apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-job-launcher
  namespace: app
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: job-manager
  namespace: app
rules:
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "get", "list", "watch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-job-launcher-binding
  namespace: app
subjects:
  - kind: ServiceAccount
    name: app-job-launcher
    namespace: app
roleRef:
  kind: Role
  name: job-manager
  apiGroup: rbac.authorization.k8s.io

from kubernetes import client, config

# Loads the ServiceAccount token mounted into the pod
config.load_incluster_config()
batch_v1 = client.BatchV1Api()


def trigger_ai_job(job_input: str, namespace: str = "app") -> str:
    container = client.V1Container(
        name="ai-worker",
        image="your-registry/ai-worker:latest",
        env=[client.V1EnvVar(name="JOB_INPUT", value=job_input)],
        resources=client.V1ResourceRequirements(
            requests={"cpu": "2", "memory": "8Gi"},
            limits={"memory": "8Gi"},
        ),
    )

    job = client.V1Job(
        metadata=client.V1ObjectMeta(generate_name="ai-job-"),
        spec=client.V1JobSpec(
            backoff_limit=2,                  # retry failed jobs up to 2 times
            active_deadline_seconds=3600,     # kill jobs that run longer than 1 hour
            ttl_seconds_after_finished=600,   # clean up finished jobs after 10 minutes
            template=client.V1PodTemplateSpec(
                spec=client.V1PodSpec(
                    restart_policy="Never",
                    containers=[container],
                )
            ),
        ),
    )

    created = batch_v1.create_namespaced_job(namespace=namespace, body=job)
    return created.metadata.name