argoyle
3630bfa380
Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied). - Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did. - Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry). - Runs as uid 65534. The Frostmoln CronJob is suspended by hand after its first deploy and resumed by `migrate-db.sh dancefinder --cutover` (not in the manifest, so later deploys don't re-suspend it). Merging deploys to Frostmoln only; DNS still points at AWS until the cutover. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi Reviewed-on: https://gitea.unbound.se/dancefinder/dancefetcher/pulls/203
36 lines
905 B
YAML
36 lines
905 B
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: dancefetcher
|
|
name: dancefetcher
|
|
spec:
|
|
schedule: '0 0 * * *'
|
|
concurrencyPolicy: Forbid
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: oci-registry
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: dancefetcher
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
image: ${IMAGE}
|
|
imagePullPolicy: Always
|
|
resources:
|
|
limits:
|
|
memory: 200Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 30Mi
|
|
restartPolicy: OnFailure
|