[INFRA-434] - Add OpenSearch reindex Job component to Phoenix overlay

kustomize/components/opensearch-index-job/job.yaml

@@ -0,0 +1,53 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: plane-opensearch-index
+  namespace: plane
+  labels:
+    app.kubernetes.io/name: plane-enterprise
+    app.kubernetes.io/component: opensearch-index
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 7200  # Auto-cleanup after 2 hours
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: plane-enterprise
+        app.kubernetes.io/component: opensearch-index
+      annotations:
+        # Update this timestamp to force a new job creation
+        # Use: date +%Y%m%d-%H%M%S
+        run-timestamp: "20250209-000000"
+    spec:
+      restartPolicy: OnFailure
+      serviceAccountName: plane-srv-account
+      containers:
+        - name: opensearch-index
+          image: makeplane/backend-commercial:v2.3.4
+          imagePullPolicy: Always
+          command:
+            - python
+            - manage.py
+            - manage_search_index
+            - document
+            - index
+            - --force
+            - --parallel
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+            - secretRef:
+                name: plane-app-secrets
+            - secretRef:
+                name: plane-doc-store-secrets
+            - secretRef:
+                name: plane-opensearch-secrets
+            - secretRef:
+                name: plane-silo-secrets
+          resources:
+            requests:
+              memory: 4Gi
+              cpu: "2"
+            limits:
+              memory: 8Gi
+              cpu: "4"

kustomize/components/opensearch-index-job/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+# Optional one-off Job that (re)builds the OpenSearch document index by running
+#   python manage.py manage_search_index document index --force --parallel
+# on the API (backend-commercial) image. Uses the same ConfigMap/Secrets as the
+# API deployment (incl. OpenSearch). Disabled by default — enable it from the
+# overlay's `components:` list when a reindex is needed.
+resources:
+  - job.yaml

kustomize/overlays/phoenix/kustomization.yaml

@@ -40,6 +40,14 @@ components:
   - ../../components/external-api
   # Worker importers (celery.importer queue)
   - ../../components/worker-importers
+  # One-off Job: rebuild the OpenSearch document index
+  # (manage_search_index document index --force --parallel) on the API image.
+  # Enabled to run a reindex; bump the Job's run-timestamp to re-trigger, and
+  # re-comment (or remove) once the reindex has completed so it does not re-fire
+  # on the next bundle deploy. MUST stay before nonroot-security-context and
+  # custom-ca so those components patch the Job (security context + CA init
+  # container) like every other workload.
+  - ../../components/opensearch-index-job
   # Optional: enable non-root security context on all workload Deployments (recommended for hardened environments)
   # Keep this AFTER pi-service and mcp-server so it patches all workloads.
   - ../../components/nonroot-security-context