72 lines
1.8 KiB
YAML
72 lines
1.8 KiB
YAML
|
image:
|
||
|
|
repository: gitea.coulomb.social/coulomb/vergabe-teilnahme
|
||
|
|
tag: "" # required; pinned via helm/vergabe-teilnahme-values.yaml
|
||
|
|
pullPolicy: IfNotPresent
|
||
|
|
|
||
|
|
replicaCount: 1 # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
|
||
|
|
|
||
|
|
service:
|
||
|
|
type: ClusterIP
|
||
|
|
port: 80
|
||
|
|
targetPort: 8000
|
||
|
|
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 256Mi
|
||
|
|
limits:
|
||
|
|
cpu: 1000m
|
||
|
|
memory: 1Gi
|
||
|
|
|
||
|
|
# Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
|
||
|
|
# Holds SECRET_KEY + DATABASE_URL. Created by the operator with kubectl
|
||
|
|
# create secret generic vergabe-teilnahme-env --from-literal=...
|
||
|
|
envSecretName: vergabe-teilnahme-env
|
||
|
|
|
||
|
|
# Non-secret env injected directly into the Deployment.
|
||
|
|
env:
|
||
|
|
DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
|
||
|
|
ALLOWED_HOSTS: vergabe-teilnahme.whywhynot.de,localhost
|
||
|
|
CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.whywhynot.de
|
||
|
|
|
||
|
|
probes:
|
||
|
|
enabled: true
|
||
|
|
path: /health/
|
||
|
|
port: 8000
|
||
|
|
hostHeader: vergabe-teilnahme.whywhynot.de # must be in ALLOWED_HOSTS
|
||
|
|
liveness:
|
||
|
|
initialDelaySeconds: 30
|
||
|
|
periodSeconds: 30
|
||
|
|
timeoutSeconds: 5
|
||
|
|
failureThreshold: 3
|
||
|
|
readiness:
|
||
|
|
initialDelaySeconds: 5
|
||
|
|
periodSeconds: 10
|
||
|
|
timeoutSeconds: 5
|
||
|
|
failureThreshold: 3
|
||
|
|
|
||
|
|
# PVC for media uploads is deferred — Django MEDIA is in-pod ephemeral
|
||
|
|
# for v1. Switch to true + a storageClass once media uploads land.
|
||
|
|
persistence:
|
||
|
|
media:
|
||
|
|
enabled: false
|
||
|
|
storageClass: local-path
|
||
|
|
size: 5Gi
|
||
|
|
accessMode: ReadWriteOnce
|
||
|
|
|
||
|
|
podSecurityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 999 # matches the 'app' user in the Dockerfile
|
||
|
|
runAsGroup: 999
|
||
|
|
fsGroup: 999
|
||
|
|
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
readOnlyRootFilesystem: false # whitenoise + collectstatic write to /app
|
||
|
|
capabilities:
|
||
|
|
drop: ["ALL"]
|
||
|
|
|
||
|
|
nodeSelector: {}
|
||
|
|
tolerations: []
|
||
|
|
affinity: {}
|