Andrew
02c8abb67b
Two-container pod sharing source via emptyDir populated by init container. Nginx vhost in a separate ConfigMap. OAuth keys mounted from the chart Secret as files under /var/www/html/secrets/, copied into storage/ by the prod entrypoint. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
101 lines
3.4 KiB
YAML
101 lines
3.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "ezscale-website.fullname" . }}-app
|
|
labels:
|
|
{{- include "ezscale-website.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: app
|
|
spec:
|
|
{{- if not .Values.app.autoscaling.enabled }}
|
|
replicas: {{ .Values.app.replicaCount }}
|
|
{{- end }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "ezscale-website.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: app
|
|
annotations:
|
|
# Restart pods when env or nginx config changes
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
checksum/nginx: {{ include (print $.Template.BasePath "/configmap-nginx.yaml") . | sha256sum }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
initContainers:
|
|
- name: copy-source
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cp -a /var/www/html/. /shared/
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /shared
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.30-alpine
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /var/www/html
|
|
readOnly: true
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/conf.d
|
|
readOnly: true
|
|
livenessProbe:
|
|
httpGet:
|
|
path: {{ .Values.healthCheck.livenessPath }}
|
|
port: http
|
|
initialDelaySeconds: {{ .Values.healthCheck.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.healthCheck.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.healthCheck.failureThreshold }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: {{ .Values.healthCheck.readinessPath }}
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
- name: app
|
|
image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
|
|
ports:
|
|
- name: php-fpm
|
|
containerPort: 9000
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "ezscale-website.fullname" . }}-env
|
|
- secretRef:
|
|
name: {{ include "ezscale-website.secretName" . }}
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /var/www/html
|
|
- name: oauth-keys
|
|
mountPath: /var/www/html/secrets
|
|
readOnly: true
|
|
resources:
|
|
{{- toYaml .Values.app.resources | nindent 12 }}
|
|
volumes:
|
|
- name: shared
|
|
emptyDir: {}
|
|
- name: nginx-config
|
|
configMap:
|
|
name: {{ include "ezscale-website.fullname" . }}-nginx
|
|
- name: oauth-keys
|
|
secret:
|
|
secretName: {{ include "ezscale-website.secretName" . }}
|
|
items:
|
|
- key: oauth-private.key
|
|
path: oauth-private.key
|
|
- key: oauth-public.key
|
|
path: oauth-public.key
|
|
optional: true
|