refactor(k8s): minimale, flache Manifeste zum Kopieren

Kustomize-Struktur (base/overlays) entfernt. Stattdessen nummerierte Einzeldateien, ausrollbar mit "kubectl apply -f k8s/": 00-namespace, 01-config, 02-storage (SMB-PVs/PVCs Postgres + Medien), 03-postgres (StatefulSet + Service), 04-app (Deployment mit Migrations-initContainer + Service), 05-ingress, 06-worker, 07-networkpolicy. Secrets als secrets.yaml.example (echte secrets.yaml ist gitignored). Images mit Tag latest aus der Gitea-Pipeline. Kurzanleitung in k8s/README.md, Betriebsdoku angepasst. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-28 01:12:26 +02:00
1 parent c84eb1e740
commit 91791b791f
@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: artista-modelcamp-postgres
+  namespace: artista
+spec:
+  serviceName: artista-modelcamp-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: artista-modelcamp-postgres
+  template:
+    metadata:
+      labels:
+        app: artista-modelcamp-postgres
+    spec:
+      terminationGracePeriodSeconds: 120   # sauber herunterfahren vor dem Aushaengen
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 70
+        runAsGroup: 70
+        seccompProfile: { type: RuntimeDefault }
+      containers:
+        - name: postgres
+          image: postgres:18.1-alpine
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: artista
+            - name: POSTGRES_DB
+              value: artista
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef: { name: artista-modelcamp-secrets, key: DB_PASSWORD }
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql
+          readinessProbe:
+            exec: { command: ["pg_isready", "-U", "artista"] }
+            periodSeconds: 5
+          resources:
+            requests: { cpu: 100m, memory: 256Mi }
+            limits: { memory: 1Gi }
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: { drop: ["ALL"] }
+      volumes:
+        - name: data
+          persistentVolumeClaim: { claimName: artista-modelcamp-postgres }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: artista-modelcamp-postgres
+  namespace: artista
+spec:
+  clusterIP: None
+  selector:
+    app: artista-modelcamp-postgres
+  ports:
+    - port: 5432