worker-deployment.yaml

{{- include "fides.worker.validateUniqueNames" . }}
{{- $userWorkers := .Values.fides.workerConfiguration.workers | default list }}
{{- $isFidesplus := include "fides.isFidesplus" . }}

{{/* Build default workers list */}}
{{- $defaultWorkers := list }}
{{/* Both Fides and Fidesplus get DSR and other workers */}}
{{- $defaultWorkers = list 
  (dict "name" "dsr" "count" 1 "queues" (list "fides.dsr") "resources" (dict "limits" (dict "memory" "512Mi") "requests" (dict "cpu" "100m" "memory" "256Mi")))
  (dict "name" "other" "count" 1 "excludeQueues" (list "fides.dsr" "fides.privacy_preferences") "resources" (dict "limits" (dict "memory" "512Mi") "requests" (dict "cpu" "100m" "memory" "256Mi")))
}}
{{/* Fidesplus additionally gets classification, helios, and consent workers */}}
{{- if eq $isFidesplus "true" }}
{{- $defaultWorkers = concat $defaultWorkers (list
  (dict "name" "classification" "count" 1 "queues" (list "fidesplus.discovery_monitors_classification") "resources" (dict "limits" (dict "memory" "512Mi") "requests" (dict "cpu" "100m" "memory" "256Mi")))
  (dict "name" "helios" "count" 1 "queues" (list "fidesplus.discovery_monitors_promotion" "fidesplus.discovery_monitors_detection") "resources" (dict "limits" (dict "memory" "512Mi") "requests" (dict "cpu" "100m" "memory" "256Mi")))
  (dict "name" "consent" "count" 1 "queues" (list "fides.privacy_preferences" "fides.consent_webhooks") "resources" (dict "limits" (dict "memory" "512Mi") "requests" (dict "cpu" "100m" "memory" "256Mi")))
) }}
{{- end }}

{{/* Merge user workers with defaults */}}
{{- $mergedWorkers := list }}
{{- $userWorkerNames := dict }}
{{- range $userWorkers }}
{{- $_ := set $userWorkerNames .name true }}
{{- $mergedWorkers = append $mergedWorkers . }}
{{- end }}
{{- range $defaultWorkers }}
{{- if not (hasKey $userWorkerNames .name) }}
{{- $mergedWorkers = append $mergedWorkers . }}
{{- end }}
{{- end }}

{{/* Check if we have any active workers */}}
{{- $hasActiveWorkers := false }}
{{- range $mergedWorkers }}
{{- if gt (.count | int) 0 }}
{{- $hasActiveWorkers = true }}
{{- end }}
{{- end }}
{{- $_ := set $ "worker" $hasActiveWorkers }}

{{- if $.worker }}
{{- range $mergedWorkers }}
{{- $workerCount := .count | int }}
{{- if gt $workerCount 0 }}
{{- $volume := "config" }}
{{- $configPath := "/etc/fides/config" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ printf "%s-%s" (include "fides.worker.fullname" $) .name}}
  labels:
    {{- include "fides.labels" $ | nindent 4 }}
    fid.es/worker: {{ .name }}
spec:
  replicas: {{ $workerCount | int }}
  selector:
    matchLabels:
      {{- include "fides.worker.selectorLabels" $ | nindent 6 }}
      fid.es/worker: {{ .name }}
  strategy:
    {{- include "fides.deploymentStrategy" $ | nindent 4 }}
  template:
    metadata:
      {{- with $.Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "fides.worker.selectorLabels" $ | nindent 8 }}
        fid.es/worker: {{ .name }}
    spec:
      {{- with $.Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "fides.serviceAccountName" $ }}
      securityContext:
        {{- toYaml $.Values.podSecurityContext | nindent 8 }}
      containers:
        - name: fides
          securityContext:
            {{- toYaml $.Values.securityContext | nindent 12 }}
          image: {{ printf "%s:%s" $.Values.fides.image.repository (default (include "fides.dockerTag" $) .imageTagOverride) }}
          imagePullPolicy: {{ $.Values.fides.image.pullPolicy }}
          command: ["fides"]
          {{- if and (hasKey . "queues") (hasKey . "excludeQueues") }}
            {{- fail (printf "Worker '%s' cannot have both --queues and --exclude-queues passed" .name) }}
          {{- end }}
          args:
            - worker
            {{- if hasKey . "queues" }}
            - {{ printf "--queues=%s" (join "," .queues) }}
            {{- else if hasKey . "excludeQueues" }}
            - {{ printf "--exclude-queues=%s" (join "," .excludeQueues) }}
            {{- end }}
          env:
            - name: FIDES__CONFIG_PATH
              value: {{ printf "%s/fides.toml" $configPath }}
            {{- include "fides.env" $ | nindent 12 }}
          envFrom:
            - secretRef: 
                name: {{ include "fides.fidesSecuritySecretName" $ }}
            {{- if $.Values.fides.configuration.additionalEnvVarsSecret }}
            - secretRef: 
                name: {{ $.Values.fides.configuration.additionalEnvVarsSecret }}
            {{- end }}
          livenessProbe:
            exec:
              command: [
                "bash",
                "-c",
                "celery --quiet --no-color --app fides.api.tasks inspect ping --destination celery@$HOSTNAME --json"
              ]
            initialDelaySeconds: {{ $.Values.fides.startupTimeSeconds | default 30 }}
            periodSeconds: 60
            timeoutSeconds: {{ $.Values.fides.healthCheckTimeoutSeconds | default 5 }}
          volumeMounts:
          - name: {{ $volume }}
            mountPath: {{ $configPath }}
          resources:
            {{- toYaml .resources | nindent 12 }}
      volumes:
        - name: {{ $volume }}
          configMap:
            name: {{ include "fides.worker.tomlConfigMapName" $ }}
      {{- with $.Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $.Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $.Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
---
{{- end }}
{{- end }}
{{- end }}