initial commit

charts/api/templates/deployment.yaml

@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "go-places.fullname" . }}
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  {{- if .Values.persistence.enabled }}
+  # Recreate, not RollingUpdate: the volume is ReadWriteOnce and SQLite allows a
+  # single writer, so the old pod must be gone before the new one mounts the
+  # claim and opens the database.
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "go-places.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "go-places.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        # The image runs as uid 10001. fsGroup makes the mounted volume group
+        # writable by that user, which is what allows the non-root process to
+        # create the database file and the media directory.
+        {{- if .Values.persistence.enabled }}
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            # These names must match the variables read by
+            # internal/config.Load(). Unrecognised names are ignored, so a typo
+            # here would silently leave the service on its defaults.
+            - name: ADDR
+              value: ":8080"
+            - name: DATABASE_URL
+              value: {{ .Values.apiConfig.databaseURL | quote }}
+            - name: MEDIA_DIR
+              value: {{ .Values.apiConfig.mediaDir | quote }}
+            - name: PUBLIC_BASE_URL
+              value: {{ .Values.apiConfig.publicBaseURL | quote }}
+            # "jwt" verifies the HS256 tokens go-loose issues. The secret is
+            # referenced rather than inlined so it can come from a Secret.
+            - name: AUTH_MODE
+              value: {{ .Values.apiConfig.authMode | quote }}
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.apiConfig.jwtSecretName | quote }}
+                  key: {{ .Values.apiConfig.jwtSecretKey | quote }}
+                  optional: true
+            - name: JWT_AUDIENCE
+              value: {{ .Values.apiConfig.jwtAudience | quote }}
+            - name: ANALYZER_MODE
+              value: {{ .Values.apiConfig.analyzerMode | quote }}
+            - name: ANALYZER_URL
+              value: {{ .Values.apiConfig.analyzerUrl | quote }}
+            - name: LOG_FORMAT
+              value: {{ .Values.apiConfig.logFormat | quote }}
+            {{- if .Values.apiConfig.amqpUrl }}
+            # Event publishing is off unless a broker URL is given; without it
+            # the service logs events instead.
+            - name: AMQP_URL
+              value: {{ .Values.apiConfig.amqpUrl | quote }}
+            {{- end }}
+            - name: EVENTS_EXCHANGE
+              value: {{ .Values.apiConfig.eventsExchange | quote }}
+          {{- with .Values.probes.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.probes.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath | quote }}
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "go-places.fullname" .)) }}
+          {{- else }}
+          # Without persistence the service still runs, but the database and every
+          # uploaded picture are lost whenever the pod is replaced.
+          emptyDir: {}
+          {{- end }}