feat: deploy to Frostmoln production #1019

Merged

argoyle merged 1 commits from feat/frostmoln-production into main 2026-10-15 21:15:31 +00:00

Conversation 0 Commits 1 Files Changed 9

+68 -52

argoyle commented 2026-10-14 20:26:31 +00:00

Owner

Copy link

Copy source

Moves the production deploy from AWS to the Frostmoln production cluster (namespace schemas).

• deploy-prod (AWS) has failed since CI left AWS (no k8s.unbound.se context on the runners). It's replaced by deploy-prod-frostmoln, as in unbound-site/lingonpaj-site: deploy prod-frostmoln -n schemas with the org's FROSTMOLN_PRODUCTION_DEPLOY_KEY, FROSTMOLN_PRODUCTION_CLUSTER_ID and BUILDTOOLS_FROSTMOLN_PRODUCTION.
• Restricted Pod Security: the image runs as node (uid 1000) with a matching securityContext. The service only writes under /tmp (cosmo composition).
• secrets.yaml (AWS ClusterSecretStore, RDS + CloudAMQP) → secrets-prod-frostmoln.yaml: the namespace's frostmoln SecretStore and the Frostmoln Secret schemas (POSTGRES_URL, AMQP_URL, API_KEY), written by infra's seed-schemas.sh. The file had no target suffix, so it applied to every target.
• config-prod/pdb-prod → -prod-frostmoln; the ALB ingress → a Traefik one for /query with a Let's Encrypt certificate.

Checked locally (amd64): runs as uid 1000 with all capabilities dropped, wgc works, /tmp writable; it fails only on the (dummy) database, as expected.

Merge after infra#1878 is applied and seed-schemas.sh + migrate-schemas-db.sh have run. schemas.unbound.se keeps pointing at AWS until the cut-over.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`). - `deploy-prod` (AWS) has failed since CI left AWS (no `k8s.unbound.se` context on the runners). It's replaced by `deploy-prod-frostmoln`, as in unbound-site/lingonpaj-site: `deploy prod-frostmoln -n schemas` with the org's `FROSTMOLN_PRODUCTION_DEPLOY_KEY`, `FROSTMOLN_PRODUCTION_CLUSTER_ID` and `BUILDTOOLS_FROSTMOLN_PRODUCTION`. - Restricted Pod Security: the image runs as `node` (uid 1000) with a matching securityContext. The service only writes under `/tmp` (cosmo composition). - `secrets.yaml` (AWS ClusterSecretStore, RDS + CloudAMQP) → `secrets-prod-frostmoln.yaml`: the namespace's `frostmoln` SecretStore and the Frostmoln Secret `schemas` (`POSTGRES_URL`, `AMQP_URL`, `API_KEY`), written by infra's `seed-schemas.sh`. The file had no target suffix, so it applied to every target. - `config-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/query` with a Let's Encrypt certificate. Checked locally (amd64): runs as uid 1000 with all capabilities dropped, `wgc` works, `/tmp` writable; it fails only on the (dummy) database, as expected. **Merge after** infra#1878 is applied and `seed-schemas.sh` + `migrate-schemas-db.sh` have run. `schemas.unbound.se` keeps pointing at AWS until the cut-over. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

argoyle added 1 commit 2026-10-14 20:26:32 +00:00

feat: deploy to Frostmoln production ... d041432772

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace schemas), the way the sites do.

Frostmoln enforces restricted Pod Security: the pod runs as the image's
non-root user with a matching securityContext. The prod-only manifests
move to the prod-frostmoln target; the ALB ingress becomes a Traefik one
with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

argoyle merged commit 3709a90124 into main 2026-10-15 21:15:31 +00:00

argoyle deleted branch feat/frostmoln-production 2026-10-15 21:15:31 +00:00

releaser referenced this pull request 2026-10-15 21:19:01 +00:00

chore(release): prepare for v0.10.0 #1024

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

dependencies

Pull requests that update a dependency file

docker

go

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unboundsoftware/schemas#1019