deployment-server.yaml

{{- $metricsPath := "/tmp/django_metrics" -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "substra.fullname" . }}-server
  labels:
    {{ include "substra.labels" . | nindent 4 }}
    app.kubernetes.io/name: {{ template "substra.name" . }}-server
spec:
  replicas: {{ .Values.server.replicaCount }}
  selector:
    matchLabels:
        app.kubernetes.io/name: {{ template "substra.name" . }}-server
        {{ include "substra.selectorLabels" . | nindent 8}}
  strategy:
    type: {{ .Values.server.updateStrategy.type }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "substra.name" . }}-server
        role-redis-client: 'true'
        role-database-client: 'true'
        role-internet-ingress: 'true'
        role-internet-egress: 'true'
        role-orchestrator-client: 'true'
        {{- if .Values.server.allowLocalRequests }}
        role-server-client: 'true'
        {{- end }}
        role-storage-client: 'true'
        {{ include "substra.labels" . | nindent 8 }}
      annotations:
        # This will cause the pod to restart if the content of the ConfigMap is updated through Helm
        checksum-cm-orchestrator: {{ include (print $.Template.BasePath "/configmap-orchestrator.yaml") . | sha256sum }}
        checksum-cm-settings: {{ include (print $.Template.BasePath "/configmap-settings.yaml") . | sha256sum }}
        checksum-cm-db: {{ include (print $.Template.BasePath "/configmap-database.yaml") . | sha256sum }}
        checksum-cm-oidc: {{ include (print $.Template.BasePath "/configmap-oidc.yaml") . | sha256sum }}
        checksum-secret-objectstore : {{ include (print $.Template.BasePath "/secret-objectstore.yaml") . | sha256sum }}
        checksum-secret-database : {{ include (print $.Template.BasePath "/secret-database.yaml") . | sha256sum }}
    spec:
      {{- if .Values.server.podSecurityContext.enabled }}
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
        fsGroup: {{ .Values.server.podSecurityContext.fsGroup }}
        runAsUser: {{ .Values.server.podSecurityContext.runAsUser }}
        runAsGroup: {{ .Values.server.podSecurityContext.runAsGroup }}
      {{- end }}
      {{- with .Values.server.image.pullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: server
        image: {{ include "substra-backend.images.name" (dict "img" .Values.server.image "defaultTag" $.Chart.AppVersion) }}
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop: ["ALL"]
        imagePullPolicy: "{{ .Values.server.image.pullPolicy }}"
        command: ["/bin/bash"]
        {{- if eq .Values.settings "prod" }}
        args: ["-c", "uwsgi --ini uwsgi.ini"]
        {{- else }}
        args: ["-c", "watchmedo auto-restart --directory=./ --pattern=*.py --recursive -- uwsgi --ini uwsgi.ini --honour-stdin"]
        stdin: true
        tty: true
        {{- end }}
        envFrom:
          - configMapRef:
              name: {{ include "substra.fullname" . }}-orchestrator
          - secretRef:
              name: {{ include "substra.fullname" . }}-objectstore
          - configMapRef:
              name: {{ include "substra.fullname" . }}-settings
          - configMapRef:
              name: {{ include "substra.fullname" . }}-database
          - secretRef:
              name: {{ include "substra-backend.database.secret-name" . }}
          - secretRef:
              name: {{ include "substra.fullname" . }}-server-key
          - configMapRef:
              name: {{ include "substra.fullname" . }}-oidc
          {{- if .Values.oidc.enabled }}
          - secretRef:
              name: {{ .Values.oidc.clientSecretName }}
          {{- end }}
        env:
          - name: HOST_IP
            valueFrom:
              fieldRef:
                fieldPath: status.hostIP
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          {{- if .Values.server.metrics.enabled }}
          - name: ENABLE_METRICS
            value: "True"
          - name: PROMETHEUS_MULTIPROC_DIR
            value: {{ $metricsPath }}
          {{- end }}
          {{- if .Values.privateCa.enabled }}
          - name: REQUESTS_CA_BUNDLE
            value: /etc/ssl/certs/ca-certificates.crt
          {{- end }}
        ports:
          - name: http
            containerPort: 8000
            protocol: TCP
        volumeMounts:
          - name: data-servermedias
            mountPath: /var/substra/servermedias
          - name: statics
            mountPath: /usr/src/app/backend/statics
          - name: uwsgi
            mountPath: /usr/src/app/uwsgi.ini
            subPath: uwsgi.ini
            readOnly: true
          - name: runtime-secrets
            mountPath: /var/substra/runtime-secrets
          {{- if .Values.privateCa.enabled }}
          - mountPath: /etc/ssl/certs
            name: ssl-certs
          {{- end }}
          {{ if .Values.orchestrator.tls.enabled }}
          - name: orchestrator-tls-cacert
            mountPath: /var/substra/orchestrator/tls/server
          {{ if .Values.orchestrator.tls.mtls.enabled }}
          - name: orchestrator-tls-client-pair
            mountPath: /var/substra/orchestrator/tls/client
          {{ end }}
          {{ end }}
          {{- if .Values.server.metrics.enabled }}
          - name: metrics
            mountPath: {{ $metricsPath }}
          {{- end }}
        {{- if .Values.server.livenessProbe.enabled }}
        livenessProbe:
          httpGet:
            path: {{ .Values.server.livenessProbe.path }}
            port: http
          initialDelaySeconds: {{ .Values.server.livenessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.server.livenessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.server.livenessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.server.livenessProbe.successThreshold }}
          failureThreshold: {{ .Values.server.livenessProbe.failureThreshold }}
        {{- end }}
        {{- if .Values.server.readinessProbe.enabled }}
        readinessProbe:
          httpGet:
            path: {{ .Values.server.readinessProbe.path }}
            port: http
          initialDelaySeconds: {{ .Values.server.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.server.readinessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.server.readinessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.server.readinessProbe.successThreshold }}
          failureThreshold: {{ .Values.server.readinessProbe.failureThreshold }}
        {{- end }}
        resources:
          {{- toYaml .Values.server.resources | nindent 12 }}
      {{- if .Values.server.metrics.enabled }}
      - name: metrics-sidecar
        image: {{ include "substra-backend.images.name" (dict "img" .Values.server.metrics.image "defaultTag" $.Chart.AppVersion) }}
        imagePullPolicy: {{ .Values.server.metrics.image.pullPolicy }}
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop: ["ALL"]
        command: ["/bin/bash"]
        args:
          - "-c"
          - "python /usr/src/app/metrics_exporter/server.py"
        envFrom:
          - configMapRef:
              name: {{ include "substra.fullname" . }}-redis
        env:
          - name: PROMETHEUS_MULTIPROC_DIR
            value: {{ $metricsPath }}
          - name: CELERY_MONITORING_ENABLED
            value: "True"
          - name: CELERY_BROKER_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ include "substra-backend.redis.secretName" . }}
                key: {{ include "substra-backend.redis.secretPasswordKey" . }}
        ports:
          - name: metrics
            containerPort: 8001
            protocol: TCP
        volumeMounts:
          - name: metrics
            mountPath: {{ $metricsPath }}
      {{- end }}
      initContainers:
      {{- include "common.addCertInitContainer" . | nindent 6 }}
      - name: init-collectstatic
        image: {{ include "substra-backend.images.name" (dict "img" .Values.server.image "defaultTag" $.Chart.AppVersion) }}
        command: ['python', 'manage.py', 'collectstatic', '--noinput']
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop: ["ALL"]
        envFrom:
          - configMapRef:
              name: {{ include "substra.fullname" . }}-orchestrator
          - configMapRef:
              name: {{ include "substra.fullname" . }}-settings
        env:
          - name: DJANGO_SETTINGS_MODULE
            value: backend.settings.{{ .Values.settings }}
        volumeMounts:
          - name: statics
            mountPath: /usr/src/app/backend/statics
      {{- include "common.waitPostgresqlInitContainer" . | nindent 6 }}
      - name: init-migrate
        image: {{ include "substra-backend.images.name" (dict "img" .Values.server.image "defaultTag" $.Chart.AppVersion) }}
        command: ['python', 'manage.py', 'migrate']
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop: ["ALL"]
        envFrom:
          - configMapRef:
              name: {{ include "substra.fullname" . }}-orchestrator
          - secretRef:
              name: {{ include "substra.fullname" . }}-objectstore
          - configMapRef:
              name: {{ include "substra.fullname" . }}-database
          - configMapRef:
              name: {{ include "substra.fullname" . }}-settings
          - secretRef:
              name: {{ include "substra-backend.database.secret-name" . }}
        env:
        - name: DJANGO_SETTINGS_MODULE
          value: backend.settings.{{ .Values.settings }}
      {{- include "common.waitMinIOContainer" . | nindent 6 }}
      {{- include "common.waitRedisInitContainer" . | nindent 6 }}
      volumes:
      - name: data-servermedias
        persistentVolumeClaim:
          claimName: {{ .Values.server.persistence.servermedias.existingClaim | default (print (include "substra.fullname" $) "-servermedias") }}
      - name: statics
        emptyDir: {}
      - name: runtime-secrets
        emptyDir: {}
      - name: uwsgi
        configMap:
          name: {{ include "substra.fullname" . }}-server-uwsgi
      {{- if .Values.server.metrics.enabled }}
      - name: metrics
        emptyDir: {}
      {{- end }}
      {{- if .Values.privateCa.enabled }}
      - name: ssl-certs
        emptyDir: {}
      - name: private-ca
        secret:
          secretName: {{ .Values.privateCa.secret.name }}
      {{- end }}
      {{ if .Values.orchestrator.tls.enabled }}
      - name: orchestrator-tls-cacert
        secret:
          secretName: {{ .Values.orchestrator.tls.cacert }}
      {{ if .Values.orchestrator.tls.mtls.enabled }}
      - name: orchestrator-tls-client-pair
        secret:
          secretName: {{ .Values.orchestrator.tls.mtls.clientCertificate }}
      {{ end }}
      {{ end }}
    {{- with .Values.server.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.server.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.server.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}