feat(deploy): project infrastructure capabilities

2026-08-07 01:59:45 +02:00
parent dce725636d
commit 612a44bc8e
8 changed files with 731 additions and 4 deletions
@@ -11,6 +11,7 @@ from typing import Any, Mapping
 from urllib.parse import urlsplit

 from .bundle import BACKUP_RUNTIME_ENV_KEYS
+from .capabilities import infrastructure_capability_document
 from .model import InstallationSpec, image_is_digest_pinned


@@ -96,6 +97,7 @@ def render_kubernetes(
    public_host = urlsplit(spec.public_url).hostname or "localhost"
    labels = {"app.kubernetes.io/name": "govoplan", "app.kubernetes.io/instance": name}
    config_name = f"{name}-runtime"
+    capabilities_config_name = f"{name}-infrastructure-capabilities"
    service_account = f"{name}-runtime"
    config = {
        key: str(environment[key])
@@ -142,6 +144,22 @@ def render_kubernetes(
            "metadata": {"name": config_name, "namespace": namespace, "labels": labels},
            "data": dict(sorted(config.items())),
        },
+        {
+            "apiVersion": "v1",
+            "kind": "ConfigMap",
+            "metadata": {
+                "name": capabilities_config_name,
+                "namespace": namespace,
+                "labels": labels,
+            },
+            "data": {
+                "infrastructure-capabilities.json": json.dumps(
+                    infrastructure_capability_document(spec, environment),
+                    sort_keys=True,
+                    separators=(",", ":"),
+                )
+            },
+        },
        _deployment(
            name=f"{name}-api",
            namespace=namespace,
@@ -161,6 +179,7 @@ def render_kubernetes(
                "--proxy-headers",
            ),
            config_name=config_name,
+            capabilities_config_name=capabilities_config_name,
            secret_name=secret_name,
            s3_ca_secret_name=s3_ca_secret_name,
            service_account=service_account,
@@ -187,6 +206,7 @@ def render_kubernetes(
            image=spec.release.web_image,
            command=(),
            config_name=None,
+            capabilities_config_name=None,
            secret_name=None,
            s3_ca_secret_name=None,
            service_account=service_account,
@@ -247,6 +267,7 @@ def render_kubernetes(
                    "INFO",
                ),
                config_name=config_name,
+                capabilities_config_name=capabilities_config_name,
                secret_name=secret_name,
                s3_ca_secret_name=s3_ca_secret_name,
                service_account=service_account,
@@ -303,6 +324,7 @@ def render_kubernetes(
                    "/tmp/celerybeat-schedule",
                ),
                config_name=config_name,
+                capabilities_config_name=capabilities_config_name,
                secret_name=secret_name,
                s3_ca_secret_name=s3_ca_secret_name,
                service_account=service_account,
@@ -652,6 +674,7 @@ def _deployment(
    image: str,
    command: tuple[str, ...],
    config_name: str | None,
+    capabilities_config_name: str | None,
    secret_name: str | None,
    s3_ca_secret_name: str | None,
    service_account: str,
@@ -682,6 +705,13 @@ def _deployment(
    )
    if secret_name:
        environment.extend(_secret_environment(secret_name))
+    if capabilities_config_name:
+        environment.append(
+            {
+                "name": "GOVOPLAN_DEPLOYMENT_CAPABILITIES_PATH",
+                "value": "/etc/govoplan/deployment/infrastructure-capabilities.json",
+            }
+        )
    if s3_ca_secret_name:
        environment.append(
            {"name": "AWS_CA_BUNDLE", "value": "/etc/govoplan/trust/s3-ca.crt"}
@@ -757,6 +787,29 @@ def _deployment(
    if s3_ca_secret_name:
        pod_spec["volumes"].append(_s3_ca_volume(s3_ca_secret_name))
        container["volumeMounts"].append(_s3_ca_volume_mount())
+    if capabilities_config_name:
+        pod_spec["volumes"].append(
+            {
+                "name": "deployment-capabilities",
+                "configMap": {
+                    "name": capabilities_config_name,
+                    "items": [
+                        {
+                            "key": "infrastructure-capabilities.json",
+                            "path": "infrastructure-capabilities.json",
+                        }
+                    ],
+                },
+            }
+        )
+        container["volumeMounts"].append(
+            {
+                "name": "deployment-capabilities",
+                "mountPath": "/etc/govoplan/deployment/infrastructure-capabilities.json",
+                "subPath": "infrastructure-capabilities.json",
+                "readOnly": True,
+            }
+        )
    if config_name:
        pod_spec["containers"][0]["envFrom"] = [{"configMapRef": {"name": config_name}}]
    if config_name and secret_name: