extract job-task-runner to a standalone deployment

HACKING.md

@@ -96,6 +96,51 @@ A sample VSCode `launch.json` configuration is provided below:
             ],
             "host": "localhost",
             "port": 30052
+        },
+        {
+            "name": "Attach to Debug Job Task Runner on Kind",
+            "type": "go",
+            "debugAdapter": "dlv-dap",
+            "request": "attach",
+            "mode": "remote",
+            "substitutePath": [
+                {
+                    "from": "${workspaceFolder}",
+                    "to": "/workspace"
+                }
+            ],
+            "host": "localhost",
+            "port": 30053
+        },
+        {
+            "name": "Attach to Debug Kpack Image Builder on Kind",
+            "type": "go",
+            "debugAdapter": "dlv-dap",
+            "request": "attach",
+            "mode": "remote",
+            "substitutePath": [
+                {
+                    "from": "${workspaceFolder}",
+                    "to": "/workspace"
+                }
+            ],
+            "host": "localhost",
+            "port": 30054
+        },
+        {
+            "name": "Attach to Debug Statefulset Runner on Kind",
+            "type": "go",
+            "debugAdapter": "dlv-dap",
+            "request": "attach",
+            "mode": "remote",
+            "substitutePath": [
+                {
+                    "from": "${workspaceFolder}",
+                    "to": "/workspace"
+                }
+            ],
+            "host": "localhost",
+            "port": 30055
         }
     ]
 }

controllers/Dockerfile

@@ -13,7 +13,6 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 COPY model model
 COPY controllers controllers
 COPY kpack-image-builder kpack-image-builder
-COPY job-task-runner job-task-runner
 COPY statefulset-runner statefulset-runner
 COPY tools tools
 COPY version version

controllers/config/config.go

@@ -11,7 +11,6 @@ import (
 type ControllerConfig struct {
 	// components
 	IncludeKpackImageBuilder bool `yaml:"includeKpackImageBuilder"`
-	IncludeJobTaskRunner     bool `yaml:"includeJobTaskRunner"`
 	IncludeStatefulsetRunner bool `yaml:"includeStatefulsetRunner"`
 
 	// core controllers
@@ -29,9 +28,6 @@ type ControllerConfig struct {
 	LogLevel                         zapcore.Level      `yaml:"logLevel"`
 	SpaceFinalizerAppDeletionTimeout *int32             `yaml:"spaceFinalizerAppDeletionTimeout"`
 
-	// job-task-runner
-	JobTTL string `yaml:"jobTTL"`
-
 	// kpack-image-builder
 	ClusterBuilderName        string     `yaml:"clusterBuilderName"`
 	BuilderServiceAccount     string     `yaml:"builderServiceAccount"`
@@ -110,11 +106,3 @@ func (c ControllerConfig) ParseTaskTTL() (time.Duration, error) {
 func (c ControllerConfig) ParseBuilderReadinessTimeout() (time.Duration, error) {
 	return tools.ParseDuration(c.BuilderReadinessTimeout)
 }
-
-func (c ControllerConfig) ParseJobTTL() (time.Duration, error) {
-	if c.JobTTL == "" {
-		return defaultJobTTL, nil
-	}
-
-	return tools.ParseDuration(c.JobTTL)
-}

controllers/config/config_test.go

@@ -45,7 +45,6 @@ var _ = Describe("LoadFromPath", func() {
 			TaskTTL:                          "taskTTL",
 			BuilderName:                      "buildReconciler",
 			RunnerName:                       "statefulset-runner",
-			JobTTL:                           "jobTTL",
 			LogLevel:                         zapcore.DebugLevel,
 			SpaceFinalizerAppDeletionTimeout: tools.PtrTo(int32(42)),
 			Networking: config.Networking{
@@ -89,7 +88,6 @@ var _ = Describe("LoadFromPath", func() {
 			RunnerName:                       "statefulset-runner",
 			NamespaceLabels:                  map[string]string{},
 			ExtraVCAPApplicationValues:       map[string]any{},
-			JobTTL:                           "jobTTL",
 			LogLevel:                         zapcore.DebugLevel,
 			SpaceFinalizerAppDeletionTimeout: tools.PtrTo(int32(42)),
 			Networking: config.Networking{
@@ -187,48 +185,3 @@ var _ = Describe("ParseTaskTTL", func() {
 		})
 	})
 })
-
-var _ = Describe("ParseJobTTL", func() {
-	var (
-		jobTTL    time.Duration
-		parseErr  error
-		jobTTLStr string
-	)
-
-	BeforeEach(func() {
-		jobTTLStr = ""
-	})
-
-	JustBeforeEach(func() {
-		cfg := config.ControllerConfig{
-			JobTTL: jobTTLStr,
-		}
-		jobTTL, parseErr = cfg.ParseJobTTL()
-	})
-
-	It("return 30 days by default", func() {
-		Expect(parseErr).NotTo(HaveOccurred())
-		Expect(jobTTL).To(Equal(24 * time.Hour))
-	})
-
-	When("jobTTL is something parseable by tools.ParseDuration", func() {
-		BeforeEach(func() {
-			jobTTLStr = "5d12h"
-		})
-
-		It("parses ok", func() {
-			Expect(parseErr).NotTo(HaveOccurred())
-			Expect(jobTTL).To(Equal(5*24*time.Hour + 12*time.Hour))
-		})
-	})
-
-	When("entering something that cannot be parsed", func() {
-		BeforeEach(func() {
-			jobTTLStr = "foreva"
-		})
-
-		It("returns an error", func() {
-			Expect(parseErr).To(HaveOccurred())
-		})
-	})
-})

controllers/controllers/workloads/orgs/controller.go

@@ -118,6 +118,8 @@ func (r *Reconciler) enqueueCFOrgRequests(ctx context.Context, object client.Obj
 //+kubebuilder:rbac:groups="metrics.k8s.io",resources=pods,verbs=get;list;watch
 //+kubebuilder:rbac:groups="policy",resources=poddisruptionbudgets,verbs=create;deletecollection
 //+kubebuilder:rbac:groups="policy",resources=podsecuritypolicies,verbs=use
+//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=runnerinfos,verbs=get;list;watch;create;patch;delete
+//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=runnerinfos/status,verbs=get;patch
 
 func (r *Reconciler) ReconcileResource(ctx context.Context, cfOrg *korifiv1alpha1.CFOrg) (ctrl.Result, error) {
 	nsReconcileResult, err := r.namespaceReconciler.ReconcileResource(ctx, cfOrg)

controllers/main.go

@@ -60,7 +60,6 @@ import (
 	packageswebhook "code.cloudfoundry.org/korifi/controllers/webhooks/workloads/packages"
 	spaceswebhook "code.cloudfoundry.org/korifi/controllers/webhooks/workloads/spaces"
 	taskswebhook "code.cloudfoundry.org/korifi/controllers/webhooks/workloads/tasks"
-	jobtaskrunnercontrollers "code.cloudfoundry.org/korifi/job-task-runner/controllers"
 	"code.cloudfoundry.org/korifi/kpack-image-builder/controllers"
 	kpackimagebuilderfinalizer "code.cloudfoundry.org/korifi/kpack-image-builder/controllers/webhooks/finalizer"
 	statefulsetcontrollers "code.cloudfoundry.org/korifi/statefulset-runner/controllers"
@@ -380,26 +379,6 @@ func main() {
 			}
 		}
 
-		if controllerConfig.IncludeJobTaskRunner {
-			var jobTTL time.Duration
-			jobTTL, err = controllerConfig.ParseJobTTL()
-			if err != nil {
-				panic(err)
-			}
-
-			taskWorkloadReconciler := jobtaskrunnercontrollers.NewTaskWorkloadReconciler(
-				controllersLog,
-				mgr.GetClient(),
-				mgr.GetScheme(),
-				jobtaskrunnercontrollers.NewStatusGetter(mgr.GetClient()),
-				jobTTL,
-			)
-			if err = taskWorkloadReconciler.SetupWithManager(mgr); err != nil {
-				setupLog.Error(err, "unable to create controller", "controller", "TaskWorkload")
-				os.Exit(1)
-			}
-		}
-
 		if controllerConfig.IncludeStatefulsetRunner {
 			if err = statefulsetcontrollers.NewAppWorkloadReconciler(
 				mgr.GetClient(),

helm/korifi/controllers/configmap.yaml

@@ -6,7 +6,6 @@ metadata:
 data:
   config.yaml: |-
     includeKpackImageBuilder: {{ .Values.kpackImageBuilder.include }}
-    includeJobTaskRunner: {{ .Values.jobTaskRunner.include }}
     includeStatefulsetRunner: {{ .Values.statefulsetRunner.include }}
     builderName: {{ .Values.reconcilers.build }}
     runnerName: {{ .Values.reconcilers.run }}
@@ -51,9 +50,6 @@ data:
     containerRegistryType: "ECR"
     {{- end }}
     {{- end }}
-    {{- if .Values.jobTaskRunner.include }}
-    jobTTL: {{ required "jobTTL is required" .Values.jobTaskRunner.jobTTL }}
-    {{- end }}
     networking:
       gatewayNamespace: {{ .Release.Namespace }}-gateway
       gatewayName: korifi

helm/korifi/controllers/role.yaml

@@ -186,6 +186,7 @@ rules:
   - korifi.cloudfoundry.org
   resources:
   - cfdomains
+  - runnerinfos
   - taskworkloads
   verbs:
   - create
@@ -215,6 +216,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - korifi.cloudfoundry.org
+  resources:
+  - runnerinfos/status
+  verbs:
+  - get
+  - patch
 - apiGroups:
   - kpack.io
   resources:

helm/korifi/job-task-runner/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: job-task-runner
+  name: job-task-runner-controller-manager
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.jobTaskRunner.replicas }}
+  selector:
+    matchLabels:
+      app: job-task-runner
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+        prometheus.io/path: /metrics
+        prometheus.io/port: "8080"
+        prometheus.io/scrape: "true"
+      labels:
+        app: job-task-runner
+    spec:
+      containers:
+      - name: manager
+        image: {{ .Values.jobTaskRunner.image }}
+{{- if .Values.debug }}
+        command:
+        - "/dlv"
+        args:
+        - "--listen=:40000"
+        - "--headless=true"
+        - "--api-version=2"
+        - "exec"
+        - "/manager"
+        - "--continue"
+        - "--accept-multiclient"
+        - "--"
+        - "--health-probe-bind-address=:8081"
+        - "--leader-elect"
+        - "--ttl={{ required "jobTTL is required" .Values.jobTaskRunner.jobTTL }}"
+        - "--add-seccomp-profile={{ .Values.jobTaskRunner.temporarySetPodSeccompProfile }}"
+{{- else }}
+        args:
+        - --health-probe-bind-address=:8081
+        - --leader-elect
+        - --ttl={{ required "jobTTL is required" .Values.jobTaskRunner.jobTTL }}
+        - --add-seccomp-profile={{ .Values.jobTaskRunner.temporarySetPodSeccompProfile }}
+{{- end }}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        ports:
+        - containerPort: 8080
+          name: metrics
+          protocol: TCP
+        resources:
+        {{- .Values.jobTaskRunner.resources | toYaml | nindent 10 }}
+        {{- include "korifi.securityContext" . | indent 8 }}
+      {{- include "korifi.podSecurityContext" . | indent 6 }}
+      serviceAccountName: job-task-runner-controller-manager
+{{- if .Values.jobTaskRunner.nodeSelector }}
+      nodeSelector:
+      {{ toYaml .Values.jobTaskRunner.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.jobTaskRunner.tolerations }}
+      tolerations:
+      {{- toYaml .Values.jobTaskRunner.tolerations | nindent 8 }}
+{{- end }}
+      terminationGracePeriodSeconds: 10

helm/korifi/job-task-runner/rbac.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: job-task-runner-controller-manager
+  namespace: {{ .Release.Namespace }}
+imagePullSecrets:
+{{- range .Values.systemImagePullSecrets }}
+- name: {{ . | quote }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: job-task-runner-leader-election-rolebinding
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: korifi-controllers-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: job-task-runner-controller-manager
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: job-task-runner-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: korifi-job-task-runner-taskworkload-manager-role
+subjects:
+- kind: ServiceAccount
+  name: job-task-runner-controller-manager
+  namespace: {{ .Release.Namespace }}

helm/korifi/job-task-runner/service.yaml

@@ -0,0 +1,18 @@
+---
+{{- if .Values.debug }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: job-task-runner-debug-port
+  namespace: {{ .Release.Namespace }}
+spec:
+  ports:
+    - name: debug-30053
+      nodePort: 30053
+      port: 30053
+      protocol: TCP
+      targetPort: 40000
+  selector:
+    app: job-task-runner
+  type: NodePort
+{{- end }}

helm/korifi/values.yaml

@@ -122,14 +122,15 @@ statefulsetRunner:
 
 jobTaskRunner:
   include: true
+  image: cloudfoundry/job-task-runner:latest
   replicas: 1
   resources:
     limits:
-      cpu: 500m
-      memory: 128Mi
+      cpu: 1000m
+      memory: 1Gi
     requests:
-      cpu: 10m
-      memory: 64Mi
+      cpu: 50m
+      memory: 100Mi
 
   jobTTL: 24h