403 lines
17 KiB
Text
403 lines
17 KiB
Text
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
name: {{ taskserv.name }}
|
||
|
|
namespace: {{ taskserv.namespace }}
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: {{ taskserv.name }}
|
||
|
|
app.kubernetes.io/instance: {{ taskserv.tenant }}
|
||
|
|
app.kubernetes.io/managed-by: provisioning
|
||
|
|
spec:
|
||
|
|
replicas: 1
|
||
|
|
strategy:
|
||
|
|
type: Recreate
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: {{ taskserv.name }}
|
||
|
|
app.kubernetes.io/instance: {{ taskserv.tenant }}
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: {{ taskserv.name }}
|
||
|
|
app.kubernetes.io/instance: {{ taskserv.tenant }}
|
||
|
|
app.kubernetes.io/managed-by: provisioning
|
||
|
|
spec:
|
||
|
|
{% if taskserv.placement is defined and taskserv.placement.node_class %}
|
||
|
|
affinity:
|
||
|
|
nodeAffinity:
|
||
|
|
{% if taskserv.placement.mode == "require" %}
|
||
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
nodeSelectorTerms:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: node-class.{{ taskserv.placement.node_class.0 }}
|
||
|
|
operator: In
|
||
|
|
values: ["true"]
|
||
|
|
{% else %}
|
||
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
{% for c in taskserv.placement.node_class %}
|
||
|
|
- weight: {{ 100 - loop.index0 * 10 }}
|
||
|
|
preference:
|
||
|
|
matchExpressions:
|
||
|
|
- key: node-class.{{ c }}
|
||
|
|
operator: In
|
||
|
|
values: ["true"]
|
||
|
|
{% endfor %}
|
||
|
|
{% endif %}
|
||
|
|
{% endif %}
|
||
|
|
securityContext:
|
||
|
|
fsGroup: 101
|
||
|
|
initContainers:
|
||
|
|
- name: wait-for-db
|
||
|
|
image: postgres:18-bookworm
|
||
|
|
command: ["/bin/bash", "-c"]
|
||
|
|
args:
|
||
|
|
- |
|
||
|
|
for i in $(seq 1 30); do
|
||
|
|
pg_isready -h {{ taskserv.db_host }} -p {{ taskserv.db_port }} -U {{ taskserv.db_user }} && exit 0
|
||
|
|
echo "waiting for postgresql (attempt $i/30)..."
|
||
|
|
sleep 2
|
||
|
|
done
|
||
|
|
echo "ERROR: postgresql not ready after 30 attempts" >&2
|
||
|
|
exit 1
|
||
|
|
|
||
|
|
- name: clone-oca-addons
|
||
|
|
image: alpine/git:latest
|
||
|
|
command: ["/bin/sh", "-c"]
|
||
|
|
args:
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
CLONEDIR=$(mktemp -d)
|
||
|
|
: > /mnt/extra-addons/.oca-lock
|
||
|
|
{% for a in odoo_oca_addons_resolved %}
|
||
|
|
echo "Fetching OCA/{{ a.repo }} @ {{ a.ref }}"
|
||
|
|
# fetch by ref works for branch, tag, or commit SHA (GitHub allows
|
||
|
|
# reachable-SHA fetch), so a pinned commit and a rolling branch
|
||
|
|
# share one code path.
|
||
|
|
if git init -q "$CLONEDIR/{{ a.repo }}" \
|
||
|
|
&& git -C "$CLONEDIR/{{ a.repo }}" remote add origin https://github.com/OCA/{{ a.repo }}.git \
|
||
|
|
&& git -C "$CLONEDIR/{{ a.repo }}" fetch -q --depth 1 origin "{{ a.ref }}" \
|
||
|
|
&& git -C "$CLONEDIR/{{ a.repo }}" checkout -q --detach FETCH_HEAD; then
|
||
|
|
sha=$(git -C "$CLONEDIR/{{ a.repo }}" rev-parse HEAD)
|
||
|
|
echo "{{ a.repo }} {{ a.ref }} $sha" >> /mnt/extra-addons/.oca-lock
|
||
|
|
find "$CLONEDIR/{{ a.repo }}" -maxdepth 1 -mindepth 1 -type d \
|
||
|
|
-exec sh -c '[ -f "$1/__manifest__.py" ] && mv "$1" /mnt/extra-addons/ || true' _ {} \;
|
||
|
|
rm -rf "$CLONEDIR/{{ a.repo }}"
|
||
|
|
else
|
||
|
|
echo "WARN: OCA/{{ a.repo }} fetch failed (ref {{ a.ref }}) — skipping"
|
||
|
|
fi
|
||
|
|
{% endfor %}
|
||
|
|
# fingerprint over the resolved SHAs; changes only when code changes
|
||
|
|
sort /mnt/extra-addons/.oca-lock | sha256sum | cut -d' ' -f1 \
|
||
|
|
> /mnt/extra-addons/.oca-fingerprint
|
||
|
|
echo "OCA fingerprint: $(cat /mnt/extra-addons/.oca-fingerprint)"
|
||
|
|
chmod -R 755 /mnt/extra-addons 2>/dev/null || true
|
||
|
|
volumeMounts:
|
||
|
|
- name: extra-addons
|
||
|
|
mountPath: /mnt/extra-addons
|
||
|
|
|
||
|
|
- name: install-python-deps
|
||
|
|
image: {{ taskserv.image }}
|
||
|
|
command: ["/bin/bash", "-c"]
|
||
|
|
args:
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
TARGET=/mnt/extra-addons/python-packages
|
||
|
|
mkdir -p $TARGET
|
||
|
|
|
||
|
|
pkgs=$(python3 - <<'PYEOF'
|
||
|
|
import os, ast
|
||
|
|
seen = set()
|
||
|
|
for entry in os.scandir("/mnt/extra-addons"):
|
||
|
|
if not entry.is_dir():
|
||
|
|
continue
|
||
|
|
manifest = os.path.join(entry.path, "__manifest__.py")
|
||
|
|
if not os.path.isfile(manifest):
|
||
|
|
continue
|
||
|
|
try:
|
||
|
|
with open(manifest) as f:
|
||
|
|
data = ast.literal_eval(f.read())
|
||
|
|
for pkg in data.get("external_dependencies", {}).get("python", []):
|
||
|
|
seen.add(pkg)
|
||
|
|
except Exception:
|
||
|
|
pass
|
||
|
|
print(" ".join(sorted(seen)))
|
||
|
|
PYEOF
|
||
|
|
)
|
||
|
|
|
||
|
|
reqs=$(find /mnt/extra-addons -name "requirements.txt" -exec cat {} \; \
|
||
|
|
| grep -v '^\s*#' | sort -u | tr '\n' ' ')
|
||
|
|
|
||
|
|
# `packaging` is needed by Odoo to parse external-dependency
|
||
|
|
# version specifiers (e.g. schwifty==2024.4.0) during `-u`; the base
|
||
|
|
# image only vendors it inside pip, not as an importable top-level.
|
||
|
|
all="$pkgs $reqs packaging{% if odoo_python_packages %} {{ odoo_python_packages }}{% endif %}"
|
||
|
|
all=$(echo "$all" | tr -s ' ' | sed 's/^ //;s/ $//')
|
||
|
|
# Pin the system crypto stack to the image's versions. The main
|
||
|
|
# container puts $TARGET on PYTHONPATH, so an addon-pulled newer
|
||
|
|
# cryptography (via xmlsig) would shadow and ABI-break the system
|
||
|
|
# pyOpenSSL ("module 'lib' has no attribute 'GEN_EMAIL'"). Pinning
|
||
|
|
# to the installed versions keeps the shadow copy ABI-compatible.
|
||
|
|
CONSTRAINTS=$(mktemp)
|
||
|
|
python3 - > "$CONSTRAINTS" <<'PYEOF'
|
||
|
|
import importlib.metadata as m
|
||
|
|
for pkg in ("cryptography", "cffi", "pyOpenSSL"):
|
||
|
|
try:
|
||
|
|
print(f"{pkg}=={m.version(pkg)}")
|
||
|
|
except Exception:
|
||
|
|
pass
|
||
|
|
PYEOF
|
||
|
|
echo "[deps] system crypto constraints:"; cat "$CONSTRAINTS"
|
||
|
|
if [ -n "$all" ]; then
|
||
|
|
pip install --target $TARGET -c "$CONSTRAINTS" $all 2>/dev/null || true
|
||
|
|
fi
|
||
|
|
chmod -R 755 $TARGET
|
||
|
|
securityContext:
|
||
|
|
runAsUser: 0
|
||
|
|
volumeMounts:
|
||
|
|
- name: extra-addons
|
||
|
|
mountPath: /mnt/extra-addons
|
||
|
|
|
||
|
|
- name: init-odoo-db
|
||
|
|
image: {{ taskserv.image }}
|
||
|
|
command: ["/bin/bash", "-c"]
|
||
|
|
args:
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
initialized=$(PGPASSWORD="$ODOO_DB_PASSWORD" python3 -c "
|
||
|
|
import psycopg2, os, sys
|
||
|
|
try:
|
||
|
|
conn = psycopg2.connect(
|
||
|
|
host='{{ taskserv.db_host }}', port={{ taskserv.db_port }},
|
||
|
|
user='{{ taskserv.db_user }}', password=os.environ['ODOO_DB_PASSWORD'],
|
||
|
|
dbname='{{ taskserv.db_name }}'
|
||
|
|
)
|
||
|
|
cur = conn.cursor()
|
||
|
|
cur.execute(\"SELECT 1 FROM pg_tables WHERE tablename='ir_module_module'\")
|
||
|
|
print('yes' if cur.fetchone() else 'no')
|
||
|
|
except Exception as e:
|
||
|
|
print('no', file=sys.stderr)
|
||
|
|
sys.exit(1)
|
||
|
|
" 2>/dev/null)
|
||
|
|
if [ "$initialized" = "yes" ]; then
|
||
|
|
echo "[init-odoo-db] schema present — skipping initialization"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
echo "[init-odoo-db] empty database — initializing Odoo base (this takes a few minutes)..."
|
||
|
|
export PGPASSWORD="$ODOO_DB_PASSWORD"
|
||
|
|
exec odoo \
|
||
|
|
-d "{{ taskserv.db_name }}" \
|
||
|
|
--db_host="{{ taskserv.db_host }}" \
|
||
|
|
--db_port="{{ taskserv.db_port }}" \
|
||
|
|
--db_user="{{ taskserv.db_user }}" \
|
||
|
|
--db_password="$ODOO_DB_PASSWORD" \
|
||
|
|
--addons-path="/usr/lib/python3/dist-packages/odoo/addons,/mnt/extra-addons" \
|
||
|
|
--init base \
|
||
|
|
--stop-after-init \
|
||
|
|
--without-demo=all \
|
||
|
|
--log-level=info
|
||
|
|
envFrom:
|
||
|
|
- secretRef:
|
||
|
|
name: {{ taskserv.name }}-credentials
|
||
|
|
volumeMounts:
|
||
|
|
- name: extra-addons
|
||
|
|
mountPath: /mnt/extra-addons
|
||
|
|
|
||
|
|
# Reconcile DB schema with the cloned addon code. Odoo only emits
|
||
|
|
# ALTER TABLE during an explicit module upgrade (-u), never on a plain
|
||
|
|
# load, so when OCA code advances the schema drifts (missing columns →
|
||
|
|
# UndefinedColumn at runtime). This runs -u on installed extra-addons
|
||
|
|
# modules exactly when the resolved-SHA fingerprint differs from the one
|
||
|
|
# stamped in ir_config_parameter, then re-stamps. No drift → no upgrade.
|
||
|
|
- name: sync-odoo-schema
|
||
|
|
image: {{ taskserv.image }}
|
||
|
|
command: ["/bin/bash", "-c"]
|
||
|
|
args:
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
FP_FILE=/mnt/extra-addons/.oca-fingerprint
|
||
|
|
if [ ! -f "$FP_FILE" ]; then
|
||
|
|
echo "[sync] no fingerprint file — skip"; exit 0
|
||
|
|
fi
|
||
|
|
FP=$(cat "$FP_FILE")
|
||
|
|
export PGPASSWORD="$ODOO_DB_PASSWORD"
|
||
|
|
action=$(python3 - "$FP" <<'PYEOF'
|
||
|
|
import sys, os, psycopg2
|
||
|
|
fp = sys.argv[1]
|
||
|
|
try:
|
||
|
|
conn = psycopg2.connect(
|
||
|
|
host="{{ taskserv.db_host }}", port={{ taskserv.db_port }},
|
||
|
|
user="{{ taskserv.db_user }}",
|
||
|
|
password=os.environ["ODOO_DB_PASSWORD"],
|
||
|
|
dbname="{{ taskserv.db_name }}")
|
||
|
|
except Exception:
|
||
|
|
print("SKIP"); sys.exit(0)
|
||
|
|
cur = conn.cursor()
|
||
|
|
cur.execute("SELECT 1 FROM pg_tables WHERE tablename='ir_config_parameter'")
|
||
|
|
if not cur.fetchone():
|
||
|
|
print("SKIP"); sys.exit(0) # DB not yet initialized
|
||
|
|
cur.execute("SELECT value FROM ir_config_parameter WHERE key='oca_addons.fingerprint'")
|
||
|
|
row = cur.fetchone()
|
||
|
|
if row and row[0] == fp:
|
||
|
|
print("SKIP"); sys.exit(0) # nothing changed
|
||
|
|
disk = {e.name for e in os.scandir("/mnt/extra-addons")
|
||
|
|
if e.is_dir() and os.path.isfile(os.path.join(e.path, "__manifest__.py"))}
|
||
|
|
cur.execute("SELECT name FROM ir_module_module WHERE state='installed'")
|
||
|
|
installed = {r[0] for r in cur.fetchall()}
|
||
|
|
mods = sorted(disk & installed)
|
||
|
|
print(("UPGRADE " + ",".join(mods)) if mods else "STAMP")
|
||
|
|
PYEOF
|
||
|
|
)
|
||
|
|
case "$action" in
|
||
|
|
SKIP*)
|
||
|
|
echo "[sync] fingerprint unchanged or DB not ready — skip"; exit 0 ;;
|
||
|
|
STAMP*)
|
||
|
|
echo "[sync] no managed modules installed yet — stamping fingerprint" ;;
|
||
|
|
UPGRADE*)
|
||
|
|
mods=$(echo "$action" | cut -d' ' -f2)
|
||
|
|
echo "[sync] OCA addons changed — upgrading installed modules: $mods"
|
||
|
|
# Non-fatal: a failed reconcile must not block the whole
|
||
|
|
# instance from starting. Leave the fingerprint unstamped so
|
||
|
|
# the upgrade is retried on the next start; the server comes
|
||
|
|
# up on the existing schema (drift surfaces as a runtime error
|
||
|
|
# to fix, not a total outage).
|
||
|
|
if ! odoo -d "{{ taskserv.db_name }}" \
|
||
|
|
--db_host="{{ taskserv.db_host }}" \
|
||
|
|
--db_port="{{ taskserv.db_port }}" \
|
||
|
|
--db_user="{{ taskserv.db_user }}" \
|
||
|
|
--db_password="$ODOO_DB_PASSWORD" \
|
||
|
|
--addons-path="/usr/lib/python3/dist-packages/odoo/addons,/mnt/extra-addons" \
|
||
|
|
-u "$mods" --stop-after-init --no-http \
|
||
|
|
--max-cron-threads=0 --log-level=info; then
|
||
|
|
echo "[sync] WARNING: module upgrade failed — starting without re-stamping; will retry next start" >&2
|
||
|
|
exit 0
|
||
|
|
fi ;;
|
||
|
|
esac
|
||
|
|
python3 - "$FP" <<'PYEOF'
|
||
|
|
import sys, os, psycopg2
|
||
|
|
fp = sys.argv[1]
|
||
|
|
conn = psycopg2.connect(
|
||
|
|
host="{{ taskserv.db_host }}", port={{ taskserv.db_port }},
|
||
|
|
user="{{ taskserv.db_user }}",
|
||
|
|
password=os.environ["ODOO_DB_PASSWORD"],
|
||
|
|
dbname="{{ taskserv.db_name }}")
|
||
|
|
conn.autocommit = True
|
||
|
|
cur = conn.cursor()
|
||
|
|
cur.execute("UPDATE ir_config_parameter SET value=%s, write_date=now() "
|
||
|
|
"WHERE key='oca_addons.fingerprint'", (fp,))
|
||
|
|
if cur.rowcount == 0:
|
||
|
|
cur.execute("INSERT INTO ir_config_parameter (key, value, create_date, write_date) "
|
||
|
|
"VALUES ('oca_addons.fingerprint', %s, now(), now())", (fp,))
|
||
|
|
PYEOF
|
||
|
|
echo "[sync] fingerprint stamped: $FP"
|
||
|
|
env:
|
||
|
|
# match the main container so `-u` can import addon external deps
|
||
|
|
# (e.g. schwifty/packaging) that install-python-deps placed here.
|
||
|
|
- name: PYTHONPATH
|
||
|
|
value: "/mnt/extra-addons/python-packages"
|
||
|
|
envFrom:
|
||
|
|
- secretRef:
|
||
|
|
name: {{ taskserv.name }}-credentials
|
||
|
|
volumeMounts:
|
||
|
|
- name: extra-addons
|
||
|
|
mountPath: /mnt/extra-addons
|
||
|
|
|
||
|
|
containers:
|
||
|
|
- name: odoo
|
||
|
|
image: {{ taskserv.image }}
|
||
|
|
args:
|
||
|
|
- "--db_host={{ taskserv.db_host }}"
|
||
|
|
- "--db_port={{ taskserv.db_port }}"
|
||
|
|
- "--db_user={{ taskserv.db_user }}"
|
||
|
|
- "--db-filter={{ odoo_db_filter }}"
|
||
|
|
- "--no-database-list"
|
||
|
|
- "--addons-path=/usr/lib/python3/dist-packages/odoo/addons,/mnt/extra-addons"
|
||
|
|
- "--proxy-mode"
|
||
|
|
- "--workers={{ taskserv.workers }}"
|
||
|
|
- "--max-cron-threads={{ taskserv.max_cron_threads }}"
|
||
|
|
- "--limit-memory-hard=536870912"
|
||
|
|
- "--limit-memory-soft=469762048"
|
||
|
|
- "--limit-time-cpu=60"
|
||
|
|
- "--limit-time-real=120"
|
||
|
|
- "--log-level=info"
|
||
|
|
ports:
|
||
|
|
- containerPort: 8069
|
||
|
|
name: http
|
||
|
|
protocol: TCP
|
||
|
|
env:
|
||
|
|
- name: DB_NAME
|
||
|
|
value: "{{ taskserv.db_name }}"
|
||
|
|
- name: HOST
|
||
|
|
value: "{{ taskserv.db_host }}"
|
||
|
|
- name: PORT
|
||
|
|
value: "{{ taskserv.db_port }}"
|
||
|
|
- name: USER
|
||
|
|
value: "{{ taskserv.db_user }}"
|
||
|
|
- name: PYTHONPATH
|
||
|
|
value: "/mnt/extra-addons/python-packages"
|
||
|
|
envFrom:
|
||
|
|
- secretRef:
|
||
|
|
name: {{ taskserv.name }}-credentials
|
||
|
|
volumeMounts:
|
||
|
|
- name: filestore
|
||
|
|
mountPath: /var/lib/odoo
|
||
|
|
- name: extra-addons
|
||
|
|
mountPath: /mnt/extra-addons
|
||
|
|
{% if taskserv.probes is defined and taskserv.probes.readiness is defined %}
|
||
|
|
readinessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: {{ taskserv.probes.readiness.path }}
|
||
|
|
port: {{ taskserv.probes.readiness.port | default(value=8069) }}
|
||
|
|
initialDelaySeconds: {{ taskserv.probes.readiness.initial_delay }}
|
||
|
|
periodSeconds: {{ taskserv.probes.readiness.period }}
|
||
|
|
failureThreshold: {{ taskserv.probes.readiness.failure_threshold }}
|
||
|
|
{% else %}
|
||
|
|
readinessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: /web/login
|
||
|
|
port: 8069
|
||
|
|
initialDelaySeconds: 30
|
||
|
|
periodSeconds: 10
|
||
|
|
failureThreshold: 12
|
||
|
|
{% endif %}
|
||
|
|
{% if taskserv.probes is defined and taskserv.probes.liveness is defined %}
|
||
|
|
livenessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: {{ taskserv.probes.liveness.path }}
|
||
|
|
port: {{ taskserv.probes.liveness.port | default(value=8069) }}
|
||
|
|
initialDelaySeconds: {{ taskserv.probes.liveness.initial_delay }}
|
||
|
|
periodSeconds: {{ taskserv.probes.liveness.period }}
|
||
|
|
failureThreshold: {{ taskserv.probes.liveness.failure_threshold }}
|
||
|
|
{% else %}
|
||
|
|
livenessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: /web/health
|
||
|
|
port: 8069
|
||
|
|
initialDelaySeconds: 60
|
||
|
|
periodSeconds: 30
|
||
|
|
failureThreshold: 3
|
||
|
|
{% endif %}
|
||
|
|
{% if taskserv.resources_effective is defined %}
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: "{{ taskserv.resources_effective.cpu.request }}"
|
||
|
|
memory: "{{ taskserv.resources_effective.memory.request }}"
|
||
|
|
limits:
|
||
|
|
cpu: "{{ taskserv.resources_effective.cpu.limit }}"
|
||
|
|
memory: "{{ taskserv.resources_effective.memory.limit }}"
|
||
|
|
{% else %}
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: "100m"
|
||
|
|
memory: "350Mi"
|
||
|
|
limits:
|
||
|
|
cpu: "1000m"
|
||
|
|
memory: "1Gi"
|
||
|
|
{% endif %}
|
||
|
|
|
||
|
|
volumes:
|
||
|
|
- name: filestore
|
||
|
|
persistentVolumeClaim:
|
||
|
|
claimName: {{ taskserv.filestore_pvc }}
|
||
|
|
- name: extra-addons
|
||
|
|
emptyDir: {}
|