add a worker deployment

this runs a celery worker process in the image. we make the default
docker command just list the available `inv` tasks, and we use
kubernetes args to specify what `inv` should do inside the image

Dockerfile

@@ -39,6 +39,7 @@ RUN IN_BUILD=True FLASK_APP=spaceship flask assets build
 # set this to 'production' in production deploys
 ENV ENVIRONMENT dev
 
-ENTRYPOINT ["inv", "run.gunicorn"]
+ENTRYPOINT ["inv"]
+CMD ["--list"]
 
 EXPOSE 9876/tcp

k8s/container_environment.yaml

@@ -0,0 +1,68 @@
+- name: IN_PRODUCTION
+  value: 'True'
+- name: COMPONENT
+  valueFrom:
+    fieldRef:
+      fieldPath: metadata.labels['component']
+- name: MYSQL_HOST
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-mysql
+      key: host
+- name: MYSQL_PORT
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-mysql
+      key: port
+- name: MYSQL_USERNAME
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-mysql
+      key: username
+- name: MYSQL_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-mysql
+      key: password
+- name: MYSQL_DB
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-mysql
+      key: db
+- name: REDIS_HOST
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-redis
+      key: host
+- name: REDIS_PORT
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-redis
+      key: port
+- name: REDIS_DB
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-redis
+      key: db
+- name: SECRET_KEY
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-session
+      key: secret_key
+- name: SENDGRID_KEY
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-sendgrid
+      key: secret_key
+- name: GOOGLE_CLIENT_ID
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-google-oauth
+      key: client_id
+- name: GOOGLE_CLIENT_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: pyspaceship-google-oauth
+      key: secret
+- name: GOOGLE_APPLICATION_CREDENTIALS
+  value: /srv/pyspaceship/google-app-creds/key.json

k8s/service.yaml

@@ -6,6 +6,7 @@ spec:
   type: NodePort
   selector:
     app: pyspaceship
+    component: web
   ports:
   - name: spaceship-port
     protocol: TCP

k8s/web_deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pyspaceship-web-deployment
+  labels:
+    app: pyspaceship
+spec:
+  selector:
+    matchLabels:
+      app: pyspaceship
+      component: web
+  replicas: {$eval: replicas}
+  template:
+    metadata:
+      labels:
+        app: pyspaceship
+        component: web
+    spec:
+      containers:
+      - name: pyspaceship-web
+        image: {$eval: image}
+        args: ["run.gunicorn"]
+        imagePullPolicy: "Always"
+        env: {$eval: container_environment}
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 9876
+        volumeMounts:
+          - name: google-app-creds
+            mountPath: /srv/pyspaceship/google-app-creds
+      volumes:
+        - name: google-app-creds
+          secret:
+            secretName: google-app-creds

k8s/worker_deployment.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pyspaceship-worker-deployment
+  labels:
+    app: pyspaceship
+spec:
+  selector:
+    matchLabels:
+      app: pyspaceship
+      component: worker
+  replicas: {$eval: replicas}
+  template:
+    metadata:
+      labels:
+        app: pyspaceship
+        component: worker
+    spec:
+      containers:
+      - name: pyspaceship-worker
+        image: {$eval: image}
+        args: ["run.celery-worker"]
+        imagePullPolicy: "Always"
+        env: {$eval: container_environment}
+        volumeMounts:
+          - name: google-app-creds
+            mountPath: /srv/pyspaceship/google-app-creds
+      volumes:
+        - name: google-app-creds
+          secret:
+            secretName: google-app-creds

spaceship/config.py

@@ -5,6 +5,8 @@
 class Config:
   IN_BUILD = bool(os.environ.get('IN_BUILD', False))
   IN_PRODUCTION = bool(os.environ.get('IN_PRODUCTION', False))
+  COMPONENT = os.environ.get('COMPONENT', 'unknown')
+
   SECRET_KEY = os.environ.get('SECRET_KEY', 'develoment')
   SENDGRID_KEY = os.environ.get('SENDGRID_KEY', None)
   EMAIL_CONFIRM_SALT = 'email-confirm-salt'

tasks/image.py

@@ -59,15 +59,27 @@ def do_deploy(tag, ns):
   if ns.is_prod:
     replicas = 3
 
-  deployment = load_manifest(
-    'deployment',
+  environment = load_manifest('container_environment', {})
+
+  web = load_manifest(
+    'web_deployment',
     {
       'image': tag,
       'replicas': replicas,
+      'container_environment': environment,
     }
   )
+  ns.apply(web)
 
-  ns.apply(deployment)
+  worker = load_manifest(
+    'worker_deployment',
+    {
+      'image': tag,
+      'replicas': replicas,
+      'container_environment': environment,
+    }
+  )
+  ns.apply(worker)
 
   service = load_manifest('service')
   ns.apply(service)

tasks/utils.py

@@ -113,5 +113,3 @@ def load_manifest(mtype, context = {}):
 
 def random_string(length):
   return "".join( random.SystemRandom().choices(string.ascii_letters + string.digits, k=length))
-
-