+6 -2

cmd/main.go

reviewed

··· 64 64 // initializeSpindle creates a spindle server with KubernetesEngine 65 65 func initializeSpindle(ctx context.Context, cfg *config.Config, mgr ctrl.Manager) (*spindle.Spindle, error) { 66 66 // Initialize Kubernetes engine 67 67 - // Namespace and template will be configured by controller based on SpindleSet CRD 68 68 - kubeEngine := engine.NewKubernetesEngine(mgr.GetClient(), "default", loomv1alpha1.SpindleTemplate{}) 67 67 + // Get namespace from environment (injected via Downward API) 68 68 + namespace := os.Getenv("POD_NAMESPACE") 69 69 + if namespace == "" { 70 70 + namespace = "default" 71 71 + } 72 72 + kubeEngine := engine.NewKubernetesEngine(mgr.GetClient(), namespace, loomv1alpha1.SpindleTemplate{}) 69 73 70 74 // Create engines map with kubernetes engine 71 75 engines := map[string]models.Engine{

+1 -1

config/manager/kustomization.yaml

reviewed

··· 7 7 images: 8 8 - name: controller 9 9 newName: atcr.io/evan.jarrett.net/loom 10 10 - newTag: v0.0.2 10 10 + newTag: v0.0.3

+4

config/manager/manager.yaml

reviewed

··· 63 63 imagePullPolicy: Always 64 64 name: manager 65 65 env: 66 66 + - name: POD_NAMESPACE 67 67 + valueFrom: 68 68 + fieldRef: 69 69 + fieldPath: metadata.namespace 66 70 - name: SPINDLE_SERVER_HOSTNAME 67 71 value: "loom.jarrett.net" 68 72 - name: SPINDLE_SERVER_OWNER

+11

config/manager/pvc.yaml

reviewed

··· 1 1 + apiVersion: v1 2 2 + kind: PersistentVolumeClaim 3 3 + metadata: 4 4 + name: spindle-db 5 5 + namespace: system 6 6 + spec: 7 7 + accessModes: 8 8 + - ReadWriteOnce 9 9 + resources: 10 10 + requests: 11 11 + storage: 1Gi

-5

pkg/jobbuilder/job_template.go

reviewed

··· 129 129 Spec: corev1.PodSpec{ 130 130 RestartPolicy: corev1.RestartPolicyNever, 131 131 SecurityContext: &corev1.PodSecurityContext{ 132 132 - RunAsNonRoot: &[]bool{true}[0], 133 132 SeccompProfile: &corev1.SeccompProfile{ 134 133 Type: corev1.SeccompProfileTypeRuntimeDefault, 135 134 }, ··· 143 142 Command: []string{"/bin/sh", "-c"}, 144 143 SecurityContext: &corev1.SecurityContext{ 145 144 AllowPrivilegeEscalation: &[]bool{false}[0], 146 146 - RunAsNonRoot: &[]bool{true}[0], 147 145 Capabilities: &corev1.Capabilities{ 148 146 Drop: []corev1.Capability{"ALL"}, 149 149 - }, 150 150 - SeccompProfile: &corev1.SeccompProfile{ 151 151 - Type: corev1.SeccompProfileTypeRuntimeDefault, 152 147 }, 153 148 }, 154 149 Args: []string{