deployment-scheduler.yaml

{{- if .Values.scheduler.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "substra.fullname" . }}-scheduler
  labels:
    {{ include "substra.labels" . | nindent 4 }}
    app.kubernetes.io/name: {{ template "substra.name" . }}-scheduler
spec:
  replicas: {{ .Values.scheduler.replicaCount }}
  selector:
    matchLabels:
        app.kubernetes.io/name: {{ template "substra.name" . }}-scheduler
        {{ include "substra.selectorLabels" . | nindent 8}}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "substra.name" . }}-scheduler
        role-database-client: 'true'
        role-orchestrator-client: 'true'
        role-redis-client: 'true'
        role-registry-client: 'true'
        {{ include "substra.labels" . | nindent 8 }}
      annotations:
        # This will cause the pod to restart if the content of the ConfigMap is updated through Helm
        checksum-cm-orchestrator: {{ include (print $.Template.BasePath "/configmap-orchestrator.yaml") . | sha256sum }}
        checksum-cm-settings: {{ include (print $.Template.BasePath "/configmap-settings.yaml") . | sha256sum }}
        checksum-cm-db: {{ include (print $.Template.BasePath "/configmap-database.yaml") . | sha256sum }}
        checksum-cm-redis: {{ include (print $.Template.BasePath "/configmap-redis.yaml") . | sha256sum }}
        checksum-cm-registry: {{ include (print $.Template.BasePath "/configmap-registry.yaml") . | sha256sum }}
        checksum-secret-database : {{ include (print $.Template.BasePath "/secret-database.yaml") . | sha256sum }}
        checksum-secret-redis : {{ include (print $.Template.BasePath "/secret-redis.yaml") . | sha256sum }}
    spec:
      {{- with .Values.scheduler.image.pullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.scheduler.podSecurityContext.enabled }}
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
        fsGroup: {{ .Values.scheduler.podSecurityContext.fsGroup }}
        runAsGroup: {{ .Values.scheduler.podSecurityContext.runAsGroup }}
        runAsUser: {{ .Values.scheduler.podSecurityContext.runAsUser }}
      {{- end }}
      containers:
        - name: scheduler
          image: {{ include "substra-backend.images.name" (dict "img" .Values.scheduler.image "defaultTag" $.Chart.AppVersion) }}
          imagePullPolicy: {{ .Values.scheduler.image.pullPolicy }}
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
            capabilities:
              drop: ["ALL"]
          command: ["/bin/bash"]
          args: ["-c", "celery -A backend beat -l debug --schedule /var/substra/runtime-db/celerybeat-scheduler"]
          envFrom:
            - configMapRef:
                name: {{ include "substra.fullname" . }}-orchestrator
            - configMapRef:
                name: {{ include "substra.fullname" . }}-settings
            - configMapRef:
                name: {{ include "substra.fullname" . }}-database
            - configMapRef:
                name: {{ include "substra.fullname" . }}-redis
            - configMapRef:
                name: {{ include "substra.fullname" . }}-registry
            - secretRef:
                name: {{ include "substra.fullname" . }}-redis
            - secretRef:
                name: {{ include "substra-backend.database.secret-name" . }}
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: DJANGO_SETTINGS_MODULE
              value: backend.settings.celery.{{ .Values.settings }}
          volumeMounts:
            - name: runtime-db
              mountPath: /var/substra/runtime-db
            {{ if .Values.orchestrator.tls.enabled }}
            - name: orchestrator-tls-cacert
              mountPath: /var/substra/orchestrator/tls/server
            {{ if .Values.orchestrator.tls.mtls.enabled }}
            - name: orchestrator-tls-client-pair
              mountPath: /var/substra/orchestrator/tls/client
            {{ end }}
            {{ end }}
          resources:
            {{- toYaml .Values.scheduler.resources | nindent 12 }}
      volumes:
      - name: runtime-db
        emptyDir: {}
      {{ if.Values.orchestrator.tls.enabled }}
      - name: orchestrator-tls-cacert
        secret:
          secretName: {{ $.Values.orchestrator.tls.cacert }}
      {{ if .Values.orchestrator.tls.mtls.enabled }}
      - name: orchestrator-tls-client-pair
        secret:
          secretName: {{ .Values.orchestrator.tls.mtls.clientCertificate }}
      {{ end }}
      {{ end }}
    {{- with .Values.scheduler.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.scheduler.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.scheduler.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
{{- end }}