git-sync-relay-deployment.yaml

###############################
## git-sync-relay Deployment ##
###############################
{{- if .Values.gitSyncRelay.enabled }}
{{- $nodeSelector := or .Values.gitSyncRelay.nodeSelector .Values.airflow.nodeSelector }}
{{- $affinity := or .Values.gitSyncRelay.affinity .Values.airflow.affinity }}
{{- $tolerations := or .Values.gitSyncRelay.tolerations .Values.airflow.tolerations }}
{{- /* Resolve the git-sync auth method. repo.auth.type is the selector; an SSH key
       with no explicit type stays SSH for back-compat. Wiring degrades gracefully
       the same way the SSH path does: the HTTPS credentials Secret is mounted only
       when credentialsSecretName is present, and a missing/unused Secret renders
       nothing rather than failing (the relay starts and retries). The only hard
       failures are an unknown auth.type and the SSH+HTTPS contradiction. */}}
{{- $authType := "" }}
{{- $httpsSecret := "" }}
{{- with .Values.gitSyncRelay.repo.auth }}
{{- $authType = .type | default "" }}
{{- with .https }}{{- $httpsSecret = .credentialsSecretName | default "" }}{{- end }}
{{- end }}
{{- if not (has $authType (list "" "ssh" "https-pat" "https-none")) }}
{{- fail (printf "gitSyncRelay.repo.auth.type: %q is invalid; must be one of ssh, https-pat, https-none." $authType) }}
{{- end }}
{{- if and .Values.gitSyncRelay.repo.sshPrivateKeySecretName (or (eq $authType "https-pat") (eq $authType "https-none") (ne $httpsSecret "")) }}
{{- fail "gitSyncRelay.repo: SSH and HTTPS auth are mutually exclusive. repo.sshPrivateKeySecretName cannot be combined with HTTPS auth (repo.auth.type of https-pat/https-none, or repo.auth.https.credentialsSecretName)." }}
{{- end }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-git-sync-relay
  labels:
    component: git-sync-relay
    tier: airflow
    release: {{ .Release.Name }}
    chart: "{{ .Release.Name }}-{{ .Chart.Version }}"
    heritage: {{ .Release.Service }}
  {{- if .Values.gitSyncRelay.annotations }}
  annotations: {{- toYaml .Values.gitSyncRelay.annotations | nindent 4 }}
  {{- end }}
spec:
  replicas: 1
  selector:
    matchLabels:
      component: git-sync-relay
      tier: airflow
  template:
    metadata:
      labels:
        component: git-sync-relay
        tier: airflow
        release: {{ .Release.Name }}
        chart: "{{ .Release.Name }}-{{ .Chart.Version }}"
        heritage: {{ .Release.Service }}
        {{- if .Values.labels }}
        {{- toYaml .Values.labels | nindent 8 }}
        {{- end }}
      {{- if .Values.gitSyncRelay.podAnnotations }}
      annotations: {{- toYaml .Values.gitSyncRelay.podAnnotations | nindent 8 }}
      {{- end }}
    spec:
      {{- if or .Values.airflow.registry.secretName .Values.airflow.registry.connection }}
      imagePullSecrets:
        - name: {{ template "astro.registry_secret" . }}
      {{- end }}
      nodeSelector: {{- toYaml $nodeSelector | nindent 8 }}
      affinity: {{- toYaml $affinity | nindent 8 }}
      tolerations: {{- toYaml $tolerations | nindent 8 }}
      terminationGracePeriodSeconds: {{ .Values.gitSyncRelay.terminationGracePeriodSeconds }}
      serviceAccountName: {{ template "astro.gitSyncRelay.serviceAccountName" . }}
      securityContext: {{- include "gitSyncRelay.podSecurityContext" . | nindent 8 }}
      volumes:
        - name: git-sync-home
          emptyDir: {}
        - name: git-repo-contents
        {{- if eq .Values.gitSyncRelay.repoShareMode "shared_volume" }}
          persistentVolumeClaim:
            claimName: git-repo-contents
        {{- else }}
          emptyDir: {}
        {{- end }}
        {{- if .Values.gitSyncRelay.repo.sshPrivateKeySecretName }}
        - name: git-secret
          secret:
            secretName: {{ .Values.gitSyncRelay.repo.sshPrivateKeySecretName }}
        {{- end }}
        {{- if and (eq $authType "https-pat") (ne $httpsSecret "") }}
        - name: git-https-secret
          secret:
            secretName: {{ $httpsSecret }}
        {{- end }}
        - name: {{ .Release.Name }}-git-sync-config
          configMap:
            name: {{ .Release.Name }}-git-sync-config
        {{- if .Values.loggingSidecar.enabled }}
        - name: config-volume
          configMap:
            name: {{ .Release.Name }}-sidecar-config
        - emptyDir: {}
          name: sidecar-logging-consumer
        {{- end }}
        {{- if and .Values.authSidecar.enabled (eq .Values.gitSyncRelay.repoFetchMode "webhook") }}
        - name: nginx-access-logs
          emptyDir: {}
        - name: nginx-sidecar-conf
          configMap:
            name: {{ .Release.Name }}-git-sync-relay-nginx-conf
        - emptyDir: {}
          name: nginx-cache
        - emptyDir: {}
          name: nginx-tmp
        {{- end }}
        - emptyDir: {}
          name: tmp
        {{- include "gitSyncRelay.customCaVolumes" . | nindent 8 }}
      initContainers:
        {{- include "gitSyncRelay.customCaInitContainer" . | nindent 8 }}
        - name: git-config-manager
          command: ["git", "config", "--global", "--add", "safe.directory", "/git"]
          image: "{{ .Values.gitSyncRelay.images.gitSync.repository }}:{{ .Values.gitSyncRelay.images.gitSync.tag }}"
          securityContext: {{- toYaml .Values.gitSyncRelay.gitSync.securityContext | nindent 12 }}
          volumeMounts:
            - name: git-sync-home
              mountPath: /home/git-sync
          resources: {{- toYaml .Values.gitSyncRelay.gitSync.resources | nindent 12 }}
      containers:
        - name: git-sync
          image: "{{ .Values.gitSyncRelay.images.gitSync.repository }}:{{ .Values.gitSyncRelay.images.gitSync.tag }}"
          {{- if .Values.loggingSidecar.enabled }}
          command: ["bash"]
          args:
            - -c
            - /entrypoint.sh 1> >( tee -a /var/log/sidecar-logging-consumer/out.log ) 2> >( tee -a /var/log/sidecar-logging-consumer/err.log >&2 )
          {{- end }}
          securityContext: {{- toYaml .Values.gitSyncRelay.gitSync.securityContext | nindent 12 }}
          volumeMounts:
            - name: git-sync-home
              mountPath: /home/git-sync
            {{- if .Values.gitSyncRelay.repo.sshPrivateKeySecretName }}
            - name: git-secret
              mountPath: /etc/git-secret/ssh
              readOnly: true
              subPath: gitSshKey
            {{- if .Values.gitSyncRelay.repo.knownHosts }}
            - name: {{ .Release.Name }}-git-sync-config
              mountPath: /etc/git-secret/known_hosts
              readOnly: true
              subPath: known_hosts
            {{- end }}
            {{- end }}
            {{- if and (eq $authType "https-pat") (ne $httpsSecret "") }}
            {{- /* Mount as a directory (no subPath) so kubelet propagates rotated
                   credentials without a pod restart (FR2.2). */}}
            - name: git-https-secret
              mountPath: /etc/git-secret/https
              readOnly: true
            {{- end }}
            - name: git-repo-contents
              mountPath: /git
            {{- if .Values.loggingSidecar.enabled }}
            - mountPath: /var/log/sidecar-logging-consumer
              name: sidecar-logging-consumer
            {{- end }}
            - name: tmp
              mountPath: /tmp
            {{- include "gitSyncRelay.customCaVolumeMounts" . | nindent 12 }}
          env:
            {{- include "gitSyncRelay.customCaEnv" . | nindent 12 }}
            - name: GIT_SYNC_ROOT
              value: "/git"
            - name: GIT_SYNC_REPO
              value: "{{ .Values.gitSyncRelay.repo.url }}"
            - name: GIT_SYNC_BRANCH
              value: "{{ .Values.gitSyncRelay.repo.branch }}"
            - name: GIT_SYNC_DEPTH
              value: "{{ .Values.gitSyncRelay.repo.depth }}"
            - name: GIT_SYNC_WAIT
              value: "{{ .Values.gitSyncRelay.repo.wait }}"
            {{- if .Values.gitSyncRelay.repoFetchMode }}
            - name: GIT_SYNC_REPO_FETCH_MODE
              value: "{{ .Values.gitSyncRelay.repoFetchMode }}"
            {{- end }}
            {{- if .Values.gitSyncRelay.webhookSecretKey }}
            - name: GIT_SYNC_WEBHOOK_SECRET
              value: "{{ .Values.gitSyncRelay.webhookSecretKey }}"
            {{- end }}
            {{- if .Values.gitSyncRelay.repo.sshPrivateKeySecretName }}
            - name: GIT_SYNC_SSH
              value: "true"
            - name: GIT_SSH_KEY_FILE
              value: "/etc/git-secret/ssh"
            {{- if .Values.gitSyncRelay.repo.knownHosts }}
            - name: GIT_KNOWN_HOSTS
              value: "true"
            - name: GIT_SSH_KNOWN_HOSTS_FILE
              value: "/etc/git-secret/known_hosts"
            {{- else }}
            - name: GIT_KNOWN_HOSTS
              value: "false"
            {{- end }}
            {{- end }}
            {{- if or (eq $authType "https-pat") (eq $authType "https-none") }}
            - name: GIT_SYNC_AUTH_TYPE
              value: "{{ $authType }}"
            {{- end }}
            {{- if and (eq $authType "https-pat") (ne $httpsSecret "") }}
            - name: GIT_SYNC_HTTPS_SECRET_DIR
              value: "/etc/git-secret/https"
            {{- end }}
            {{- if .Values.gitSyncRelay.metrics.enabled}}
            - name: METRICS_ENABLED
              value: "{{ .Values.gitSyncRelay.metrics.enabled }}"
            - name: STATSD_HOST
              value: {{ .Release.Name }}-statsd
            - name: STATSD_PORT
              value: "{{ include "astro.statsd.port" . }}"
            - name: DEBUG
              value: "{{ .Values.gitSyncRelay.debug }}"
            {{- end }}
          {{- if .Values.gitSyncRelay.gitSync.livenessProbe }}
          livenessProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitSync.livenessProbe) . | nindent 12 }}
          {{- end }}
          {{- if .Values.gitSyncRelay.gitSync.readinessProbe }}
          readinessProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitSync.readinessProbe) . | nindent 12 }}
          {{- else }}
          # /readyz reflects the most recent sync, so a bad Gitsync URL edit marks this pod
          # NotReady instead of staying "ready" forever (PINF-816). Not a livenessProbe -- a
          # restart can't fix a bad URL. failureThreshold: 1 (not the k8s default of 3): the
          # sync itself already retries internally before /readyz ever flips, so no extra
          # smoothing is needed here.
          readinessProbe:
            httpGet:
              path: /readyz
              port: {{ .Values.gitSyncRelay.gitSync.webhookPort }}
            initialDelaySeconds: 5
            periodSeconds: 15
            failureThreshold: 1
          {{- end }}
          {{- if .Values.gitSyncRelay.gitSync.startupProbe }}
          startupProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitSync.startupProbe) . | nindent 12 }}
          {{- end }}
          resources: {{- toYaml .Values.gitSyncRelay.gitSync.resources | nindent 12 }}
        {{- if eq .Values.gitSyncRelay.repoShareMode "git_daemon" }}
        - name: git-daemon
          image: "{{ .Values.gitSyncRelay.images.gitDaemon.repository }}:{{ .Values.gitSyncRelay.images.gitDaemon.tag }}"
          securityContext: {{- toYaml .Values.gitSyncRelay.gitDaemon.securityContext | nindent 12 }}
          volumeMounts:
            - name: git-repo-contents
              mountPath: /git
              readOnly: False
          env:
            - name: GIT_ROOT
              value: /git
          {{- if .Values.gitSyncRelay.gitDaemon.livenessProbe }}
          livenessProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitDaemon.livenessProbe) . | nindent 12 }}
          {{- else }}
          livenessProbe:
            exec:
              command:
              - touch
              - /git/.git/git-daemon-export-ok
            initialDelaySeconds: 5
            periodSeconds: 15
          {{- end }}
          {{- if .Values.gitSyncRelay.gitDaemon.readinessProbe }}
          readinessProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitDaemon.readinessProbe) . | nindent 12 }}
          {{- end }}
          {{- if .Values.gitSyncRelay.gitDaemon.startupProbe }}
          startupProbe: {{- tpl (toYaml .Values.gitSyncRelay.gitDaemon.startupProbe) . | nindent 12 }}
          {{- else }}
          startupProbe:
            exec:
              command:
              - test
              - -f
              - /git/.git/git-daemon-export-ok
            initialDelaySeconds: 0
            periodSeconds: 15
            failureThreshold: 6
          {{- end }}
          resources: {{- toYaml .Values.gitSyncRelay.gitDaemon.resources | nindent 12 }}
        {{- end }}

      {{- if .Values.loggingSidecar.enabled }}
        {{- include "logging_sidecar_container_spec" . | nindent 8 }}
      {{- end }}
      {{- if and .Values.authSidecar.enabled (eq .Values.gitSyncRelay.repoFetchMode "webhook") }}
        {{- include "auth_sidecar_container_spec" . | nindent 8 }}
      {{- end }}
      {{- if .Values.gitSyncRelay.extraContainers }}
        {{- toYaml .Values.gitSyncRelay.extraContainers | nindent 8 }}
      {{- end }}
{{- end -}}