supervisor.yaml

{{- if .Values.supervisor.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "trigger-v4.supervisorServiceAccountName" . }}
  labels:
    {{- $component := "supervisor" }}
    {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
  {{- with .Values.supervisor.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}
---
{{- if .Values.supervisor.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "trigger-v4.supervisorClusterRoleName" . }}
  labels:
    {{- $component := "supervisor" }}
    {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "delete", "deletecollection", "get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "trigger-v4.supervisorClusterRoleName" . }}-binding
  labels:
    {{- $component := "supervisor" }}
    {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
subjects:
  - kind: ServiceAccount
    name: {{ include "trigger-v4.supervisorServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ include "trigger-v4.supervisorClusterRoleName" . }}
  apiGroup: rbac.authorization.k8s.io
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "trigger-v4.fullname" . }}-supervisor
  labels:
    {{- $component := "supervisor" }}
    {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 8 }}
      {{- with .Values.supervisor.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
      serviceAccountName: {{ include "trigger-v4.supervisorServiceAccountName" . }}
      securityContext:
        fsGroup: 1000
        {{- with .Values.supervisor.podSecurityContext }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- if not .Values.webapp.bootstrap.enabled }}
      initContainers:
        - name: init-shared
          image: busybox:1.35
          command: ['sh', '-c', 'mkdir -p /home/node/shared']
          securityContext:
            runAsUser: 1000
          volumeMounts:
            - name: shared
              mountPath: /home/node/shared
      {{- end }}
      containers:
        - name: supervisor
          image: {{ include "trigger-v4.supervisor.image" . }}
          imagePullPolicy: {{ .Values.supervisor.image.pullPolicy }}
          ports:
            - name: workload
              containerPort: {{ .Values.supervisor.service.ports.workload }}
              protocol: TCP
            - name: metrics
              containerPort: {{ .Values.supervisor.service.ports.metrics }}
              protocol: TCP
          {{- if .Values.supervisor.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
              path: /health
              port: workload
            initialDelaySeconds: {{ .Values.supervisor.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.supervisor.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.supervisor.livenessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.supervisor.livenessProbe.failureThreshold }}
            successThreshold: {{ .Values.supervisor.livenessProbe.successThreshold }}
          {{- end }}
          {{- if .Values.supervisor.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
              path: /health
              port: workload
            initialDelaySeconds: {{ .Values.supervisor.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.supervisor.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.supervisor.readinessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.supervisor.readinessProbe.failureThreshold }}
            successThreshold: {{ .Values.supervisor.readinessProbe.successThreshold }}
          {{- end }}
          {{- if .Values.supervisor.startupProbe.enabled }}
          startupProbe:
            httpGet:
              path: /health
              port: workload
            initialDelaySeconds: {{ .Values.supervisor.startupProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.supervisor.startupProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.supervisor.startupProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.supervisor.startupProbe.failureThreshold }}
            successThreshold: {{ .Values.supervisor.startupProbe.successThreshold }}
          {{- end }}
          resources:
            {{- toYaml .Values.supervisor.resources | nindent 12 }}
          env:
            # Core configuration
            - name: TRIGGER_API_URL
              value: "http://{{ include "trigger-v4.fullname" . }}-webapp:{{ .Values.webapp.service.port }}"
            - name: TRIGGER_WORKER_TOKEN
              {{- if .Values.webapp.bootstrap.enabled }}
              valueFrom:
                secretKeyRef:
                  name: {{ include "trigger-v4.fullname" . }}-worker-token
                  key: token
              {{- else if .Values.supervisor.bootstrap.workerToken.secret.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.supervisor.bootstrap.workerToken.secret.name }}
                  key: {{ .Values.supervisor.bootstrap.workerToken.secret.key }}
              {{- else }}
              value: {{ .Values.supervisor.bootstrap.workerToken.value | quote }}
              {{- end }}
            {{- if .Values.secrets.enabled }}
            - name: MANAGED_WORKER_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ include "trigger-v4.secretsName" . }}
                  key: MANAGED_WORKER_SECRET
            {{- end }}
            # Worker instance configuration
            - name: TRIGGER_WORKER_INSTANCE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            # Kubernetes configuration
            - name: KUBERNETES_NAMESPACE
              value: {{ default .Release.Namespace .Values.supervisor.config.kubernetes.namespace | quote }}
            - name: KUBERNETES_FORCE_ENABLED
              value: {{ .Values.supervisor.config.kubernetes.forceEnabled | quote }}
            - name: KUBERNETES_WORKER_NODETYPE_LABEL
              value: {{ .Values.supervisor.config.kubernetes.workerNodetypeLabel | quote }}
            {{- $registryAuthEnabled := false }}
            {{- if .Values.registry.deploy }}
              {{- $registryAuthEnabled = .Values.registry.auth.enabled }}
            {{- else }}
              {{- $registryAuthEnabled = .Values.registry.external.auth.enabled }}
            {{- end }}
            {{- if $registryAuthEnabled }}
            - name: KUBERNETES_IMAGE_PULL_SECRETS
              value: "{{ include "trigger-v4.fullname" . }}-registry-secret"
            {{- end }}
            - name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT
              value: {{ default "10Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeLimit | quote }}
            - name: KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST
              value: {{ default "2Gi" .Values.supervisor.config.kubernetes.ephemeralStorageSizeRequest | quote }}
            # Pod cleaner configuration
            - name: POD_CLEANER_ENABLED
              value: {{ .Values.supervisor.config.podCleaner.enabled | quote }}
            - name: POD_CLEANER_BATCH_SIZE
              value: {{ .Values.supervisor.config.podCleaner.batchSize | quote }}
            - name: POD_CLEANER_INTERVAL_MS
              value: {{ .Values.supervisor.config.podCleaner.intervalMs | quote }}
            # Failed pod handler
            - name: FAILED_POD_HANDLER_ENABLED
              value: {{ .Values.supervisor.config.failedPodHandler.enabled | quote }}
            - name: FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS
              value: {{ .Values.supervisor.config.failedPodHandler.reconnectIntervalMs | quote }}
            # Workload API configuration
            - name: TRIGGER_WORKLOAD_API_PROTOCOL
              value: {{ .Values.supervisor.config.workloadApi.protocol | quote }}
            - name: TRIGGER_WORKLOAD_API_DOMAIN
              value: "{{ include "trigger-v4.fullname" . }}-supervisor.{{ .Release.Namespace }}.svc.cluster.local"
            - name: TRIGGER_WORKLOAD_API_PORT_EXTERNAL
              value: {{ .Values.supervisor.config.workloadApi.portExternal | quote }}
            - name: TRIGGER_WORKLOAD_API_PORT_INTERNAL
              value: {{ .Values.supervisor.config.workloadApi.portInternal | quote }}
            - name: TRIGGER_WORKLOAD_API_HOST_INTERNAL
              value: {{ .Values.supervisor.config.workloadApi.hostInternal | quote }}
            - name: TRIGGER_WORKLOAD_API_ENABLED
              value: {{ .Values.supervisor.config.workloadApi.enabled | quote }}
            # Dequeue configuration
            - name: TRIGGER_DEQUEUE_ENABLED
              value: {{ .Values.supervisor.config.dequeue.enabled | quote }}
            - name: TRIGGER_DEQUEUE_INTERVAL_MS
              value: {{ .Values.supervisor.config.dequeue.intervalMs | quote }}
            - name: TRIGGER_DEQUEUE_MAX_RUN_COUNT
              value: {{ .Values.supervisor.config.dequeue.maxRunCount | quote }}
            - name: TRIGGER_DEQUEUE_IDLE_INTERVAL_MS
              value: {{ .Values.supervisor.config.dequeue.idleIntervalMs | quote }}
            # Heartbeat configuration
            - name: RUNNER_HEARTBEAT_INTERVAL_SECONDS
              value: {{ .Values.supervisor.config.runner.heartbeatIntervalSeconds | quote }}
            - name: RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS
              value: {{ .Values.supervisor.config.runner.snapshotPollIntervalSeconds | quote }}
            # Metrics configuration
            - name: METRICS_ENABLED
              value: {{ .Values.supervisor.config.metrics.enabled | quote }}
            - name: METRICS_COLLECT_DEFAULTS
              value: {{ .Values.supervisor.config.metrics.collectDefaults | quote }}
            - name: METRICS_HOST
              value: {{ .Values.supervisor.config.metrics.host | quote }}
            - name: METRICS_PORT
              value: {{ .Values.supervisor.config.metrics.port | quote }}
            # Debug
            - name: DEBUG
              value: {{ .Values.supervisor.config.debug | quote }}
            # OTEL
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://{{ include "trigger-v4.fullname" . }}-webapp:{{ .Values.webapp.service.port }}/otel"
            {{- with .Values.supervisor.extraEnvVars }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          {{- if not .Values.webapp.bootstrap.enabled }}
          volumeMounts:
            - name: shared
              mountPath: /home/node/shared
          {{- end }}
          {{- with .Values.supervisor.securityContext }}
          securityContext:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- if not .Values.webapp.bootstrap.enabled }}
      volumes:
        - name: shared
          {{- if .Values.persistence.shared.enabled }}
          persistentVolumeClaim:
            claimName: {{ include "trigger-v4.fullname" . }}-shared
          {{- else }}
          emptyDir: {}
          {{- end }}
      {{- end }}
      {{- with .Values.supervisor.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.supervisor.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.supervisor.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ include "trigger-v4.fullname" . }}-supervisor
  labels:
    {{- $component := "supervisor" }}
    {{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
spec:
  type: {{ .Values.supervisor.service.type }}
  ports:
    - port: {{ .Values.supervisor.service.ports.workload }}
      targetPort: workload
      protocol: TCP
      name: workload
    - port: {{ .Values.supervisor.service.ports.metrics }}
      targetPort: metrics
      protocol: TCP
      name: metrics
  selector:
    {{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}