Nick SzaunigandClaude Opus 5.5
a0ba921d19
Docker-Images bauen und veroeffentlichen / build-and-push (push) Successful in 3m2s
- Dateinamen nach Wabenhain-Schema (01-configmap, 02-secret, 03-storage, 04-postgres, 05-app-deployment, 06-ingress, 07-worker-cronjob, 08-networkpolicy); Secret-Vorlage als 02-secret.yaml.example, echte 02-secret.yaml gitignored. - Namespace: Pod Security "baseline" erzwungen, "restricted" als warn/audit. "restricted" kann den HTTP-01-Solver-Pod von cert-manager abweisen und damit die Zertifikatsausstellung blockieren. - NetworkPolicy nur noch fuer PostgreSQL; keine Policy vor der App (wie Wabenhain/ApiCore), da sie bei Traefik im Host-Netzwerk die Seite sperrt. - README: kompletter Neuaufbau inkl. Freigabe der Retain-PVs nach "kubectl delete namespace", Zertifikats-Diagnose. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
89 lines
2.6 KiB
YAML
89 lines
2.6 KiB
YAML
# Website. Der initContainer migriert vor jedem Start die Datenbank.
|
|
# Update nach neuem Image: kubectl -n artista rollout restart deploy/artista-modelcamp-app
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: artista-modelcamp-app
|
|
namespace: artista
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: artista-modelcamp-app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: artista-modelcamp-app
|
|
db-client: "true"
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
seccompProfile: { type: RuntimeDefault }
|
|
initContainers:
|
|
- name: migrate
|
|
image: git.encry.de/nick.rosenloecher/artista-modelcamp-tools:latest
|
|
imagePullPolicy: Always
|
|
command: ["prisma", "migrate", "deploy"]
|
|
envFrom:
|
|
- secretRef: { name: artista-modelcamp-secrets }
|
|
resources:
|
|
limits: { memory: 512Mi }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: { drop: ["ALL"] }
|
|
containers:
|
|
- name: app
|
|
image: git.encry.de/nick.rosenloecher/artista-modelcamp:latest
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- name: http
|
|
containerPort: 3000
|
|
envFrom:
|
|
- configMapRef: { name: artista-modelcamp-config }
|
|
- secretRef: { name: artista-modelcamp-secrets }
|
|
readinessProbe:
|
|
httpGet: { path: /api/health/ready, port: http }
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: { path: /api/health, port: http }
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 20
|
|
resources:
|
|
requests: { cpu: 200m, memory: 256Mi }
|
|
limits: { memory: 768Mi }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: { drop: ["ALL"] }
|
|
volumeMounts:
|
|
- name: media
|
|
mountPath: /app/media
|
|
readOnly: true
|
|
- name: cache
|
|
mountPath: /app/.next/cache
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: media
|
|
persistentVolumeClaim: { claimName: artista-modelcamp-media }
|
|
- name: cache
|
|
emptyDir: { sizeLimit: 512Mi }
|
|
- name: tmp
|
|
emptyDir: { sizeLimit: 64Mi }
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: artista-modelcamp-app
|
|
namespace: artista
|
|
spec:
|
|
selector:
|
|
app: artista-modelcamp-app
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|