deployment-worker.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "wordpress-bedrock.fullname" . }}-worker
  labels:
{{ include "wordpress-bedrock.labels" . | indent 4 }}
    app.kubernetes.io/component: "worker"
  annotations:
    {{- if .Values.wordpress.uptime }}
    downscaler/uptime: {{.Values.wordpress.uptime}}
    {{- end }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "wordpress-bedrock.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: "worker"
  template:
    metadata:
      labels:
        {{- include "wordpress-bedrock.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: "worker"
      {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
    {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      serviceAccountName: {{ template "wordpress-bedrock.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      # extend the pods shutdown grace period from the default of 30s to 60s
      terminationGracePeriodSeconds: 60
      initContainers:
        - name: copy-files
          securityContext:
            runAsUser: 0
          image: "{{ .Values.php.image.repository }}:{{ .Values.php.image.tag }}"
          imagePullPolicy: {{ .Values.php.image.pullPolicy }}
          command: ['sh', '-c', 'tar cf - . | (cd /tmp; tar xf -);chown -R www-data:2000 /tmp']
          volumeMounts:
          - name: web-volume
            mountPath: /tmp
            readOnly: false
          resources:
            {{- toYaml .Values.init.resources | nindent 12 }}
        {{- if .Values.offload.privateKey.enabled }}
        - name: prepare-private-key
          securityContext:
            runAsUser: 0
          image: "{{ .Values.php.image.repository }}:{{ .Values.php.image.tag }}"
          imagePullPolicy: {{ .Values.php.image.pullPolicy }}
          command: ['sh', '-c']
          args:
          - if [ "$WP_OFFLOAD_PRIVATE_KEY_BASE64" = "" ]; then echo "please define WP_OFFLOAD_PRIVATE_KEY_BASE64"; exit 1; fi;
            echo "$WP_OFFLOAD_PRIVATE_KEY_BASE64" | base64 -d > /tmp/"$WP_OFFLOAD_PRIVATE_KEY_FILE_NAME";
          env:
          - name: WP_OFFLOAD_PRIVATE_KEY_FILE_NAME
            value: {{ .Values.offload.privateKey.fileName | quote }}
          {{- range $key, $value := .Values.externalSecrets.env }}
          {{- if (eq "WP_OFFLOAD_PRIVATE_KEY_BASE64" $key) }}
          - name: {{ $key }}
            valueFrom:
              secretKeyRef:
                name: {{ template "wordpress-bedrock.fullname" $ }}
                key: {{ $key | lower | replace "_" "-" }}
          {{- end }}
          {{- end }}
          volumeMounts:
          - name: key-volume
            mountPath: /tmp
            readOnly: false
          resources:
            {{- toYaml .Values.init.resources | nindent 12 }}
        {{- end }}
      containers:
        - name: {{ .Chart.Name }}-nginx
          securityContext:
            {{- toYaml .Values.nginx.securityContext | nindent 12 }}
          image: "{{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag }}"
          imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            {{- toYaml .Values.nginx.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- toYaml .Values.nginx.readinessProbe | nindent 12 }}
          volumeMounts:
          - name: config-volume
            mountPath: /etc/nginx/conf.d/default.conf
            subPath: nginx-default.conf
            readOnly: true
          - name: web-volume
            mountPath: /var/www/html
            readOnly: true
          - name: uploads-volume
            mountPath: /var/www/html/web/app/uploads
            readOnly: false
          - name: nginx-cache-volume
            mountPath: /var/cache/nginx
            readOnly: false
          - name: nginx-var-run-volume
            mountPath: /var/run
            readOnly: false
{{- if .Values.nginx.extraVolumeMounts }}
          {{- toYaml .Values.nginx.extraVolumeMounts | nindent 10 }}
{{- end }}
          lifecycle:
            preStop:
              exec:
                # SIGTERM triggers a quick exit; gracefully terminate instead
                command:
                  - /bin/bash
                  - -c
                  - "sleep 30 && /usr/sbin/nginx -s quit"
          resources:
            {{- toYaml .Values.nginx.resources | nindent 12 }}
        - name: {{ .Chart.Name }}-php-fpm
          securityContext:
            {{- toYaml .Values.php.securityContext | nindent 12 }}
          image: "{{ .Values.php.image.repository }}:{{ .Values.php.image.tag }}"
          imagePullPolicy: {{ .Values.php.image.pullPolicy }}
          ports:
          - name: fpm
            containerPort: 9000
            protocol: TCP
          volumeMounts:
          - name: config-volume
            mountPath: /usr/local/etc/php-fpm.conf
            subPath: php-fpm.conf
            readOnly: true
          - name: web-volume
            mountPath: /var/www/html
            readOnly: {{ .Values.php.readOnlyWebFilesystem }}
          - name: uploads-volume
            mountPath: /var/www/html/web/app/uploads
            readOnly: false
          - name: tmp-volume
            mountPath: /tmp
            readOnly: false
          {{- if .Values.offload.privateKey.enabled }}
          - name: key-volume
            mountPath: {{ .Values.offload.privateKey.filePath }}
            readOnly: true
          {{- end }}
{{- if .Values.php.extraVolumeMounts }}
          {{- toYaml .Values.php.extraVolumeMounts | nindent 10 }}
{{- end }}
          lifecycle:
            preStop:
              exec:
                command:
                  - /bin/bash
                  - -c
                  - "sleep 30"
          env:
          - name: AWS_ZONE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.labels['topology.kubernetes.io/zone']
          {{- if $.Values.offload.bucket }}
          - name: WP_OFFLOAD_BUCKET
            value: {{ $.Values.offload.bucket | quote }}
          - name: WP_OFFLOAD_REGION
            value: {{ $.Values.offload.region | quote }}
          - name: WP_OFFLOAD_DOMAIN
            value: {{ $.Values.offload.domain | quote }}
          - name: WP_OFFLOAD_CLOUDFRONT
            value: {{ $.Values.offload.cloudfront | quote }}
          - name: WP_OFFLOAD_LOCAL_DOMAINS
            value: {{ $.Values.offload.local_domains | quote }}
          {{- end }}
          {{- if $.Values.offload.privateKey.enabled }}
          - name: WP_OFFLOAD_PRIVATE_KEY_FILE_PATH
            value: {{ printf "%s%s" $.Values.offload.privateKey.filePath $.Values.offload.privateKey.fileName | quote }}
          {{- end }}
          - name: WP_DEFAULT_HOST
            value: {{ index $.Values.ingress.hosts 0 "host" | quote }}
          - name: WP_PLUGINS
            value: {{ join " " $.Values.plugins | quote }}
          {{- range $key, $value := .Values.externalSecrets.env }}
          {{- if and (not (contains "WORDPRESS_" $key)) (not (contains "_ROOT_" $key)) (not (eq "WP_OFFLOAD_PRIVATE_KEY_BASE64" $key)) }}
          - name: {{ $key }}
            valueFrom:
              secretKeyRef:
                name: {{ template "wordpress-bedrock.fullname" $ }}
                key: {{ $key | lower | replace "_" "-" }}
          {{- end }}
          {{- end }}
          {{- with .Values.env }}
          {{- range $key, $value := . }}
          - name: {{ $key }}
            value: {{ $value | quote }}
          {{- end }}
          {{- end }}
          resources:
            {{- toYaml .Values.php.resources | nindent 12 }}
{{- if ( .Values.monitoring.enabled ) }}
        - name: {{ .Chart.Name }}-php-fpm-monitor
          securityContext:
            {{- toYaml .Values.exporter.phpfpm.securityContext | nindent 12 }}
          image: "{{ .Values.exporter.phpfpm.image.repository }}:{{ .Values.exporter.phpfpm.image.tag }}"
          imagePullPolicy: {{ .Values.exporter.phpfpm.image.pullPolicy }}
          env:
          - name: PHP_FPM_WEB_LISTEN_ADDRESS
            value: ":{{ .Values.exporter.phpfpm.port }}"
          - name: PHP_FPM_WEB_TELEMETRY_PATH
            value: {{ .Values.exporter.phpfpm.metrics | quote }}
          - name: PHP_FPM_SCRAPE_URI
            value: {{ .Values.exporter.phpfpm.scrape_uri | quote }}
          - name: PHP_FPM_FIX_PROCESS_COUNT
            value: {{ .Values.exporter.phpfpm.fix_process_count | quote }}
          - name: PHP_FPM_LOG_LEVEL
            value: {{ .Values.exporter.phpfpm.log_level | quote }}
          ports:
            - name: php-fpm-metrics
              containerPort: {{ .Values.exporter.phpfpm.port }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: php-fpm-metrics
          resources:
{{ toYaml .Values.exporter.phpfpm.resources | indent 12 }}
        - name: {{ .Chart.Name }}-nginx-monitor
          securityContext:
            {{- toYaml .Values.exporter.nginx.securityContext | nindent 12 }}
          image: "{{ .Values.exporter.nginx.image.repository }}:{{ .Values.exporter.nginx.image.tag }}"
          imagePullPolicy: {{ .Values.exporter.nginx.image.pullPolicy }}
          env:
          - name: LISTEN_ADDRESS
            value: ":{{ .Values.exporter.nginx.port }}"
          - name: TELEMETRY_PATH
            value: {{ .Values.exporter.nginx.telemetry_path | quote }}
          - name: NGINX_PLUS
            value: {{ .Values.exporter.nginx.nginx_plus | quote }}
          - name: SCRAPE_URI
            value: {{ .Values.exporter.nginx.scrape_uri | quote }}
          - name: SSL_VERIFY
            value: {{ .Values.exporter.nginx.ssl_verify | quote }}
          - name: TIMEOUT
            value: {{ .Values.exporter.nginx.timeout | quote }}
          - name: NGINX_RETRIES
            value: {{ .Values.exporter.nginx.nginx_retries | quote }}
          - name: NGINX_RETRY_INTERVAL
            value: {{ .Values.exporter.nginx.nginx_retry_interval | quote }}
          args:
          - --nginx.scrape-uri={{ .Values.exporter.nginx.scrape_uri }}
          ports:
            - name: nginx-metrics
              containerPort: {{ .Values.exporter.nginx.port }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /metrics
              port: nginx-metrics
          resources:
{{ toYaml .Values.exporter.nginx.resources | indent 12 }}
{{- end }}
      volumes:
      - name: config-volume
        configMap:
          # Provide the name of the ConfigMap containing the files you want
          # to add to the container
          name: {{ include "wordpress-bedrock.fullname" . }}
      - name: tmp-volume
        emptyDir: {}
      - name: nginx-cache-volume
        emptyDir: {}
      - name: nginx-var-run-volume
        emptyDir: {}
      - name: web-volume
        emptyDir: {}
      - name: uploads-volume
        emptyDir: {}
      {{- if .Values.offload.privateKey.enabled }}
      - name: key-volume
        emptyDir: {}
      {{- end }}
{{- range $key, $value := .Values.php.extraVolumeMounts }}
{{- if not (contains "efs" $value.name ) }}
      - name: {{ $value.name }}
        emptyDir: {}
{{- end }}
{{- end }}
{{- if .Values.efs.enabled }}
      - name: efs
        persistentVolumeClaim:
          claimName: {{ $.Release.Name }}
{{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.karpenter.optimization }}         
      {{- include "wordpress-bedrock.archSelector" . | trim | nindent 6 }}
      {{- else }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- end }}
      topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/instance: {{ .Release.Name }}
            app.kubernetes.io/component: "worker"
        {{- if semverCompare ">=1.27-0" $.Capabilities.KubeVersion.GitVersion }}
        matchLabelKeys:
        - pod-template-hash
        {{- end }}
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
      - labelSelector:
          matchLabels:
              app.kubernetes.io/instance: {{ .Release.Name }}
              app.kubernetes.io/component: "worker"
        {{- if semverCompare ">=1.27-0" $.Capabilities.KubeVersion.GitVersion }}
        matchLabelKeys:
        - pod-template-hash
        {{- end }}
        maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule