From 1b629d8ea3403715256f755f4a419fc16fbf5d49 Mon Sep 17 00:00:00 2001
From: Suriya <tenext@Suriyas-MacBook-Air.local>
Date: Mon, 20 Jul 2026 12:25:55 +0530
Subject: [PATCH] Recreate worker-notifications - lost when core namespace got
 wiped

This StatefulSet was deployed manually outside git at some point before
this repo's GitOps work began, and was destroyed when deleting the core
Kustomization triggered a full namespace recreation (Flux prune-on-delete
cascades regardless of kubectl's --cascade flag - that only affects
Kubernetes' own owner-reference GC, not Flux's finalizer).

Reconstructed from its own logs (NATS_STREAM=NOTIFICATIONS,
NATS_CONSUMER=notifications-worker, FILTER_SUBJECT=api.v1.notifications.push)
plus the same pattern as its sibling workers. Resource limits and
WORKER_CONCURRENCY are a best-guess match to worker-rider-logs, since the
original values were never version-controlled anywhere. Adding it to git
now so this can't happen again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 manifests/core/kustomization.yaml        |   1 +
 manifests/core/worker-notifications.yaml | 122 +++++++++++++++++++++++
 2 files changed, 123 insertions(+)
 create mode 100644 manifests/core/worker-notifications.yaml

diff --git a/manifests/core/kustomization.yaml b/manifests/core/kustomization.yaml
index 67f0244..7817aee 100644
--- a/manifests/core/kustomization.yaml
+++ b/manifests/core/kustomization.yaml
@@ -12,6 +12,7 @@ resources:
   - core-config.yaml
   - worker-script.yaml
   - workers.yaml
+  - worker-notifications.yaml
   - worker-pdb.yaml
   - ingress-unified.yaml
   # traefik-middlewares.yaml intentionally excluded - this cluster's
diff --git a/manifests/core/worker-notifications.yaml b/manifests/core/worker-notifications.yaml
new file mode 100644
index 0000000..401e6b6
--- /dev/null
+++ b/manifests/core/worker-notifications.yaml
@@ -0,0 +1,122 @@
+# Reconstructed manifest - this StatefulSet was originally deployed
+# manually outside of git, and was lost when the core namespace got
+# recreated during the Flux removal incident on 2026-07-20. Rebuilt from
+# its confirmed runtime config (NATS_STREAM/NATS_CONSUMER/FILTER_SUBJECT
+# seen in its own logs) plus the same pattern as its sibling workers.
+# Resource requests/limits and WORKER_CONCURRENCY are best-guess matches
+# to the lightest sibling worker (worker-rider-logs) - adjust if the
+# original values are known.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: worker-notifications
+  namespace: core
+  labels:
+    app.kubernetes.io/name: worker-notifications
+    app.kubernetes.io/component: worker
+spec:
+  serviceName: "worker-notifications"
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: worker-notifications
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: worker-notifications
+        app.kubernetes.io/component: worker
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9090"
+        prometheus.io/path: "/metrics"
+    spec:
+      terminationGracePeriodSeconds: 45
+      tolerations:
+      - key: dedicated
+        operator: Equal
+        value: workers
+        effect: NoSchedule
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.workolik/worker
+                operator: In
+                values:
+                - "true"
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - worker-notifications
+              topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: worker-notifications
+      containers:
+      - name: worker
+        image: workolik360/nats-worker:v1.1.0
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+        command: ["python3", "-u", "/scripts/worker.py"]
+        volumeMounts:
+        - name: worker-script-vol
+          mountPath: /scripts
+        envFrom:
+        - configMapRef:
+            name: core-config
+        env:
+        - name: NATS_STREAM
+          value: "NOTIFICATIONS"
+        - name: NATS_CONSUMER
+          value: "notifications-worker"
+        - name: FILTER_SUBJECT
+          value: "api.v1.notifications.push"
+        - name: WORKER_CONCURRENCY
+          value: "10"
+        - name: NATS_USER
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: username
+        - name: NATS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: password
+        - name: EXTERNAL_ENDPOINT_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: external-endpoint-secrets
+              key: api_key
+              optional: true
+        - name: EXTERNAL_BASE_URL
+          value: "http://10.43.224.63"
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "40m"
+          limits:
+            memory: "128Mi"
+            cpu: "200m"
+        ports:
+        - containerPort: 9090
+          name: metrics
+      volumes:
+      - name: worker-script-vol
+        configMap:
+          name: worker-script