Andrew
4ff3048dd3
- _helpers.tpl: required guard on image.tag — silent empty deploys can no longer happen; helm fails fast with a clear message. - configmap-nginx: HTTPS fastcgi param uses if_not_empty, so PHP only sees HTTPS when X-Forwarded-Proto is actually present. - deployment-app: add startupProbe with 100s budget so first-boot cache warmup doesn't trip liveness. - deployment-horizon: failureThreshold=5 on the horizon:status probe; transient Valkey blips no longer cause restart loops. - job-migrate: mount oauth-keys so seeders that touch Passport clients don't silently fail. - statefulset-valkey: replace separate password Secret with a requirePassword toggle that reads REDIS_PASSWORD from the main chart Secret (same Secret app/horizon/scheduler already mount). Liveness probe authenticates with the password when set. - values-us-prod: enable valkey.requirePassword. - README: add REDIS_PASSWORD to bootstrap procedure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
108 lines
3.7 KiB
YAML
108 lines
3.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "ezscale-website.fullname" . }}-app
|
|
labels:
|
|
{{- include "ezscale-website.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: app
|
|
spec:
|
|
{{- if not .Values.app.autoscaling.enabled }}
|
|
replicas: {{ .Values.app.replicaCount }}
|
|
{{- end }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: app
|
|
annotations:
|
|
# Restart pods when env or nginx config changes
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
checksum/nginx: {{ include (print $.Template.BasePath "/configmap-nginx.yaml") . | sha256sum }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
initContainers:
|
|
- name: copy-source
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cp -a /var/www/html/. /shared/
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /shared
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.30-alpine
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /var/www/html
|
|
readOnly: true
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/conf.d
|
|
readOnly: true
|
|
# Startup probe gives the app up to 100s for first-boot work
|
|
# (config:cache + route:cache + view:cache + opcache warmup) before
|
|
# liveness takes over.
|
|
startupProbe:
|
|
httpGet:
|
|
path: {{ .Values.healthCheck.livenessPath }}
|
|
port: http
|
|
failureThreshold: 20
|
|
periodSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: {{ .Values.healthCheck.livenessPath }}
|
|
port: http
|
|
periodSeconds: {{ .Values.healthCheck.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.healthCheck.failureThreshold }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: {{ .Values.healthCheck.readinessPath }}
|
|
port: http
|
|
periodSeconds: 5
|
|
- name: app
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
|
|
ports:
|
|
- name: php-fpm
|
|
containerPort: 9000
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "ezscale-website.fullname" . }}-env
|
|
- secretRef:
|
|
name: {{ include "ezscale-website.secretName" . }}
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /var/www/html
|
|
- name: oauth-keys
|
|
mountPath: /var/www/html/secrets
|
|
readOnly: true
|
|
resources:
|
|
{{- toYaml .Values.app.resources | nindent 12 }}
|
|
volumes:
|
|
- name: shared
|
|
emptyDir: {}
|
|
- name: nginx-config
|
|
configMap:
|
|
name: {{ include "ezscale-website.fullname" . }}-nginx
|
|
- name: oauth-keys
|
|
secret:
|
|
secretName: {{ include "ezscale-website.secretName" . }}
|
|
items:
|
|
- key: oauth-private.key
|
|
path: oauth-private.key
|
|
- key: oauth-public.key
|
|
path: oauth-public.key
|
|
optional: true
|