feat(catalog) : sync Lunaris updates from Discord

k8s/base/ci-rbac.yaml

@@ -26,7 +26,7 @@ rules:
     verbs: ["get"]
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    resourceNames: ["buzz-sheet", "buzz-sheet-worker"]
+    resourceNames: ["buzz-sheet", "buzz-sheet-worker", "buzz-sheet-discord-worker"]
     verbs: ["get", "watch", "patch", "update"]
   - apiGroups: ["apps"]
     resources: ["replicasets"]

k8s/base/discord-worker-deployment.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buzz-sheet-discord-worker
+  labels:
+    app.kubernetes.io/name: buzz-sheet
+    app.kubernetes.io/component: discord-worker
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: buzz-sheet
+      app.kubernetes.io/component: discord-worker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: buzz-sheet
+        app.kubernetes.io/component: discord-worker
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 60
+      nodeSelector:
+        kubernetes.io/arch: arm64
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: discord-worker
+          image: buzz-sheet-app
+          imagePullPolicy: IfNotPresent
+          command: ["bun", "worker/discord.js"]
+          envFrom:
+            - configMapRef:
+                name: buzz-sheet-config
+            - secretRef:
+                name: buzz-sheet-env
+          env:
+            - name: NEXT_DEPLOYMENT_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: buzz-sheet-config
+                  key: NEXT_DEPLOYMENT_ID
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: temporary
+              mountPath: /tmp
+      volumes:
+        - name: temporary
+          emptyDir: {}

k8s/base/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - configmap.yaml
   - deployment.yaml
   - worker-deployment.yaml
+  - discord-worker-deployment.yaml
   - service.yaml
   - ingress.yaml
   - hpa.yaml