apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: worker
  namespace: core
  labels:
    app.kubernetes.io/name: worker
    app.kubernetes.io/instance: worker-primary
    app.kubernetes.io/part-of: core
    app.kubernetes.io/component: worker
spec:
  serviceName: "worker" # Required for StatefulSet
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: worker
      app.kubernetes.io/instance: worker-primary
  template:
    metadata:
      labels:
        app.kubernetes.io/name: worker
        app.kubernetes.io/instance: worker-primary
        app.kubernetes.io/part-of: core
        app.kubernetes.io/component: worker
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"
        prometheus.io/path: "/metrics"
    spec:
      terminationGracePeriodSeconds: 45
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 2000
      tolerations:
      - key: dedicated
        operator: Equal
        value: workers
        effect: NoSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: node-role.workolik/worker
                operator: In
                values:
                - "true"
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - worker
              topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: ScheduleAnyway
        labelSelector:
          matchLabels:
            app.kubernetes.io/name: worker
      containers:
      - name: worker
        image: workolik360/nats-worker:v1.1.0
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
          capabilities:
            drop:
              - ALL
        ports:
        - containerPort: 9090
          name: metrics
        command: ["python3", "-u", "/scripts/worker.py"]
        volumeMounts:
        - name: worker-script-vol
          mountPath: /scripts
        envFrom:
        - configMapRef:
            name: core-config
        env:
        - name: NATS_USER
          valueFrom:
            secretKeyRef:
              name: nats-credentials
              key: username
        - name: NATS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: nats-credentials
              key: password
        - name: EXTERNAL_ENDPOINT_API_KEY
          valueFrom:
            secretKeyRef:
              name: external-endpoint-secrets
              key: api_key
              optional: true
        resources:
          requests:
            memory: "256Mi"
            cpu: "200m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /metrics
            port: 9090
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 10
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /metrics
            port: 9090
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
      volumes:
      - name: worker-script-vol
        configMap:
          name: worker-script