deployment.yml

# The consumer Deployment, the workload KEDA scales.
#
# replicas: 0 is deliberate: the ScaledObject activates the Deployment when the queue has messages and
# returns it to zero when the backlog is drained, so the sample starts from a scaled-to-zero state. The
# image reference is patched at apply time from `az acr show --query loginServer`, because the emulator
# and real Azure return different login servers.
#
# The pod template carries the azure.workload.identity/use: "true" label and runs as the queue-app
# service account: together they make the workload-identity webhook project a service account token
# into the pod and set AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_AUTHORITY_HOST and
# AZURE_FEDERATED_TOKEN_FILE, which is all DefaultAzureCredential needs. envFrom therefore references
# only the config map: the consumer holds no credential.
# https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster
apiVersion: apps/v1
kind: Deployment
metadata:
  name: queue-consumer
  namespace: keda-queue-storage-sample # Patched from NAMESPACE.
  labels:
    app: queue-consumer
spec:
  replicas: 0 # Start scaled to zero and let KEDA own the count from here on. Patched from MIN_REPLICAS.
  selector:
    matchLabels:
      app: queue-consumer # Must match the pod template labels below, or the Deployment is rejected.
  template:
    metadata:
      labels:
        app: queue-consumer
        azure.workload.identity/use: "true" # Without this label the webhook does not mutate the pod and no token is projected.
    spec:
      serviceAccountName: queue-app # The identity half of the chain; its annotations name the managed identity. Patched from SERVICE_ACCOUNT_NAME.
      containers:
        - name: consumer # Container name within the pod; the scripts use it for `kubectl logs -c`.
          image: <your-registry>/keda-queue-consumer:v1 # Patched at apply time from the ACR login server.
          imagePullPolicy: Always # Always re-pull, so rebuilding the image with the same tag takes effect. Patched from IMAGE_PULL_POLICY.
          envFrom:
            # Only the config map: this tutorial authenticates with workload identity, so there is no
            # secret to project and no connection string anywhere in the manifests.
            - configMapRef:
                name: queue-app-config # Non-secret settings. Patched from CONFIG_MAP_NAME.
          # Requests are what the scheduler reserves and what decides whether a replica fits on a node;
          # limits are the ceiling the kubelet enforces at runtime. Both are set so the ramp is honest:
          # without a request, four replicas could be packed onto capacity that cannot really run them.
          resources:
            requests:
              cpu: 50m # 0.05 of a core. The consumer spends most of its time sleeping or awaiting I/O.
              memory: 128Mi # Enough for the Python runtime and the Storage Queue SDK client.
            limits:
              cpu: 500m # 0.5 of a core. Exceeding this throttles the container rather than killing it.
              memory: 256Mi # Exceeding this is an OOMKill, so it is set well above the steady-state usage.