The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace sites), the way Shiny deploys to Frostmoln staging.
Frostmoln enforces restricted Pod Security, so the image is
nginx-unprivileged (uid 101, port 8080) with a matching securityContext.
The ALB ingress becomes a Traefik one with a Let's Encrypt certificate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
## Summary
`k8s/deploy.yaml` takes the image from build-tools: `image: ${IMAGE}` instead of the hard-coded `oci.unbound.se/unboundsoftware/lingonpaj-site:${COMMIT}`.
`deploy` substitutes `${IMAGE}` with `<registry>/<owner>/<name>:<tag>`, where the registry comes from the build-tools config and the tag is the value `${COMMIT}` gets today. The rendered reference is unchanged. Moving off `oci.unbound.se` later becomes one change in infra.
Validated on shiny/time-service#864: merged and deployed to AWS staging and Frostmoln staging with the same image. Prerequisites, all merged:
- unboundsoftware/infra#1808: registry in `BUILDTOOLS_FROSTMOLN_STAGING`
- shiny/acctest#952: acctest pins build-tools to the Gitea registry
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.unbound.se/unboundsoftware/lingonpaj-site/pulls/84
Remove cpu from resource limits while keeping memory limits and all
requests intact. CPU limits cause unnecessary throttling and
overcommit alerts when actual usage is far below limits.
Refactor Kubernetes deployment and service labels to follow
the recommended label format. Change all occurrences of
"app: lingonpaj-site" to "app.kubernetes.io/name: lingonpaj-site"
for improved consistency and compliance with Kubernetes best
practices.
Reduce CPU and memory requests from 10m to 5m and from 10Mi to 5Mi to
optimize resource usage for the application deployment. This change
aims to improve overall efficiency without compromising performance.
argoyleandClaude Opus 5.5
renovate