Introduce worker service (sourcegraph#3082)

Author: efritz

base/worker/worker.Deployment.yaml

@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    description: Manages background processes.
+  labels:
+    deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
+    app.kubernetes.io/component: worker
+  name: worker
+spec:
+  minReadySeconds: 10
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: worker
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        deploy: sourcegraph
+        app: worker
+    spec:
+      containers:
+      - name: worker
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        image: index.docker.io/sourcegraph/worker:insiders@sha256:c724fc8d29c30135d30e41a798b6a7688b5eda0a3b9a7b74753faf7028c02b41
+        terminationMessagePolicy: FallbackToLogsOnError
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: debug
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: debug
+            scheme: HTTP
+          periodSeconds: 5
+          timeoutSeconds: 5
+        ports:
+        - containerPort: 3189
+          name: http
+        - containerPort: 6060
+          name: debug
+        resources:
+          limits:
+            cpu: "2"
+            memory: 4G
+          requests:
+            cpu: 500m
+            memory: 2G
+      securityContext:
+        runAsUser: 0

base/worker/worker.Service.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    prometheus.io/port: "6060"
+    sourcegraph.prometheus/scrape: "true"
+  labels:
+    app: worker
+    deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
+    app.kubernetes.io/component: worker
+  name: worker
+spec:
+  ports:
+  - name: http
+    port: 3189
+    targetPort: http
+  - name: debug
+    port: 6060
+    targetPort: debug
+  selector:
+    app: worker
+  type: ClusterIP

overlays/bases/deployments/kustomization.yaml

@@ -41,6 +41,8 @@ resources:
 - base/github-proxy/github-proxy.Deployment.yaml
 - base/repo-updater/repo-updater.Service.yaml
 - base/repo-updater/repo-updater.Deployment.yaml
+- base/worker/worker.Deployment.yaml
+- base/worker/worker.Service.yaml
 - base/gitserver/gitserver.Service.yaml
 - base/gitserver/gitserver.StatefulSet.yaml
 - base/precise-code-intel/worker.Deployment.yaml

overlays/minikube/kustomization.yaml

@@ -45,6 +45,12 @@ patchesJson6902:
       group: apps
       version: v1
     path: delete-resources.yaml
+  - target:
+      kind: Deployment
+      name: worker
+      group: apps
+      version: v1
+    path: delete-resources.yaml
   - target:
       kind: Deployment
       name: pgsql

overlays/non-root/kustomization.yaml

@@ -19,6 +19,7 @@ patchesStrategicMerge:
   - query-runner/query-runner.Deployment.yaml
   - redis/redis-cache.Deployment.yaml
   - redis/redis-store.Deployment.yaml
+  - worker/worker.Deployment.yaml
   - repo-updater/repo-updater.Deployment.yaml
   - searcher/searcher.Deployment.yaml
   - symbols/symbols.Deployment.yaml

overlays/non-root/worker/worker.Deployment.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: worker
+spec:
+  template:
+    spec:
+      containers:
+      - name: worker
+        securityContext:
+          # Required to prevent escalations to root.
+          allowPrivilegeEscalation: false
+          runAsUser: 100
+          runAsGroup: 101