deploy/server/deployment.yaml

Ref: main v0.0.5   Size: 2.4 KiB   History

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eitri-server
  namespace: ${NAMESPACE}
spec:
  replicas: 1
  strategy:
    type: Recreate            # sqlite + in-memory sync registry: single process
  selector:
    matchLabels: {app: eitri-server}
  template:
    metadata:
      labels: {app: eitri-server}
    spec:
      # The node is load-bearing twice over: the only one with a public IP
      # (sync/gate listeners below), and local-path binds the PVC to the node
      # the pod first lands on.
      nodeSelector:
        kubernetes.io/hostname: ${NODE_NAME}
      # hostNetwork: the QUIC sync socket and SSH gate bind the node's
      # interfaces directly. Both flows carry their own pinned cryptography
      # end-to-end and tolerate no middlebox — that includes the CNI's own
      # hostPort NAT, which conntrack-drops long-lived single-tuple UDP flows.
      # It also means these ports are the NODE's: two planes on one node need
      # two port triples, which is what the plane env files carry.
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      imagePullSecrets:
        - name: regcred
      securityContext:
        fsGroup: 65532        # distroless nonroot; PVC files must be writable
      containers:
        - name: eitri-server
          # By TAG, never by digest: a podman-pushed digest differs from the
          # registry's, and rolling by one has taken the fleet down overnight.
          image: ${SERVER_IMAGE}:${TAG}
          # Always: a re-cut release reuses its version tag, and the tag plus a
          # forced pull is the one rollout shape that never serves a stale image.
          imagePullPolicy: Always
          ports:
            - {name: http, containerPort: ${HTTP_PORT}}
            - {name: sync, containerPort: ${SYNC_PORT}, protocol: UDP}
            - {name: gate, containerPort: ${GATE_PORT}, protocol: TCP}
          volumeMounts:
            - {name: data, mountPath: /var/lib/eitri}
            - {name: config, mountPath: /etc/eitri, readOnly: true}
          livenessProbe:
            httpGet: {path: /livez, port: ${HTTP_PORT}}
            periodSeconds: 10
          readinessProbe:
            httpGet: {path: /readyz, port: ${HTTP_PORT}}
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim: {claimName: ${PVC_NAME}}
        - name: config
          secret:
            secretName: ${CONFIG_SECRET}
            defaultMode: 0400