Nick SzaunigandClaude Opus 5.5
f2b548cb98
Docker-Images bauen und veroeffentlichen / build-and-push (push) Successful in 5m51s
App, Migration und Worker zeigen auf sha-<commit> mit imagePullPolicy IfNotPresent. Damit gibt es ein Rollback per rollout undo, und ein Neustart zieht nicht mehr ungeprueft das neueste Image (oder scheitert, wenn Gitea gerade nicht laeuft). README beschreibt das Ausrollen mit kubectl set image. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
91 lines
2.8 KiB
YAML
91 lines
2.8 KiB
YAML
# Website. Der initContainer migriert vor jedem Start die Datenbank.
|
|
# Update nach neuem Image: kubectl -n artista rollout restart deploy/artista-modelcamp-app
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: artista-modelcamp-app
|
|
namespace: artista
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: artista-modelcamp-app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: artista-modelcamp-app
|
|
db-client: "true"
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
seccompProfile: { type: RuntimeDefault }
|
|
initContainers:
|
|
- name: migrate
|
|
# Gepinnt auf einen CI-Build (sha-<commit>), nicht :latest. Ausrollen siehe README.
|
|
image: git.encry.de/nick.rosenloecher/artista-modelcamp-tools:sha-REPLACE_ME
|
|
imagePullPolicy: IfNotPresent
|
|
command: ["prisma", "migrate", "deploy"]
|
|
envFrom:
|
|
- secretRef: { name: artista-modelcamp-secrets }
|
|
resources:
|
|
requests: { cpu: "0", memory: "0" }
|
|
limits: { memory: 512Mi }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: { drop: ["ALL"] }
|
|
containers:
|
|
- name: app
|
|
image: git.encry.de/nick.rosenloecher/artista-modelcamp:sha-REPLACE_ME
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- name: http
|
|
containerPort: 3000
|
|
envFrom:
|
|
- configMapRef: { name: artista-modelcamp-config }
|
|
- secretRef: { name: artista-modelcamp-secrets }
|
|
readinessProbe:
|
|
httpGet: { path: /api/health/ready, port: http }
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: { path: /api/health, port: http }
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 20
|
|
resources:
|
|
requests: { cpu: "0", memory: "0" }
|
|
limits: { memory: 768Mi }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: { drop: ["ALL"] }
|
|
volumeMounts:
|
|
- name: media
|
|
mountPath: /app/media
|
|
readOnly: true
|
|
- name: cache
|
|
mountPath: /app/.next/cache
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: media
|
|
persistentVolumeClaim: { claimName: artista-modelcamp-media }
|
|
- name: cache
|
|
emptyDir: { sizeLimit: 512Mi }
|
|
- name: tmp
|
|
emptyDir: { sizeLimit: 64Mi }
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: artista-modelcamp-app
|
|
namespace: artista
|
|
spec:
|
|
selector:
|
|
app: artista-modelcamp-app
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|