feat(supervisor): expose org placement overrides in helm and docs

Author: myftija

.server-changes/supervisor-org-placement-overrides.md

@@ -0,0 +1,6 @@
+---
+area: supervisor
+type: feature
+---
+
+Self-hosted Kubernetes deployments can now pin an organization's runs to specific nodes, with per-organization node selectors and tolerations for run pods.

docs/self-hosting/env/supervisor.mdx

@@ -48,6 +48,7 @@ mode: "wide"
 | `KUBERNETES_NAMESPACE`                      | No       | default     | The namespace that runs should be in.                       |
 | `KUBERNETES_WORKER_NODETYPE_LABEL`          | No       | v4-worker   | Nodes for runs need `nodetype=<this>`. Empty: any node.     |
 | `KUBERNETES_RUNNER_TOLERATIONS`             | No       | —           | Run pod tolerations. CSV: `key=value:effect`/`key:effect`.  |
+| `KUBERNETES_ORG_PLACEMENT_OVERRIDES`        | No       | —           | Per-org node selector and tolerations. JSON keyed by org ID.|
 | `KUBERNETES_IMAGE_PULL_SECRETS`             | No       | —           | Image pull secrets (CSV).                                   |
 | `KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT`   | No       | 10Gi        | Ephemeral storage size limit. Applies to all runs.          |
 | `KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST` | No       | 2Gi         | Ephemeral storage size request. Applies to all runs.        |

hosting/k8s/helm/templates/supervisor.yaml

@@ -174,6 +174,10 @@ spec:
             - name: KUBERNETES_RUNNER_TOLERATIONS
               value: {{ join "," . | quote }}
             {{- end }}
+            {{- with .Values.supervisor.config.kubernetes.orgPlacementOverrides }}
+            - name: KUBERNETES_ORG_PLACEMENT_OVERRIDES
+              value: {{ toJson . | quote }}
+            {{- end }}
             {{- $registryAuthEnabled := false }}
             {{- if .Values.registry.deploy }}
               {{- $registryAuthEnabled = .Values.registry.auth.enabled }}

hosting/k8s/helm/values.yaml

@@ -297,6 +297,7 @@ supervisor:
       namespace: "" # Default: uses release namespace
       workerNodetypeLabel: "" # When set, runs will only be scheduled on nodes with "nodetype=<label>"
       runnerTolerations: [] # Run pod tolerations, e.g. ["dedicated=runs:NoSchedule"]
+      orgPlacementOverrides: {} # Per-org run pod placement, e.g. {"<orgId>": {"nodeSelector": {"pool": "dedicated"}, "tolerations": "dedicated=runs:NoSchedule"}}
       ephemeralStorageSizeLimit: "" # Default: 10Gi
       ephemeralStorageSizeRequest: "" # Default: 2Gi´
     podCleaner: