codeforphilly-ng/deploy/kustomize/base/deployment.yaml at develop · CodeForPhilly/codeforphilly-ng · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
apiVersion: apps/v1
kind: Deployment
metadata:
  name: codeforphilly
spec:
  # Single replica is a hard architectural constraint — the in-process write
  # mutex serializes gitsheets commits. See specs/architecture.md.
  replicas: 1
  strategy:
    # Recreate, not RollingUpdate: two pods writing the same gitsheets repo
    # would corrupt state. Old pod must release the lock before new starts.
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: codeforphilly
  template:
    metadata:
      labels:
        app.kubernetes.io/name: codeforphilly
    spec:
      serviceAccountName: codeforphilly
      securityContext:
        fsGroup: 1000
      containers:
        - name: codeforphilly
          image: ghcr.io/codeforphilly/codeforphilly-ng:sandbox
          # Always pull — sandbox tag is mutable (re-pushed on each iteration).
          # Production overlays should pin to a digest and flip this to IfNotPresent.
          imagePullPolicy: Always
          ports:
            - containerPort: 3001
              name: http
          envFrom:
            - configMapRef:
                name: codeforphilly-env
            - secretRef:
                name: codeforphilly-secrets
          env:
            - name: HOST
              value: "0.0.0.0"
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: private
              mountPath: /app/private-storage
            - name: deploy-key
              mountPath: /etc/cfp-data-deploy-key
              readOnly: true
          # Readiness probe gates traffic until both stores have loaded.
          readinessProbe:
            httpGet:
              path: /api/health/ready
              port: http
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 30
          livenessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 100m
              # ~321Mi measured steady-state RSS (full `published` import +
              # indices + FTS) with gitsheets 1.4.1; request sits above that.
              memory: 512Mi
            limits:
              cpu: 1000m
              # Holds the full public dataset + secondary indices + FTS in
              # memory (~31.8k people, 268 projects, 10.4k tag-assignments, …).
              # 1Gi (was 2.5Gi): gitsheets 1.4.1's smol-toml parser fixed the
              # #132 heap blowup — a full boot now measures ~123Mi heap /
              # ~321Mi RSS (vs >500Mi heap before). With the heap ceiling at
              # NODE_OPTIONS=--max-old-space-size=512 (see configmap.yaml), 1Gi
              # gives ~3x the steady RSS for heap-ceiling growth + off-heap FTS5
              # + ephemeral request work, and hands the ~3.9Gi node ~1.5Gi back
              # vs the old 2.5Gi limit.
              memory: 1Gi
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
      volumes:
        # Data repo lives as a bare clone — ephemeral. Re-cloned from origin
        # on every pod boot; objects-only (~50 MB) so the clone is cheap.
        # Persisting across pod restarts buys nothing because the bare
        # clone is fully recoverable from the git remote.
        - name: data
          emptyDir: {}
        - name: private
          persistentVolumeClaim:
            claimName: codeforphilly-private
        - name: deploy-key
          secret:
            secretName: codeforphilly-data-deploy-key
            defaultMode: 0400