Init

deploy/gke.yaml

@@ -0,0 +1,94 @@
+# Render placeholders before use. Apply the migration Job first, wait for completion,
+# then apply this file. See docs/deployment.md for IAM, secrets and ingress.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: meguri
+  annotations:
+    iam.gke.io/gcp-service-account: MEGURI_GSA@PROJECT_ID.iam.gserviceaccount.com
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: meguri-config
+data:
+  MEGURI_BIND: 0.0.0.0:3000
+  MEGURI_PUBLIC_URL: https://meguri.example.internal
+  MEGURI_ROLE: all
+  MEGURI_SKIP_MIGRATIONS: "true"
+  MEGURI_ALLOW_SIGNUP: "false"
+  MEGURI_SEED_DEMO: "false"
+  RUST_LOG: meguri=info,cot=warn
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: meguri
+spec:
+  replicas: 2
+  selector:
+    matchLabels: {app: meguri}
+  template:
+    metadata:
+      labels: {app: meguri}
+    spec:
+      serviceAccountName: meguri
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile: {type: RuntimeDefault}
+      initContainers:
+        - name: cloud-sql-proxy
+          restartPolicy: Always
+          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
+          args: ["--private-ip", "--structured-logs", "--port=5432", "--health-check", "--http-address=0.0.0.0", "--http-port=9090", "PROJECT_ID:REGION:INSTANCE"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+            limits: {memory: 256Mi}
+          startupProbe:
+            httpGet: {path: /startup, port: 9090}
+            periodSeconds: 2
+            failureThreshold: 30
+      containers:
+        - name: meguri
+          image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
+          ports: [{name: http, containerPort: 3000}]
+          envFrom:
+            - configMapRef: {name: meguri-config}
+            - secretRef: {name: meguri-secrets}
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          resources:
+            requests: {cpu: 250m, memory: 256Mi}
+            limits: {memory: 512Mi}
+          startupProbe:
+            httpGet: {path: /health/ready, port: http}
+            periodSeconds: 2
+            failureThreshold: 60
+          readinessProbe:
+            httpGet: {path: /health/ready, port: http}
+          livenessProbe:
+            httpGet: {path: /health/live, port: http}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: meguri
+spec:
+  type: ClusterIP
+  selector: {app: meguri}
+  ports: [{port: 80, targetPort: http}]
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: meguri
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: meguri}

deploy/migrate.yaml

@@ -0,0 +1,46 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: meguri-migrate-RELEASE
+spec:
+  backoffLimit: 0
+  activeDeadlineSeconds: 300
+  ttlSecondsAfterFinished: 86400
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: meguri
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile: {type: RuntimeDefault}
+      initContainers:
+        - name: cloud-sql-proxy
+          restartPolicy: Always
+          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
+          args: ["--private-ip", "--structured-logs", "--port=5432", "--health-check", "--http-address=0.0.0.0", "--http-port=9090", "PROJECT_ID:REGION:INSTANCE"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+            limits: {memory: 256Mi}
+          startupProbe:
+            httpGet: {path: /startup, port: 9090}
+            periodSeconds: 2
+            failureThreshold: 30
+      containers:
+        - name: migrate
+          image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
+          envFrom:
+            - configMapRef: {name: meguri-config}
+            - secretRef: {name: meguri-secrets}
+          env:
+            - {name: MEGURI_ROLE, value: migrate}
+            - {name: MEGURI_SKIP_MIGRATIONS, value: "false"}
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          resources:
+            requests: {cpu: 250m, memory: 128Mi}
+            limits: {memory: 256Mi}