package-init-job.yaml

{{/*
Package Init Job
Populates the packages PVC (Python, Node, Bun, Bash runtimes for the NsJail
sandbox) once. Ordered before the sandbox-runner by Argo CD sync-wave -5.
Managed resource, NOT a Sync hook: an unchanged sync is an apply no-op that
does NOT re-run the Job or wake the (scale-to-zero) sandbox node pool. No TTL,
so the completed Job persists and stays a no-op across syncs. Its spec is
immutable: to re-run it (forceRebuild or a runtime-version bump), delete the Job
first, then sync (see values.yaml initJob.forceRebuild).
*/}}
{{- if and .Values.workerSandbox.enabled .Values.workerSandbox.packages.initJob.enabled }}
{{- $packageInitNodeSelector := .Values.workerSandbox.sandboxRunner.nodeSelector }}
{{- $packageInitTolerations := .Values.workerSandbox.sandboxRunner.tolerations }}
{{- if .Values.workerSandbox.sandboxRunner.inheritSharedScheduling }}
{{- $packageInitNodeSelector = default .Values.nodeSelector $packageInitNodeSelector }}
{{- $packageInitTolerations = default .Values.tolerations $packageInitTolerations }}
{{- end }}
apiVersion: batch/v1
kind: Job
metadata:
  {{- with .Values.workerSandbox.sandboxRunner.namespaceOverride }}
  namespace: {{ . }}
  {{- end }}
  name: {{ include "codeapi.fullname" . }}-package-init
  labels:
    {{- include "codeapi.labels" . | nindent 4 }}
    app.kubernetes.io/component: package-init
  annotations:
    "argocd.argoproj.io/sync-wave": "-5"
spec:
  backoffLimit: {{ .Values.workerSandbox.packages.initJob.backoffLimit }}
  template:
    metadata:
      labels:
        {{- include "codeapi.labels" . | nindent 8 }}
        app.kubernetes.io/component: package-init
    spec:
      {{- with .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      restartPolicy: Never
      containers:
        - name: package-init
          image: "{{ .Values.workerSandbox.packages.initJob.image.repository }}:{{ .Values.workerSandbox.packages.initJob.image.tag }}"
          imagePullPolicy: {{ .Values.workerSandbox.packages.initJob.image.pullPolicy }}
          env:
            - name: PYTHON_VERSION
              value: {{ .Values.workerSandbox.packages.initJob.pythonVersion | quote }}
            - name: NODE_VERSION
              value: {{ .Values.workerSandbox.packages.initJob.nodeVersion | quote }}
            - name: BUN_VERSION
              value: {{ .Values.workerSandbox.packages.initJob.bunVersion | quote }}
            - name: BASH_PACKAGE_VERSION
              value: {{ .Values.workerSandbox.packages.initJob.bashPackageVersion | quote }}
            - name: FORCE_REBUILD
              value: {{ .Values.workerSandbox.packages.initJob.forceRebuild | quote }}
          volumeMounts:
            - name: packages
              mountPath: /pkgs
          resources:
            {{- toYaml .Values.workerSandbox.packages.initJob.resources | nindent 12 }}
      volumes:
        - name: packages
          {{- if .Values.workerSandbox.packages.persistence.existingClaim }}
          persistentVolumeClaim:
            claimName: {{ .Values.workerSandbox.packages.persistence.existingClaim }}
          {{- else if .Values.workerSandbox.packages.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ include "codeapi.fullname" . }}-packages
          {{- else }}
          emptyDir: {}
          {{- end }}
      {{- with $packageInitNodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $packageInitTolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{- end }}