feat: enable site clusters to run Nautobot Celery workers on site clusters

charts/argocd-understack/templates/application-nautobot-worker.yaml

@@ -0,0 +1,66 @@
+{{- if eq (include "understack.isEnabled" (list $.Values.site "nautobot_worker")) "true" }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ printf "%s-%s" $.Release.Name "nautobot-worker" }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
+{{- include "understack.appLabelsBlock" $ | nindent 2 }}
+spec:
+  destination:
+    namespace: nautobot
+    server: {{ $.Values.cluster_server }}
+  project: understack
+  sources:
+  - chart: nautobot
+    helm:
+      fileParameters:
+      - name: nautobot.config
+        path: $understack/components/nautobot/nautobot_config.py
+      ignoreMissingValueFiles: true
+      releaseName: nautobot-worker
+      valueFiles:
+      - $understack/components/nautobot-worker/values.yaml
+      - $deploy/{{ include "understack.deploy_path" $ }}/nautobot-worker/values.yaml
+      {{- with index $.Values.appLabels "understack.rackspace.com/partition" }}
+      values: |
+        workers:
+          default:
+            taskQueues: {{ . | quote }}
+      {{- end }}
+    repoURL: https://nautobot.github.io/helm-charts/
+    targetRevision: 2.5.6
+
+  - path: components/nautobot-worker
+    ref: understack
+    repoURL: {{ include "understack.understack_url" $ }}
+    targetRevision: {{ include "understack.understack_ref" $ }}
+    kustomize:
+      patches:
+        - patch: |
+            - op: replace
+              path: /data/UNDERSTACK_PARTITION
+              value: "{{ index $.Values.appLabels "understack.rackspace.com/partition" | default "" }}"
+          target:
+            kind: ConfigMap
+            name: cluster-data
+  - path: {{ include "understack.deploy_path" $ }}/nautobot-worker
+    ref: deploy
+    repoURL: {{ include "understack.deploy_url" $ }}
+    targetRevision: {{ include "understack.deploy_ref" $ }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    managedNamespaceMetadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Delete=false
+    syncOptions:
+    - CreateNamespace=true
+    - ServerSideApply=true
+    - RespectIgnoreDifferences=true
+    - ApplyOutOfSyncOnly=true
+{{- end }}

charts/argocd-understack/values.yaml

@@ -556,6 +556,12 @@ site:
     # @default -- false
     enabled: false
 
+  # -- Nautobot Celery workers (site-level, connects to global Nautobot)
+  nautobot_worker:
+    # -- Enable/disable deploying Nautobot workers at the site level
+    # @default -- false
+    enabled: false
+
   # -- SNMP exporter for network device monitoring
   snmp_exporter:
     # -- Enable/disable deploying SNMP exporter

components/envoy-configs/templates/gw-external.yaml.tpl

@@ -35,13 +35,11 @@ spec:
     {{- range .Values.routes.tls }}
     {{- $listenerName := .name | default (index (splitList "." .fqdn) 0) }}
     - name: {{ $listenerName }}
-      port: {{ $.Values.gateways.external.port | default 443 }}
+      port: {{ .gatewayPort | default ($.Values.gateways.external.port | default 443) }}
       protocol: TLS
       hostname: {{ .fqdn | quote }}
       tls:
         mode: Passthrough
-        certificateRefs:
-          - name: {{ $listenerName }}-tls
       allowedRoutes:
         namespaces:
           {{- if .selector }}
@@ -52,6 +50,7 @@ spec:
           from: {{ .from | default "All" }}
           {{- end }}
     {{- end }}
+
   {{- if .Values.gateways.external.serviceAnnotations }}
   infrastructure:
     parametersRef:

components/envoy-configs/values.schema.json

@@ -180,6 +180,12 @@
                 "type": "string",
                 "description": "Namespace where the httproute will be installed (same as backend service)"
               },
+              "gatewayPort": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 65535,
+                "description": "Port exposed on the gateway for this TLS passthrough listener. Defaults to the external gateway port (443) if not specified."
+              },
               "service": {
                 "type": "object",
                 "description": "Kubernetes service backend configuration for the route",

components/nautobot-worker/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+configMapGenerator:
+  - name: cluster-data
+    literals:
+      - UNDERSTACK_PARTITION=""
+    options:
+      disableNameSuffixHash: true

components/nautobot-worker/values.yaml

@@ -0,0 +1,68 @@
+# Nautobot Worker (site-level)
+#
+# Deploys only Celery workers that connect back to the global Nautobot
+# database and Redis. The web server is disabled because it lives on
+# the global cluster. Redis and PostgreSQL are disabled because the
+# workers reach the global instances over the network.
+---
+
+# Disable the Nautobot web server — workers only
+nautobot:
+  enabled: false
+  replicaCount: 0
+
+  db:
+    engine: "django.db.backends.postgresql"
+    # Override in deploy repo values to point at the global CNPG service
+    host: ""
+    port: 5432
+    name: "app"
+    user: "app"
+    existingSecret: "nautobot-db"
+    existingSecretPasswordKey: "password"
+
+  django:
+    existingSecret: nautobot-django
+
+  superUser:
+    enabled: false
+
+  redis:
+    # Override in deploy repo values to point at the global Redis service
+    host: ""
+    port: 6379
+    ssl: false
+    username: ""
+
+celery:
+  enabled: true
+  concurrency: 2
+  replicaCount: 1
+  extraEnvVarsCM:
+    - cluster-data
+  extraEnvVarsSecret:
+    - nautobot-django
+  livenessProbe:
+    initialDelaySeconds: 60
+    periodSeconds: 120
+    timeoutSeconds: 60
+  readinessProbe:
+    initialDelaySeconds: 60
+    periodSeconds: 120
+    timeoutSeconds: 60
+
+# Disable celery beat — scheduling runs on the global cluster only
+workers:
+  beat:
+    enabled: false
+
+# Do not deploy local Redis — use the global instance
+redis:
+  enabled: false
+
+# Do not deploy local PostgreSQL — use the global CNPG instance
+postgresql:
+  enabled: false
+
+ingress:
+  enabled: false

components/nautobot/nautobot_config.py

@@ -64,6 +64,55 @@
 if DATABASES["default"]["ENGINE"].endswith("mysql"):  # noqa F405
     DATABASES["default"]["OPTIONS"] = {"charset": "utf8mb4"}  # noqa F405
 
+# mTLS options for PostgreSQL connections.
+# When NAUTOBOT_DB_SSLMODE is set to "verify-ca" or "verify-full", the client
+# certificate, key, and CA root cert must be present at the configured paths.
+_db_sslcert = os.getenv("NAUTOBOT_DB_SSLCERT", "/etc/nautobot/mtls/tls.crt")
+_db_sslkey = os.getenv("NAUTOBOT_DB_SSLKEY", "/etc/nautobot/mtls/tls.key")
+_db_sslrootcert = os.getenv("NAUTOBOT_DB_SSLROOTCERT", "/etc/nautobot/mtls/ca.crt")
+_db_sslmode = os.getenv("NAUTOBOT_DB_SSLMODE", "")
+
+if _db_sslmode in ("verify-ca", "verify-full"):
+    for _path, _label in [
+        (_db_sslcert, "NAUTOBOT_DB_SSLCERT"),
+        (_db_sslkey, "NAUTOBOT_DB_SSLKEY"),
+        (_db_sslrootcert, "NAUTOBOT_DB_SSLROOTCERT"),
+    ]:
+        if not os.path.isfile(_path):
+            raise FileNotFoundError(
+                f"SSL certificate file required by {_label} not found: {_path}"
+            )
+    DATABASES["default"]["OPTIONS"] = {  # noqa F405
+        "sslmode": _db_sslmode,
+        "sslcert": _db_sslcert,
+        "sslkey": _db_sslkey,
+        "sslrootcert": _db_sslrootcert,
+    }
+
+# mTLS options for Redis connections.
+# When NAUTOBOT_REDIS_SSL env var is "true" (set by Helm `nautobot.redis.ssl`),
+# the Helm chart switches the URL scheme to rediss://.  We still need to tell
+# the Python redis client *which* certs to use for mutual TLS.
+from ssl import CERT_REQUIRED  # noqa: E402
+
+_redis_ca = os.getenv("NAUTOBOT_REDIS_SSL_CA_CERTS", "/etc/nautobot/mtls/ca.crt")
+_redis_cert = os.getenv("NAUTOBOT_REDIS_SSL_CERTFILE", "/etc/nautobot/mtls/tls.crt")
+_redis_key = os.getenv("NAUTOBOT_REDIS_SSL_KEYFILE", "/etc/nautobot/mtls/tls.key")
+
+if os.path.isfile(_redis_ca):
+    _redis_ssl_kwargs = {
+        "ssl_cert_reqs": CERT_REQUIRED,
+        "ssl_ca_certs": _redis_ca,
+        "ssl_certfile": _redis_cert,
+        "ssl_keyfile": _redis_key,
+    }
+    CACHES["default"].setdefault("OPTIONS", {})  # noqa F405
+    CACHES["default"]["OPTIONS"].setdefault("CONNECTION_POOL_KWARGS", {})  # noqa F405
+    CACHES["default"]["OPTIONS"]["CONNECTION_POOL_KWARGS"].update(_redis_ssl_kwargs)  # noqa F405
+    CELERY_BROKER_USE_SSL = _redis_ssl_kwargs  # noqa F405
+    CELERY_REDIS_BACKEND_USE_SSL = _redis_ssl_kwargs  # noqa F405
+    CELERY_BROKER_TRANSPORT_OPTIONS = {"ssl": _redis_ssl_kwargs}  # noqa F405
+
 # This key is used for secure generation of random numbers and strings. It must never be exposed outside of this file.
 # For optimal security, SECRET_KEY should be at least 50 characters in length and contain a mix of letters, numbers, and
 # symbols. Nautobot will not run without this defined. For more information, see