tegwick
9fbcef7b05
Concrete, reviewable placement request per docs/SecurityPractice.md #7 (I1 Reinforced minimum: dedicated node pool/namespace, given internet reachability via the facade and sole custody of the bank credential). deploy/k8s/qonto-assistant/: modeled on llm-connect's real deployment (deploy/k8s/activity-core-llm-connect/) but tightened -- dedicated namespace (not shared), Deployment starts at replicas:0 (meant to be scaled 0<->1 by the facade, QONTO-WP-0004-T05), ClusterIP-only Service, NetworkPolicy default-deny with ingress limited to the facade and egress limited to DNS+443 (the FQDN-egress limitation is called out explicitly, not silently widened). Verified: `kubectl kustomize` renders all six resources cleanly. externalsecret.yaml depends on CCR-2026-0009 (new), proposed in railiance-platform: a workload-scoped Kubernetes-auth access lane into the existing tenants/binky/qonto-api credential, since CCR-2026-0008 is human/OIDC admin access only and unusable by a running pod. Mirrors CCR-2026-0003's llm-connect/ExternalSecretsOperator pattern. Paired draft ClusterSecretStore also added there. Both validated against schemas/credential-change-request.schema.yaml. Status: proposed, not approved -- explicitly not something this repo can complete alone. railiance/app.toml: staged-promotion contract (criticality=critical, mandatory human approval before Stage 2 traffic exposure and Stage 3 promotion, per railiance-cluster/docs/app-toml-contract.md's own rule for production-critical workloads). Validated against railiance-cluster/schemas/railiance-app.schema.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
69 lines
2 KiB
YAML
69 lines
2 KiB
YAML
# Starts at replicas: 0 -- this Deployment is meant to be scaled 0<->1 by
|
|
# the facade/activator (QONTO-WP-0004-T05, not yet built), never run
|
|
# continuously. Applying this manifest alone leaves the service correctly
|
|
# idle; something else (the facade, or manual `kubectl scale` for interim
|
|
# testing) must patch replicas to 1 to actually run it.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: qonto-assistant
|
|
namespace: qonto-assistant
|
|
labels:
|
|
app.kubernetes.io/name: qonto-assistant
|
|
app.kubernetes.io/part-of: qonto-assistant
|
|
spec:
|
|
replicas: 0
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: qonto-assistant
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: qonto-assistant
|
|
app.kubernetes.io/part-of: qonto-assistant
|
|
spec:
|
|
containers:
|
|
- name: qonto-assistant
|
|
image: docker.io/library/qonto-assistant:latest
|
|
imagePullPolicy: Never
|
|
envFrom:
|
|
- configMapRef:
|
|
name: qonto-assistant-config
|
|
- secretRef:
|
|
name: qonto-assistant-qonto-api
|
|
optional: false
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /v1/health
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /v1/health
|
|
port: http
|
|
periodSeconds: 30
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
securityContext:
|
|
fsGroup: 10001
|