Graham McIntire
47a3e1dbde
podAntiAffinity on app=prop already keeps the backfill pod on its own physical host, so the dedicated nodeSelector + taint were redundant. Removing them lets talos4 be used as a normal worker for anything else the cluster wants to place there. The live taint and label on talos4 were cleared alongside this commit.
114 lines
3.9 KiB
YAML
114 lines
3.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: prop-backfill
|
|
namespace: prop
|
|
spec:
|
|
# Single replica. podAntiAffinity on app=prop / physical-host means
|
|
# this pod lands on whichever physical host the hot replicas aren't on
|
|
# (currently talos4 / node4); no nodeSelector or taint is needed to
|
|
# pin it — the antiaffinity is sufficient and keeps talos4 available
|
|
# as a normal scheduling target for the rest of the cluster.
|
|
replicas: 1
|
|
minReadySeconds: 5
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 0
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app: prop
|
|
tier: backfill
|
|
template:
|
|
metadata:
|
|
labels:
|
|
# app=prop matches the libcluster selector in runtime.exs, so these
|
|
# pods join the same Erlang cluster as the hot-path prop pods and
|
|
# share Oban's queue ownership / leader election.
|
|
app: prop
|
|
tier: backfill
|
|
spec:
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: prop
|
|
topologyKey: topology.kubernetes.io/physical-host
|
|
serviceAccountName: prop
|
|
imagePullSecrets:
|
|
- name: forgejo-registry
|
|
securityContext:
|
|
runAsUser: 65534
|
|
runAsNonRoot: true
|
|
fsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: prop-backfill
|
|
image: git.mcintire.me/graham/prop:main-1776884183-04146af # {"$imagepolicy": "flux-system:prop"}
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
# No PHX_SERVER — endpoint stays inert. No PORT either.
|
|
- name: PROP_ROLE
|
|
value: "backfill"
|
|
- name: PHX_HOST
|
|
value: "prop.w5isp.com"
|
|
- name: HRRR_BASE_URL
|
|
value: "http://skippy.w5isp.com:8080"
|
|
# OTLP disabled — see deployment.yaml for rationale.
|
|
envFrom:
|
|
- secretRef:
|
|
name: prop-secrets
|
|
# No HTTP probes (no web server). Use exec probe against the
|
|
# running BEAM to confirm the VM is responsive. `rpc ':ok'`
|
|
# has to spawn a release CLI and round-trip through distributed
|
|
# Erlang; during an IEM 429 retry storm the scheduler is
|
|
# responsive but slow. 15 s still tripped failureThreshold
|
|
# every ~10 min, so the liveness probe now runs every 2 min
|
|
# with a 30 s ceiling — the BEAM itself would have crashed
|
|
# long before that if it were genuinely wedged, and rescue
|
|
# relies on the BEAM's own crash-loop handling anyway.
|
|
startupProbe:
|
|
exec:
|
|
command: ["/bin/sh", "-c", "/app/bin/microwaveprop rpc ':ok'"]
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 18
|
|
timeoutSeconds: 30
|
|
livenessProbe:
|
|
exec:
|
|
command: ["/bin/sh", "-c", "/app/bin/microwaveprop rpc ':ok'"]
|
|
periodSeconds: 120
|
|
failureThreshold: 3
|
|
timeoutSeconds: 30
|
|
resources:
|
|
# 8GB T620 box — leave ~3GB for kubelet/containerd/OS.
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 4Gi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
volumes:
|
|
- name: data
|
|
nfs:
|
|
server: 10.0.15.103
|
|
path: /data
|