client-secret-writer
      restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      volumes:
        - name: work
          emptyDir: {}
--- a/services/comms/mas-db-ensure-job.yaml
+++ b/services/comms/mas-db-ensure-job.yaml
@ -11,6 +11,20 @@ spec:
    spec:
      serviceAccountName: mas-db-ensure
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: ensure
          image: registry.bstein.dev/bstein/kubectl:1.35.0
--- a/services/comms/mas-local-users-ensure-job.yaml
+++ b/services/comms/mas-local-users-ensure-job.yaml
@ -48,6 +48,20 @@ spec:
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: comms-vault
      volumes:
        - name: vault-scripts
@ -187,4 +201,4 @@ spec:
              token = admin_token()
              ensure_user(token, os.environ["SEEDER_USER"], os.environ["SEEDER_PASS"])
              ensure_user(token, os.environ["BOT_USER"], os.environ["BOT_PASS"])
-              PY
+              PY
--- a/services/comms/othrys-kick-numeric-job.yaml
+++ b/services/comms/othrys-kick-numeric-job.yaml
@ -47,6 +47,20 @@ spec:
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: comms-vault
      containers:
        - name: kick
@ -156,4 +170,4 @@ spec:
        - name: vault-scripts
          configMap:
            name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555
--- a/services/comms/synapse-seeder-admin-ensure-job.yaml
+++ b/services/comms/synapse-seeder-admin-ensure-job.yaml
@ -47,6 +47,20 @@ spec:
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
    spec:
      restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: comms-vault
      containers:
        - name: psql
@ -77,4 +91,4 @@ spec:
        - name: vault-scripts
          configMap:
            name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555
--- a/services/comms/synapse-signingkey-ensure-job.yaml
+++ b/services/comms/synapse-signingkey-ensure-job.yaml
@ -10,6 +10,20 @@ spec:
    spec:
      serviceAccountName: othrys-synapse-signingkey-job
      restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      volumes:
        - name: work
          emptyDir: {}
--- a/services/comms/synapse-user-seed-job.yaml
+++ b/services/comms/synapse-user-seed-job.yaml
@ -48,6 +48,20 @@ spec:
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: comms-vault
      containers:
        - name: seed
@ -151,4 +165,4 @@ spec:
        - name: vault-scripts
          configMap:
            name: comms-vault-env
-            defaultMode: 0555
+            defaultMode: 0555
--- a/services/keycloak/logs-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/logs-oidc-secret-ensure-job.yaml
@ -23,6 +23,20 @@ spec:
    spec:
      serviceAccountName: mas-secrets-ensure
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: apply
          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
--- a/services/keycloak/portal-admin-client-secret-ensure-job.yaml
+++ b/services/keycloak/portal-admin-client-secret-ensure-job.yaml
@ -23,6 +23,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: configure
--- a/services/keycloak/portal-e2e-client-job.yaml
+++ b/services/keycloak/portal-e2e-client-job.yaml
@ -39,6 +39,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: configure
@ -258,4 +272,4 @@ spec:
                      raise SystemExit(f"Role mapping update failed (status={status}) resp={resp}")
              PY
          volumeMounts:
-      volumes:
+      volumes:
--- a/services/keycloak/portal-e2e-execute-actions-email-test-job.yaml
+++ b/services/keycloak/portal-e2e-execute-actions-email-test-job.yaml
@ -39,6 +39,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: test
--- a/services/keycloak/portal-e2e-target-client-job.yaml
+++ b/services/keycloak/portal-e2e-target-client-job.yaml
@ -39,6 +39,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: configure
@ -159,4 +173,4 @@ spec:
              print(f"OK: ensured token exchange enabled on client {target_client_id}")
              PY
          volumeMounts:
-      volumes:
+      volumes:
--- a/services/keycloak/portal-e2e-token-exchange-permissions-job.yaml
+++ b/services/keycloak/portal-e2e-token-exchange-permissions-job.yaml
@ -39,6 +39,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: configure
@ -291,4 +305,4 @@ spec:

              print("OK: configured token exchange permissions for portal E2E client")
              PY
-          volumeMounts:
+          volumeMounts:
--- a/services/keycloak/portal-e2e-token-exchange-test-job.yaml
+++ b/services/keycloak/portal-e2e-token-exchange-test-job.yaml
@ -40,6 +40,20 @@ spec:
          {{ end }}
    spec:
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: sso-vault
      containers:
        - name: test
@ -71,4 +85,4 @@ spec:
        - name: tests
          configMap:
            name: portal-e2e-tests
-            defaultMode: 0555
+            defaultMode: 0555
--- a/services/keycloak/synapse-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
@ -23,6 +23,20 @@ spec:
    spec:
      serviceAccountName: mas-secrets-ensure
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: apply
          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
--- a/services/mailu/mailu-sync-job.yaml
+++ b/services/mailu/mailu-sync-job.yaml
@ -28,6 +28,20 @@ spec:
          {{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-secret" }}{{- end -}}
    spec:
      restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: mailu-vault-sync
      containers:
        - name: mailu-sync
@ -75,4 +89,4 @@ spec:
        - name: vault-scripts
          configMap:
            name: mailu-vault-env
-            defaultMode: 0555
+            defaultMode: 0555
--- a/services/maintenance/k3s-traefik-cleanup-job.yaml
+++ b/services/maintenance/k3s-traefik-cleanup-job.yaml
@ -10,6 +10,20 @@ spec:
    spec:
      serviceAccountName: k3s-traefik-cleanup
      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      containers:
        - name: cleanup
          image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
--- a/services/monitoring/grafana-org-bootstrap.yaml
+++ b/services/monitoring/grafana-org-bootstrap.yaml
@ -20,6 +20,20 @@ spec:
          {{- end -}}
    spec:
      restartPolicy: OnFailure
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
      serviceAccountName: monitoring-vault-sync
      containers:
        - name: bootstrap