refactor: Kubernetes-Ressourcen und Images heissen artista-filmcamp

Alle Ressourcen tragen den Praefix artista-filmcamp- (Deployment,
Service, StatefulSet, CronJobs, PVCs, ConfigMap, Secret, Ingress,
NetworkPolicies, Middleware) und liegen im Namespace artista. Die Images
heissen wieder <owner>/artista-filmcamp und <owner>/artista-filmcamp-tools,
passend zum Repo. DATABASE_URL-Host, Backup-Host und Betriebsdoku
entsprechend angepasst.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

k8s/base/app.yaml

@@ -3,11 +3,11 @@
 # PostgreSQL — beliebig viele Replikate moeglich.
 #
 # Migrationen laufen NICHT beim Start, sondern als eigener, kontrollierter
-# Schritt (jobs.yaml, CronJob "artista-migrate", siehe docs/BETRIEB.md).
+# Schritt (jobs.yaml, CronJob "artista-filmcamp-migrate", siehe docs/BETRIEB.md).
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: artista-app
+  name: artista-filmcamp-app
 spec:
   replicas: 2
   revisionHistoryLimit: 5
@@ -16,11 +16,11 @@ spec:
     rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
   selector:
     matchLabels:
-      app.kubernetes.io/name: artista-app
+      app.kubernetes.io/name: artista-filmcamp-app
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: artista-app
+        app.kubernetes.io/name: artista-filmcamp-app
         artista/db-client: "true"
     spec:
       automountServiceAccountToken: false
@@ -36,16 +36,16 @@ spec:
           whenUnsatisfiable: ScheduleAnyway
           labelSelector:
             matchLabels:
-              app.kubernetes.io/name: artista-app
+              app.kubernetes.io/name: artista-filmcamp-app
       containers:
         - name: app
-          image: artista-modelcamp
+          image: artista-filmcamp
           ports:
             - name: http
               containerPort: 3000
           envFrom:
-            - configMapRef: { name: artista-config }
-            - secretRef: { name: artista-secrets }
+            - configMapRef: { name: artista-filmcamp-config }
+            - secretRef: { name: artista-filmcamp-secrets }
           readinessProbe:
             httpGet: { path: /api/health/ready, port: http }
             periodSeconds: 10
@@ -76,7 +76,7 @@ spec:
               mountPath: /tmp
       volumes:
         - name: media
-          persistentVolumeClaim: { claimName: artista-media }
+          persistentVolumeClaim: { claimName: artista-filmcamp-media }
         - name: next-cache
           emptyDir: { sizeLimit: 512Mi }
         - name: tmp
@@ -85,10 +85,10 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: artista-app
+  name: artista-filmcamp-app
 spec:
   selector:
-    app.kubernetes.io/name: artista-app
+    app.kubernetes.io/name: artista-filmcamp-app
   ports:
     - name: http
       port: 80
@@ -102,11 +102,11 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: artista-app-ingress
+  name: artista-filmcamp-app-ingress
 spec:
   podSelector:
     matchLabels:
-      app.kubernetes.io/name: artista-app
+      app.kubernetes.io/name: artista-filmcamp-app
   policyTypes: ["Ingress"]
   ingress:
     - from:
@@ -121,9 +121,9 @@ spec:
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: artista-app
+  name: artista-filmcamp-app
 spec:
   minAvailable: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: artista-app
+      app.kubernetes.io/name: artista-filmcamp-app

k8s/base/config.yaml

@@ -10,7 +10,7 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: artista-config
+  name: artista-filmcamp-config
 data:
   APP_ENV: "production"
   APP_URL: "https://modelcamp.example.org"
@@ -33,7 +33,7 @@ data:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: artista-media
+  name: artista-filmcamp-media
 spec:
   accessModes: ["ReadWriteMany"]
   # storageClassName: longhorn
@@ -46,11 +46,11 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: artista-postgres-access
+  name: artista-filmcamp-postgres-access
 spec:
   podSelector:
     matchLabels:
-      app.kubernetes.io/name: artista-postgres
+      app.kubernetes.io/name: artista-filmcamp-postgres
   policyTypes: ["Ingress"]
   ingress:
     - from:

k8s/base/jobs.yaml

@@ -2,12 +2,12 @@
 # Als SUSPENDIERTER CronJob definiert, damit Kustomize das Image mit der
 # App gleichzieht. Er laeuft nie von selbst, sondern bewusst vor jedem
 # Rollout:
-#   kubectl -n artista create job migrate-$(date +%Y%m%d%H%M) --from=cronjob/artista-migrate
+#   kubectl -n artista create job migrate-$(date +%Y%m%d%H%M) --from=cronjob/artista-filmcamp-migrate
 #   kubectl -n artista wait --for=condition=complete job/migrate-… --timeout=5m
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: artista-migrate
+  name: artista-filmcamp-migrate
 spec:
   suspend: true
   schedule: "0 0 1 1 *"
@@ -28,10 +28,10 @@ spec:
             seccompProfile: { type: RuntimeDefault }
           containers:
             - name: migrate
-              image: artista-modelcamp-tools
+              image: artista-filmcamp-tools
               command: ["prisma", "migrate", "deploy"]
               envFrom:
-                - secretRef: { name: artista-secrets }
+                - secretRef: { name: artista-filmcamp-secrets }
               resources:
                 requests: { cpu: 50m, memory: 128Mi }
                 limits: { memory: 512Mi }
@@ -47,7 +47,7 @@ spec:
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: artista-worker
+  name: artista-filmcamp-worker
 spec:
   schedule: "*/10 * * * *"
   timeZone: "Europe/Berlin"
@@ -72,11 +72,11 @@ spec:
             seccompProfile: { type: RuntimeDefault }
           containers:
             - name: worker
-              image: artista-modelcamp-tools
+              image: artista-filmcamp-tools
               command: ["tsx", "scripts/worker.ts"]
               envFrom:
-                - configMapRef: { name: artista-config }
-                - secretRef: { name: artista-secrets }
+                - configMapRef: { name: artista-filmcamp-config }
+                - secretRef: { name: artista-filmcamp-secrets }
               resources:
                 requests: { cpu: 50m, memory: 192Mi }
                 limits: { memory: 512Mi }
@@ -91,7 +91,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: artista-db-backup
+  name: artista-filmcamp-db-backup
 spec:
   accessModes: ["ReadWriteOnce"]
   # storageClassName: smb-backup
@@ -102,7 +102,7 @@ spec:
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: artista-db-backup
+  name: artista-filmcamp-db-backup
 spec:
   schedule: "15 3 * * *"
   timeZone: "Europe/Berlin"
@@ -131,7 +131,7 @@ spec:
               env:
                 - name: PGPASSWORD
                   valueFrom:
-                    secretKeyRef: { name: artista-secrets, key: DB_PASSWORD }
+                    secretKeyRef: { name: artista-filmcamp-secrets, key: DB_PASSWORD }
               command: ["/bin/sh", "-c"]
               args:
                 - |
@@ -139,7 +139,7 @@ spec:
                   set -o pipefail
                   target="/backup/artista-$(date -u +%Y-%m-%d_%H%M).dump"
                   # Custom-Format: komprimiert, selektiv wiederherstellbar.
-                  pg_dump --host=artista-postgres --username=artista --dbname=artista \
+                  pg_dump --host=artista-filmcamp-postgres --username=artista --dbname=artista \
                     --format=custom --file="${target}.partial"
                   mv "${target}.partial" "${target}"
                   find /backup -name 'artista-*.dump.partial' -mtime +1 -delete
@@ -156,4 +156,4 @@ spec:
                   mountPath: /backup
           volumes:
             - name: backup
-              persistentVolumeClaim: { claimName: artista-db-backup }
+              persistentVolumeClaim: { claimName: artista-filmcamp-db-backup }

k8s/base/kustomization.yaml

@@ -10,5 +10,5 @@ resources:
   - jobs.yaml
 labels:
   - pairs:
-      app.kubernetes.io/part-of: artista-modelcamp
+      app.kubernetes.io/part-of: artista-filmcamp
     includeSelectors: false

k8s/base/postgres.yaml

@@ -12,17 +12,17 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: artista-postgres
+  name: artista-filmcamp-postgres
 spec:
-  serviceName: artista-postgres
+  serviceName: artista-filmcamp-postgres
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: artista-postgres
+      app.kubernetes.io/name: artista-filmcamp-postgres
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: artista-postgres
+        app.kubernetes.io/name: artista-filmcamp-postgres
     spec:
       securityContext:
         runAsNonRoot: true
@@ -42,7 +42,7 @@ spec:
               value: artista
             - name: POSTGRES_PASSWORD
               valueFrom:
-                secretKeyRef: { name: artista-secrets, key: DB_PASSWORD }
+                secretKeyRef: { name: artista-filmcamp-secrets, key: DB_PASSWORD }
           volumeMounts:
             # Ab PostgreSQL 18 liegt PGDATA unter /var/lib/postgresql/18/docker.
             - name: data
@@ -73,10 +73,10 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: artista-postgres
+  name: artista-filmcamp-postgres
 spec:
   clusterIP: None
   selector:
-    app.kubernetes.io/name: artista-postgres
+    app.kubernetes.io/name: artista-filmcamp-postgres
   ports:
     - port: 5432

k8s/overlays/production/ingress.yaml

@@ -8,7 +8,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: artista
+  name: artista-filmcamp
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -18,7 +18,7 @@ spec:
   tls:
     - hosts:
         - modelcamp.example.org
-      secretName: artista-tls
+      secretName: artista-filmcamp-tls
   rules:
     - host: modelcamp.example.org
       http:
@@ -27,7 +27,7 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: artista-app
+                name: artista-filmcamp-app
                 port:
                   name: http
 ---
@@ -36,10 +36,10 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: artista-http-redirect
+  name: artista-filmcamp-http-redirect
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: web
-    traefik.ingress.kubernetes.io/router.middlewares: artista-redirect-https@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: artista-artista-filmcamp-redirect-https@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
@@ -50,14 +50,14 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: artista-app
+                name: artista-filmcamp-app
                 port:
                   name: http
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: redirect-https
+  name: artista-filmcamp-redirect-https
 spec:
   redirectScheme:
     scheme: https

k8s/overlays/production/kustomization.yaml

@@ -12,15 +12,15 @@ images:
   # Gebaut von .gitea/workflows/docker-build.yml: Git-Tag "v0.1.0" pushen
   # ergibt Image-Tag "0.1.0" (Alternativen: "sha-<kurz>", "latest").
   # Beide Images immer mit identischem Tag ausrollen.
-  - name: artista-modelcamp
-    newName: git.encry.de/nick.rosenloecher/artista-modelcamp
+  - name: artista-filmcamp
+    newName: git.encry.de/nick.rosenloecher/artista-filmcamp
     newTag: "0.1.0"
-  - name: artista-modelcamp-tools
-    newName: git.encry.de/nick.rosenloecher/artista-modelcamp-tools
+  - name: artista-filmcamp-tools
+    newName: git.encry.de/nick.rosenloecher/artista-filmcamp-tools
     newTag: "0.1.0"
 
 patches:
-  - target: { kind: ConfigMap, name: artista-config }
+  - target: { kind: ConfigMap, name: artista-filmcamp-config }
     patch: |-
       - op: replace
         path: /data/APP_URL

k8s/secret.example.yaml

@@ -1,8 +1,8 @@
 # VORLAGE — nicht mit echten Werten ins Repository einchecken.
 # Anlegen z. B. per:
-#   kubectl -n artista create secret generic artista-secrets \
+#   kubectl -n artista create secret generic artista-filmcamp-secrets \
 #     --from-literal=DB_PASSWORD='…' \
-#     --from-literal=DATABASE_URL='postgresql://artista:…@artista-postgres:5432/artista' \
+#     --from-literal=DATABASE_URL='postgresql://artista:…@artista-filmcamp-postgres:5432/artista' \
 #     --from-literal=APP_SECRET="$(openssl rand -base64 48)" \
 #     --from-literal=BETTER_AUTH_SECRET="$(openssl rand -base64 48)" \
 #     --from-literal=STRIPE_SECRET_KEY='sk_test_…' \
@@ -12,13 +12,13 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: artista-secrets
+  name: artista-filmcamp-secrets
   namespace: artista
 type: Opaque
 stringData:
   DB_PASSWORD: "<starkes-passwort>"
   # Passwort URL-kodiert einsetzen, falls Sonderzeichen enthalten sind.
-  DATABASE_URL: "postgresql://artista:<starkes-passwort>@artista-postgres:5432/artista"
+  DATABASE_URL: "postgresql://artista:<starkes-passwort>@artista-filmcamp-postgres:5432/artista"
   APP_SECRET: "<mind-32-zeichen-zufall>"
   BETTER_AUTH_SECRET: "<anderer-mind-32-zeichen-zufall>"
   STRIPE_SECRET_KEY: "<sk_test_… oder sk_live_…>"