AI overhaul

2026-10-23 12:49:53 -04:00
parent b040ca26c3
commit b4db1a0182
21 changed files with 1226 additions and 189 deletions
@@ -0,0 +1,79 @@
+# Shared pod spec for web, worker and migration Job.
+automountServiceAccountToken: false
+restartPolicy: {{ 'OnFailure' if component == 'migrate' else 'Always' }}
+{% if www_image_pull_secrets | length %}
+imagePullSecrets:
+{{ www_image_pull_secrets | to_nice_yaml | indent(2, true) }}
+{% endif %}
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  fsGroup: 10001
+  seccompProfile:
+    type: RuntimeDefault
+containers:
+  - name: {{ component }}
+    image: {{ www_membership_image | to_json }}
+    imagePullPolicy: {{ www_membership_image_pull_policy }}
+{% if component == 'migrate' %}
+    command: [python, manage.py, migrate, --noinput]
+{% elif component == 'worker' %}
+    command: [python, manage.py, sync_memberships, --loop, --interval, {{ www_membership_worker_interval | string | to_json }}]
+{% endif %}
+    envFrom:
+      - configMapRef:
+          name: membership-config
+      - secretRef:
+          name: {{ www_membership_secret_name }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+    resources:
+{{ (www_membership_worker_resources if component == 'worker' else www_membership_resources) | to_nice_yaml | indent(6, true) }}
+{% if component == 'web' %}
+    ports:
+      - name: http
+        containerPort: 8000
+    startupProbe:
+      tcpSocket: {port: http}
+      periodSeconds: 5
+      failureThreshold: 24
+    readinessProbe:
+      exec:
+        command:
+          - python
+          - -c
+          - {{ ("import http.client; c=http.client.HTTPConnection('127.0.0.1',8000,timeout=3); c.request('GET','/members/',headers={'Host': '" ~ www_hostname ~ "', 'X-Forwarded-Proto': 'https'}); r=c.getresponse(); assert r.status==200; c.close()") | to_json }}
+      timeoutSeconds: 5
+      periodSeconds: 10
+    livenessProbe:
+      tcpSocket: {port: http}
+      periodSeconds: 20
+{% endif %}
+    volumeMounts:
+      - name: tiers
+        mountPath: /etc/membership/tiers
+        readOnly: true
+      - name: tmp
+        mountPath: /tmp
+{% if www_membership_ca_secret_name | length %}
+      - name: ca
+        mountPath: /etc/membership/ca
+        readOnly: true
+{% endif %}
+volumes:
+  - name: tiers
+    configMap:
+      name: membership-tiers
+  - name: tmp
+    emptyDir:
+      sizeLimit: 64Mi
+{% if www_membership_ca_secret_name | length %}
+  - name: ca
+    secret:
+      secretName: {{ www_membership_ca_secret_name }}
+      defaultMode: 0444
+{% endif %}