feat(ops): define production Kubernetes resources

2026-08-29 05:51:40 +00:00
parent 3dc6fe2648
commit 954d886ff7
13 changed files with 396 additions and 0 deletions
@@ -0,0 +1,50 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: buzz-sheet-migrate
+  labels:
+    app.kubernetes.io/name: buzz-sheet
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 3
+  activeDeadlineSeconds: 600
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: buzz-sheet
+        app.kubernetes.io/component: migration
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migration
+          image: buzz-sheet-migrate
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: buzz-sheet-config
+            - secretRef:
+                name: buzz-sheet-env
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: temporary
+              mountPath: /tmp
+      volumes:
+        - name: temporary
+          emptyDir: {}
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: buzz-sheet
+resources:
+  - job.yaml
+images:
+  - name: buzz-sheet-migrate
+    newName: registry.neko-piranha.ts.net/astral/buzz-sheet
+    newTag: migrate-replace-me