94 lines
2.7 KiB
YAML
94 lines
2.7 KiB
YAML
|
# Render placeholders before use. Apply the migration Job first, wait for completion,
|
||
|
|
# then apply this file. See docs/deployment.md for IAM, secrets and ingress.
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: meguri
|
||
|
|
annotations:
|
||
|
|
iam.gke.io/gcp-service-account: MEGURI_GSA@PROJECT_ID.iam.gserviceaccount.com
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: meguri-config
|
||
|
|
data:
|
||
|
|
MEGURI_BIND: 0.0.0.0:3000
|
||
|
|
MEGURI_PUBLIC_URL: https://meguri.example.internal
|
||
|
|
MEGURI_ROLE: all
|
||
|
|
MEGURI_SKIP_MIGRATIONS: "true"
|
||
|
|
MEGURI_ALLOW_SIGNUP: "false"
|
||
|
|
MEGURI_SEED_DEMO: "false"
|
||
|
|
RUST_LOG: meguri=info,cot=warn
|
||
|
|
---
|
||
|
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
name: meguri
|
||
|
|
spec:
|
||
|
|
replicas: 2
|
||
|
|
selector:
|
||
|
|
matchLabels: {app: meguri}
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels: {app: meguri}
|
||
|
|
spec:
|
||
|
|
serviceAccountName: meguri
|
||
|
|
terminationGracePeriodSeconds: 60
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
initContainers:
|
||
|
|
- name: cloud-sql-proxy
|
||
|
|
restartPolicy: Always
|
||
|
|
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
|
||
|
|
args: ["--private-ip", "--structured-logs", "--port=5432", "--health-check", "--http-address=0.0.0.0", "--http-port=9090", "PROJECT_ID:REGION:INSTANCE"]
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 100m, memory: 128Mi}
|
||
|
|
limits: {memory: 256Mi}
|
||
|
|
startupProbe:
|
||
|
|
httpGet: {path: /startup, port: 9090}
|
||
|
|
periodSeconds: 2
|
||
|
|
failureThreshold: 30
|
||
|
|
containers:
|
||
|
|
- name: meguri
|
||
|
|
image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
|
||
|
|
ports: [{name: http, containerPort: 3000}]
|
||
|
|
envFrom:
|
||
|
|
- configMapRef: {name: meguri-config}
|
||
|
|
- secretRef: {name: meguri-secrets}
|
||
|
|
securityContext:
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 250m, memory: 256Mi}
|
||
|
|
limits: {memory: 512Mi}
|
||
|
|
startupProbe:
|
||
|
|
httpGet: {path: /health/ready, port: http}
|
||
|
|
periodSeconds: 2
|
||
|
|
failureThreshold: 60
|
||
|
|
readinessProbe:
|
||
|
|
httpGet: {path: /health/ready, port: http}
|
||
|
|
livenessProbe:
|
||
|
|
httpGet: {path: /health/live, port: http}
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Service
|
||
|
|
metadata:
|
||
|
|
name: meguri
|
||
|
|
spec:
|
||
|
|
type: ClusterIP
|
||
|
|
selector: {app: meguri}
|
||
|
|
ports: [{port: 80, targetPort: http}]
|
||
|
|
---
|
||
|
|
apiVersion: policy/v1
|
||
|
|
kind: PodDisruptionBudget
|
||
|
|
metadata:
|
||
|
|
name: meguri
|
||
|
|
spec:
|
||
|
|
minAvailable: 1
|
||
|
|
selector:
|
||
|
|
matchLabels: {app: meguri}
|