The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace sites), the way Shiny deploys to Frostmoln staging.
Frostmoln enforces restricted Pod Security, so the served image is
nginx-unprivileged (uid 101, port 8080) with a matching securityContext.
The ALB ingress becomes a Traefik one with a Let's Encrypt certificate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
## Summary
`k8s/deploy.yaml` takes the image from build-tools: `image: ${IMAGE}` instead of the hard-coded `oci.unbound.se/unboundsoftware/unbound-site:${COMMIT}`.
`deploy` substitutes `${IMAGE}` with `<registry>/<owner>/<name>:<tag>`, where the registry comes from the build-tools config and the tag is the value `${COMMIT}` gets today. The rendered reference is unchanged. Moving off `oci.unbound.se` later becomes one change in infra.
Validated on shiny/time-service#864: merged and deployed to AWS staging and Frostmoln staging with the same image. Prerequisites, all merged:
- unboundsoftware/infra#1808: registry in `BUILDTOOLS_FROSTMOLN_STAGING`
- shiny/acctest#952: acctest pins build-tools to the Gitea registry
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.unbound.se/unboundsoftware/unbound-site/pulls/241
Remove cpu from resource limits while keeping memory limits and all
requests intact. CPU limits cause unnecessary throttling and
overcommit alerts when actual usage is far below limits.
Change label keys from "app" to "app.kubernetes.io/name"
to standardize the label format across the deployment,
service, and pod specifications. This improves clarity and
ensures alignment with Kubernetes best practices for
labeling and facilitates better management and
selection of resources.
Adjust the CPU and memory requests for the container from 10m and
10Mi to 5m and 5Mi, respectively, to optimize resource usage in
the Kubernetes deployment. This change aims to allocate fewer
resources while maintaining application performance.
argoyleandClaude Opus 5.5
renovate