worker-deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "invenio.fullname" . }}-worker
  labels:
    {{- include "invenio.labels" . | nindent 4 }}
    app.kubernetes.io/component: worker
spec:
  replicas: {{ .Values.worker.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/component: worker
  template:
    metadata:
      labels:
        app.kubernetes.io/component: worker
    spec:
      {{- with .Values.worker.nodeSelector }}
      nodeSelector:
        {{- tpl (toYaml .) $ | nindent 8 -}}
      {{- end }}
      {{- with .Values.worker.tolerations }}
      tolerations:
        {{- tpl (toYaml .) $ | nindent 8 -}}
      {{- end }}
      containers:
        - name: worker
          image: {{ required "Missing .Values.worker.image" .Values.worker.image }}
          command: [
              "/bin/bash",
              "-c",
              "celery -A {{ .Values.worker.app }} worker -c {{ .Values.worker.concurrency }} -l {{ .Values.worker.log_level }}"
          ]
          {{- if .Values.worker.resources }}
          resources: {{- toYaml .Values.worker.resources | nindent 12 }}
          {{- end }}
          securityContext:
            {{- with .Values.worker.securityContext }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          envFrom:
            - configMapRef:
                name: {{ include "invenio.fullname" . }}-config
            - secretRef:
                name: {{ include "invenio.secretName" . }}
            {{- with .Values.invenio.extraEnvFrom }}
            {{- . | toYaml | nindent 12 }}
            {{- end }}
            {{- with .Values.worker.extraEnvFrom }}
            {{- . | toYaml | nindent 12 }}
            {{- end }}
          env:
          - name: TZ
            value: {{ required "Missing .Values.global.timezone" .Values.global.timezone }}
          - name: INVENIO_BROKER_URL
            value: {{ include "invenio.rabbitmq.uri" . }}
          - name: INVENIO_CELERY_BROKER_URL
            value: {{ include "invenio.rabbitmq.uri" . }}
          - name: INVENIO_SQLALCHEMY_DATABASE_URI
            value: {{ include "invenio.sqlAlchemyDbUri" . }}
          {{- with .Values.worker.extraEnvVars }}
          {{- toYaml . | nindent 10 }}
          {{- end }}
          {{- include "invenio.config.sentry" . | nindent 10 }}
          {{- if .Values.invenio.datacite.enabled }}
          - name: INVENIO_DATACITE_USERNAME
            valueFrom:
              secretKeyRef:
                name: {{ .Values.invenio.datacite.secret_name }}
                key: DATACITE_USERNAME
          - name: INVENIO_DATACITE_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ .Values.invenio.datacite.secret_name }}
                key: DATACITE_PASSWORD
          {{- end }}
          {{- if .Values.invenio.remote_apps.enabled }}
          {{- range .Values.invenio.remote_apps.credentials }}
          - name: {{ default (printf "INVENIO_%s_APP_CREDENTIALS" .name) }}
            valueFrom:
              secretKeyRef:
                name: {{ $.Values.invenio.remote_apps.secret_name }}
                key: {{ default (printf "INVENIO_%s_APP_CREDENTIALS" .name) }}
          {{- end }}
          {{- end }}
          {{- range .Values.invenio.extra_env_from_secret }}
          - name: {{ .name }}
            valueFrom:
              secretKeyRef:
                name: {{ .valueFrom.secretKeyRef.name }}
                key: {{ .valueFrom.secretKeyRef.key }}
          {{- end }}
          livenessProbe:
            exec:
              command:
                - /bin/bash
                - -c
                - "celery -A {{ .Values.worker.app }} inspect ping -d celery@$(hostname)"
            initialDelaySeconds: 20
            timeoutSeconds: 30
          volumeMounts:
            {{- if .Values.persistence.enabled }}
            - mountPath: /opt/invenio/var/instance/data
              name: shared-volume
              subPath: data
            {{- end }}
            {{- if .Values.kerberos.enabled }}
            - name: kerberos-credentials-cache
              mountPath: /tmp
            {{- end }}
            {{- range $key, $value := .Values.invenio.vocabularies }}
            - name: vocabularies
              mountPath: "/opt/invenio/var/instance/app_data/vocabularies/{{ $key }}"
              subPath: "{{ $key }}"
            {{- end }}
        {{- if .Values.kerberos.enabled }}
        - name: kerberos-credentials
          image: {{ required "Missing .Values.kerberos.image" .Values.kerberos.image }}
          args: {{ .Values.kerberos.args }}
          envFrom:
            - secretRef:
                name: {{ .Values.kerberos.secret_name }}
          resources: {{- toYaml .Values.kerberos.resources | nindent 12 }}
          {{- if .Values.kerberos.readinessProbe }}
          readinessProbe: {{- toYaml .Values.kerberos.readinessProbe | nindent 12 }}
          {{- end }}
          {{- if .Values.kerberos.livenessProbe }}
          livenessProbe: {{- toYaml .Values.kerberos.livenessProbe | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: kerberos-credentials-cache
              mountPath: /tmp
        {{- end }}

      {{- if .Values.kerberos.enabled }}
      initContainers:
        # Init kerberos credentials
        - name: init-kerberos-credentials
          image: {{ required "Missing .Values.kerberos.image" .Values.kerberos.image }}
          args: {{ .Values.kerberos.initArgs }}
          envFrom:
            - secretRef:
                name: {{ .Values.kerberos.secret_name }}
          resources: {{- toYaml .Values.kerberos.resources | nindent 12 }}
          volumeMounts:
            - name: kerberos-credentials-cache
              mountPath: /tmp
      {{- end }}
      securityContext:
        {{- with .Values.worker.podSecurityContext }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      volumes:
        {{- if .Values.persistence.enabled }}
        - name: shared-volume
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.name }}
        {{- end }}
        {{- if .Values.kerberos.enabled }}
        - name: kerberos-credentials-cache
          emptyDir: {}
        {{- end }}
        {{- if .Values.invenio.vocabularies }}
        - name: vocabularies
          configMap:
            name: "{{ include "invenio.fullname" . }}-vocabularies"
        {{- end }}
      {{- if .Values.worker.imagePullSecret }}
      imagePullSecrets:
      - name: {{ .Values.worker.imagePullSecret }}
      {{- end }}