Andrew
4ff3048dd3
- _helpers.tpl: required guard on image.tag — silent empty deploys can no longer happen; helm fails fast with a clear message. - configmap-nginx: HTTPS fastcgi param uses if_not_empty, so PHP only sees HTTPS when X-Forwarded-Proto is actually present. - deployment-app: add startupProbe with 100s budget so first-boot cache warmup doesn't trip liveness. - deployment-horizon: failureThreshold=5 on the horizon:status probe; transient Valkey blips no longer cause restart loops. - job-migrate: mount oauth-keys so seeders that touch Passport clients don't silently fail. - statefulset-valkey: replace separate password Secret with a requirePassword toggle that reads REDIS_PASSWORD from the main chart Secret (same Secret app/horizon/scheduler already mount). Liveness probe authenticates with the password when set. - values-us-prod: enable valkey.requirePassword. - README: add REDIS_PASSWORD to bootstrap procedure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.2 KiB
YAML
66 lines
2.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "ezscale-website.fullname" . }}-horizon
|
|
labels:
|
|
{{- include "ezscale-website.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: horizon
|
|
spec:
|
|
replicas: {{ .Values.horizon.replicaCount }}
|
|
# Horizon needs SIGTERM + drain time. Don't run two replicas during update.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: horizon
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: horizon
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
terminationGracePeriodSeconds: 60
|
|
containers:
|
|
- name: horizon
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "horizon") }}
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "ezscale-website.fullname" . }}-env
|
|
- secretRef:
|
|
name: {{ include "ezscale-website.secretName" . }}
|
|
volumeMounts:
|
|
- name: oauth-keys
|
|
mountPath: /var/www/html/secrets
|
|
readOnly: true
|
|
resources:
|
|
{{- toYaml .Values.horizon.resources | nindent 12 }}
|
|
# horizon:status hits Redis. failureThreshold: 5 + periodSeconds: 30
|
|
# gives 150s of tolerance for transient Valkey blips before restart.
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- php
|
|
- artisan
|
|
- horizon:status
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
failureThreshold: 5
|
|
volumes:
|
|
- name: oauth-keys
|
|
secret:
|
|
secretName: {{ include "ezscale-website.secretName" . }}
|
|
items:
|
|
- key: oauth-private.key
|
|
path: oauth-private.key
|
|
- key: oauth-public.key
|
|
path: oauth-public.key
|
|
optional: true
|