rein-aharness/deploy/k8s/railiance/deployment.yaml
tegwick 20e6f381f6 feat(runtime): enforce governed mutation boundaries
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
2026-09-04 11:25:07 +02:00

56 lines
1.6 KiB
YAML

# Packaging-smoke placeholder only. The supported production runtime is the
# railiance01 user service; this Deployment never claims or executes work.
apiVersion: apps/v1
kind: Deployment
metadata:
name: rein-aharness
namespace: rein-aharness
labels:
app.kubernetes.io/name: rein-aharness
app.kubernetes.io/part-of: rein-aharness
app.kubernetes.io/component: packaging-smoke
rein-aharness.railiance.io/runtime-role: packaging-smoke
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: rein-aharness
template:
metadata:
labels:
app.kubernetes.io/name: rein-aharness
app.kubernetes.io/part-of: rein-aharness
app.kubernetes.io/component: packaging-smoke
rein-aharness.railiance.io/runtime-role: packaging-smoke
spec:
securityContext:
fsGroup: 10001
containers:
- name: rein-aharness
image: rein-aharness:railiance01
imagePullPolicy: Never
command: ["sleep", "infinity"]
envFrom:
- configMapRef:
name: rein-aharness-config
resources:
requests:
cpu: 25m
memory: 64Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: tmp
emptyDir: {}