argoyleandClaude Opus 5.5
c6191756c5
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace sites), the way Shiny deploys to Frostmoln staging. Frostmoln enforces restricted Pod Security, so the image is nginx-unprivileged (uid 101, port 8080) with a matching securityContext. The ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
81 lines
1.8 KiB
YAML
81 lines
1.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: lingonpaj-site
|
|
labels:
|
|
app.kubernetes.io/name: lingonpaj-site
|
|
annotations:
|
|
kubernetes.io/change-cause: "${TIMESTAMP} Deployed commit id: ${COMMIT}"
|
|
spec:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 1
|
|
minReadySeconds: 30
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: lingonpaj-site
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: lingonpaj-site
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
labelSelector:
|
|
matchExpressions:
|
|
- key: "app.kubernetes.io/name"
|
|
operator: In
|
|
values:
|
|
- lingonpaj-site
|
|
topologyKey: kubernetes.io/hostname
|
|
containers:
|
|
- name: lingonpaj-site
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
imagePullPolicy: Always
|
|
image: ${IMAGE}
|
|
ports:
|
|
- containerPort: 8080
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
resources:
|
|
requests:
|
|
cpu: 5m
|
|
memory: 5Mi
|
|
limits:
|
|
memory: 300Mi
|
|
|
|
|
|
---
|
|
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: lingonpaj-site
|
|
labels:
|
|
app.kubernetes.io/name: lingonpaj-site
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: lingonpaj-site
|
|
ports:
|
|
- port: 80
|
|
targetPort: 8080
|