[INF-6675] add js executor

charts/retool/templates/_helpers.tpl

@@ -125,6 +125,23 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 telemetry.retool.com/service-name: code-executor
 {{- end }}
 
+{{/*
+Selector labels for js executor. Note changes here will require manual
+deployment recreation and incur downtime, so should be avoided.
+*/}}
+{{- define "retool.jsExecutor.selectorLabels" -}}
+retoolService: {{ include "retool.jsExecutor.name" . }}
+{{- end }}
+
+{{/*
+Extra (non-selector) labels for js executor.
+*/}}
+{{- define "retool.jsExecutor.labels" -}}
+app.kubernetes.io/name: {{ include "retool.jsExecutor.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+telemetry.retool.com/service-name: js-executor
+{{- end }}
+
 {{/*
 Selector labels for agent worker. Note changes here will require manual
 deployment recreation and incur downtime, so should be avoided.
@@ -370,6 +387,13 @@ Set code executor service name
 {{ template "retool.fullname" . }}-code-executor
 {{- end -}}
 
+{{/*
+Set JS executor service name
+*/}}
+{{- define "retool.jsExecutor.name" -}}
+{{ template "retool.fullname" . }}-js-executor
+{{- end -}}
+
 {{/*
 Set multiplayer service name
 */}}
@@ -564,6 +588,25 @@ Usage: (template "retool.codeExecutor.image.tag" .)
 {{- end -}}
 {{- end -}}
 
+{{/*
+Set JS executor image tag
+Usage: (template "retool.jsExecutor.image.tag" .)
+*/}}
+{{- define "retool.jsExecutor.image.tag" -}}
+{{- if .Values.image.tag -}}
+  {{- $valid_retool_version_regexp := "([0-9]+\\.[0-9]+(\\.[0-9]+)?(-[a-zA-Z0-9]+)?)" }}
+  {{- $semver_version_regexp := "[0-9]+\\.[0-9]+(\\.[0-9]+)?" }}
+  {{- $retool_version_with_ce := ( and ( regexMatch $valid_retool_version_regexp $.Values.image.tag ) ( semverCompare ">= 3.20.15-0" ( regexFind $semver_version_regexp $.Values.image.tag ) ) ) }}
+  {{- if $retool_version_with_ce -}}
+    {{- .Values.image.tag -}}
+  {{- else -}}
+    {{- "1.1.0" -}}
+  {{- end -}}
+{{- else -}}
+  {{- fail "Please set a value for .Values.image.tag" }}
+{{- end -}}
+{{- end -}}
+
 {{- define "retool_version_with_java_dbconnector_opt_out" -}}
 {{- $output := "" -}}
 {{- $valid_retool_version_regexp := "([0-9]+\\.[0-9]+(\\.[0-9]+)?(-[a-zA-Z0-9]+)?)" }}

charts/retool/templates/_workers.tpl

@@ -213,6 +213,8 @@ spec:
             value: {{ template "retool.postgresql.ssl_enabled" $ }}
           - name: CODE_EXECUTOR_INGRESS_DOMAIN
             value: http://{{ template "retool.codeExecutor.name" $ }}
+          - name: JS_EXECUTOR_INGRESS_DOMAIN
+            value: http://{{ template "retool.jsExecutor.name" $ }}
           {{- include "retool.agentSandbox.backendEnvVars" $ | nindent 10 }}
 
           {{- include "retool.telemetry.includeEnvVars" $ | nindent 10 }}

charts/retool/templates/configmap_js_executor.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: js-executor-seccomp
+data:
+  nsjail-seccomp.json: |
+    {{- .Files.Get "files/nsjail-seccomp.json" | nindent 4 }}

charts/retool/templates/deployment_backend.yaml

@@ -180,6 +180,8 @@ spec:
               {{- end }}
           {{- end }}
           {{- end }}
+          - name: JS_EXECUTOR_INGRESS_DOMAIN
+            value: http://{{ template "retool.jsExecutor.name" . }}
 
           {{- include "retool.telemetry.includeEnvVars" . | nindent 10 }}
 

charts/retool/templates/deployment_js_executor.yaml

@@ -0,0 +1,211 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "retool.jsExecutor.name" . }}
+  labels:
+    {{- include "retool.jsExecutor.selectorLabels" . | nindent 4 }}
+    {{- include "retool.jsExecutor.labels" . | nindent 4 }}
+    {{- include "retool.labels" . | nindent 4 }}
+{{- if .Values.deployment.labels }}
+{{ toYaml .Values.deployment.labels | indent 4 }}
+{{- end }}
+{{- if .Values.deployment.annotations }}
+  annotations:
+{{ toYaml .Values.deployment.annotations | indent 4 }}
+{{- end }}
+spec:
+  replicas: {{ .Values.jsExecutor.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "retool.jsExecutor.selectorLabels" . | nindent 6 }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  template:
+    metadata:
+      annotations:
+        checksum/seccomp: {{ .Files.Get "files/nsjail-seccomp.json" | sha256sum }}
+{{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+{{- end }}
+{{- if .Values.jsExecutor.annotations }}
+{{ toYaml .Values.jsExecutor.annotations | indent 8 }}
+{{- end }}
+      labels:
+        {{- include "retool.jsExecutor.selectorLabels" . | nindent 8 }}
+        {{- include "retool.jsExecutor.labels" . | nindent 8 }}
+        {{- include "retool.labels" . | nindent 8 }}
+{{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+{{- end }}
+{{- if .Values.jsExecutor.labels }}
+{{ toYaml .Values.jsExecutor.labels | indent 8 }}
+{{- end }}
+    spec:
+      serviceAccountName: {{ template "retool.serviceAccountName" . }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
+      initContainers:
+        - name: install-seccomp
+          image: busybox:1.37.0@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 1m
+              memory: 4Mi
+            limits:
+              cpu: 10m
+              memory: 16Mi
+          command:
+            - /bin/sh
+            - -c
+            - |
+              DEST="/host-seccomp/{{ .Values.jsExecutor.seccompLocalhostProfile }}"
+              mkdir -p "$(dirname "$DEST")"
+              cp /seccomp-profile/nsjail-seccomp.json "$DEST"
+              echo "seccomp profile installed at $DEST"
+          volumeMounts:
+            - name: seccomp-profile
+              mountPath: /seccomp-profile
+            - name: host-seccomp
+              mountPath: /host-seccomp
+{{- if .Values.initContainers }}
+{{- range $key, $value := .Values.initContainers }}
+        - name: "{{ $key }}"
+{{ toYaml $value | indent 10 }}
+{{- end }}
+{{- end }}
+      containers:
+      - name: js-executor
+        image: "{{ .Values.jsExecutor.image.repository }}:{{ include "retool.jsExecutor.image.tag" . }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        securityContext:
+          capabilities:
+            add: ["NET_ADMIN"]
+          seccompProfile:
+            type: Localhost
+            localhostProfile: {{ .Values.jsExecutor.seccompLocalhostProfile }}
+        env:
+          - name: DEPLOYMENT_TEMPLATE_TYPE
+            value: {{ template "retool.deploymentTemplateType" . }}
+          - name: DEPLOYMENT_TEMPLATE_VERSION
+            value: {{ template "retool.deploymentTemplateVersion" . }}
+          - name: NODE_ENV
+            value: production
+          {{- include "retool.telemetry.includeEnvVars" . | nindent 10 }}
+          {{- range $key, $value := .Values.env }}
+          - name: "{{ $key }}"
+            value: "{{ $value }}"
+          {{- end }}
+          {{- range .Values.environmentSecrets }}
+          - name: {{ .name }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ .secretKeyRef.name }}
+                key: {{ .secretKeyRef.key }}
+          {{- end }}
+          {{- with .Values.environmentVariables }}
+{{ toYaml . | indent 10 }}
+          {{- end }}
+        ports:
+        - containerPort: 3000
+          name: http-server
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+          failureThreshold:  {{ .Values.livenessProbe.failureThreshold }}
+        readinessProbe:
+          httpGet:
+            path: /api/readiness
+            port: 3000
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+          successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+        resources:
+{{ toYaml .Values.jsExecutor.resources | indent 10 }}
+        volumeMounts:
+{{- if .Values.jsExecutor.volumeMounts }}
+{{ toYaml .Values.jsExecutor.volumeMounts | indent 10 }}
+{{- end }}
+{{- if .Values.extraVolumeMounts }}
+{{ toYaml .Values.extraVolumeMounts | indent 10 }}
+{{- end }}
+{{- range .Values.extraConfigMapMounts }}
+          - name: {{ .name }}
+            mountPath: {{ .mountPath }}
+            subPath: {{ .subPath }}
+{{- end }}
+{{- with .Values.extraContainers }}
+{{ tpl . $ | indent 6 }}
+{{- end }}
+      volumes:
+        - name: seccomp-profile
+          configMap:
+            name: "js-executor-seccomp"
+        - name: host-seccomp
+          hostPath:
+            path: /var/lib/kubelet/seccomp
+            type: DirectoryOrCreate
+{{- if .Values.jsExecutor.volumes }}
+{{ toYaml .Values.jsExecutor.volumes | indent 8 }}
+{{- end }}
+{{- range .Values.extraConfigMapMounts }}
+        - name: {{ .name }}
+          configMap:
+            name: {{ .configMap }}
+{{- end }}
+{{- if .Values.extraVolumes }}
+{{ toYaml .Values.extraVolumes | indent 8 }}
+{{- end }}
+{{- if .Values.image.pullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.image.pullSecrets | indent 8 }}
+{{- end }}
+{{- if .Values.jsExecutor.affinity }}
+      affinity:
+{{ toYaml .Values.jsExecutor.affinity | indent 8 }}
+{{- end }}
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 8 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "retool.jsExecutor.name" . }}
+spec:
+  selector:
+    {{- include "retool.jsExecutor.selectorLabels" . | nindent 4 }}
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 3000
+    name: http-server
+---
+{{- if .Values.podDisruptionBudget }}
+{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.Version -}}
+apiVersion: policy/v1
+{{- else -}}
+apiVersion: policy/v1beta1
+{{- end }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "retool.jsExecutor.name" . }}
+spec:
+  {{- toYaml .Values.podDisruptionBudget | nindent 2 }}
+  selector:
+    matchLabels:
+  {{- include "retool.jsExecutor.selectorLabels" . | nindent 6 }}
+{{- end }}
+---

charts/retool/templates/deployment_workflows.yaml

@@ -153,6 +153,8 @@ spec:
               {{- end }}
           {{- end }}
           {{- end }}
+          - name: JS_EXECUTOR_INGRESS_DOMAIN
+            value: http://{{ template "retool.jsExecutor.name" . }}
 
           {{- include "retool.telemetry.includeEnvVars" . | nindent 10 }}
 

charts/retool/values.yaml

@@ -606,6 +606,37 @@ codeExecutor:
   securityContext:
     privileged: true
 
+# JS Executor
+jsExecutor:
+  image:
+    repository: tryretool/js-executor-service
+    pullPolicy: IfNotPresent
+
+  replicaCount: 1
+
+  seccompLocalhostProfile: profiles/nsjail-seccomp.json
+
+  # Annotations for JS executor pods
+  annotations: {}
+
+  # Labels for JS executor pods
+  labels: {}
+
+  volumes: {}
+  volumeMounts: {}
+
+  # Config affinity and anti-affinity rules for the JS executor pods
+  affinity: {}
+
+  # Resources for the JS executor
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 2048Mi
+    requests:
+      cpu: 1000m
+      memory: 1024Mi
+
 agents:
   # Enable AI Agents
   enabled: false

values.yaml

@@ -606,6 +606,37 @@ codeExecutor:
   securityContext:
     privileged: true
 
+# JS Executor
+jsExecutor:
+  image:
+    repository: tryretool/js-executor-service
+    pullPolicy: IfNotPresent
+
+  replicaCount: 1
+
+  seccompLocalhostProfile: profiles/nsjail-seccomp.json
+
+  # Annotations for JS executor pods
+  annotations: {}
+
+  # Labels for JS executor pods
+  labels: {}
+
+  volumes: {}
+  volumeMounts: {}
+
+  # Config affinity and anti-affinity rules for the JS executor pods
+  affinity: {}
+
+  # Resources for the JS executor
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 2048Mi
+    requests:
+      cpu: 1000m
+      memory: 1024Mi
+
 agents:
   # Enable AI Agents
   enabled: false