120 lines
4.4 KiB
YAML
120 lines
4.4 KiB
YAML
# services/cassandra/generator-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cassandra-generator-worker
|
|
namespace: cassandra
|
|
labels:
|
|
app: cassandra-generator-worker
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 2
|
|
selector:
|
|
matchLabels:
|
|
app: cassandra-generator-worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: cassandra-generator-worker
|
|
annotations:
|
|
cassandra.bstein.dev/redeploy: "2026-07-25-0.8.2-builder-spine"
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-init-first: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/role: "cassandra"
|
|
vault.hashicorp.com/agent-inject-secret-cassandra-env.sh: "kv/data/atlas/cassandra/cassandra-db"
|
|
vault.hashicorp.com/agent-inject-template-cassandra-env.sh: |
|
|
{{- with secret "kv/data/atlas/cassandra/cassandra-db" }}
|
|
unset DATABASE_URL
|
|
export CASSANDRA_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
|
|
export CASSANDRA_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
|
|
export CASSANDRA_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
|
|
export CASSANDRA_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
|
|
export CASSANDRA_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
|
|
export CASSANDRA_DATABASE_SSLMODE="disable"
|
|
{{- end }}
|
|
{{- with secret "kv/data/atlas/cassandra/app-secrets" }}
|
|
export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
|
|
export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
|
|
{{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
|
|
export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
|
|
{{- end }}
|
|
{{- end }}
|
|
spec:
|
|
serviceAccountName: cassandra-generator
|
|
priorityClassName: cassandra-core
|
|
nodeSelector:
|
|
cassandra.bstein.dev/node-pool: oceanus
|
|
kubernetes.io/arch: amd64
|
|
tolerations:
|
|
- key: veles.bstein.dev/simulation
|
|
operator: Equal
|
|
value: "true"
|
|
effect: NoSchedule
|
|
securityContext:
|
|
fsGroup: 10001
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: generator
|
|
image: registry.bstein.dev/cassandra/cassandra-generator-worker:0.8.25 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
|
|
imagePullPolicy: Always
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -eu
|
|
if [ -f /vault/secrets/cassandra-env.sh ]; then
|
|
. /vault/secrets/cassandra-env.sh
|
|
fi
|
|
exec cassandra-generation-worker --loop --idle-sleep-seconds 5
|
|
envFrom:
|
|
- configMapRef:
|
|
name: cassandra-config
|
|
env:
|
|
- name: CASSANDRA_STRATEGY_SPEC_USE_CODEX
|
|
value: "1"
|
|
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_BIN
|
|
value: codex
|
|
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_MODEL
|
|
value: gpt-5.3-codex-spark
|
|
- name: CASSANDRA_STRATEGY_AUTHORING_CODEX_REASONING
|
|
value: low
|
|
- name: CASSANDRA_STRATEGY_SPEC_TIMEOUT
|
|
value: "900"
|
|
- name: CASSANDRA_CODEX_CLI_AUTH_MOUNT_PATH
|
|
value: /var/run/cassandra-codex-cli
|
|
- name: CASSANDRA_CODEX_CLI_LOGIN_FILE
|
|
value: login.json
|
|
- name: CODEX_HOME
|
|
value: /home/cassandra/.codex
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumeMounts:
|
|
- name: codex-cli
|
|
mountPath: /var/run/cassandra-codex-cli
|
|
readOnly: true
|
|
- name: codex-home
|
|
mountPath: /home/cassandra/.codex
|
|
volumes:
|
|
- name: codex-cli
|
|
csi:
|
|
driver: secrets-store.csi.k8s.io
|
|
readOnly: true
|
|
volumeAttributes:
|
|
secretProviderClass: cassandra-generator-codex-cli
|
|
- name: codex-home
|
|
emptyDir: {}
|