beer_data/kube/beer_namespace.yaml at ab3050194d9787e28e0a0a6bea4318c07366db1f - beer_data - aridgway git

armistace/beer_data

Files

T

hermes 55c5de9d61 feat(deploy): add the kubernetes manifests so the deployment is in the repo

The cluster objects for the beer namespace were created by hand. This puts
them in the repo so they can be applied and reviewed like everything else.

- `beer-deployment.yaml` — the Deployment, with the security context, the
  resource limits, and both probes wired up (`/healthz` liveness,
  `/readyz` readiness).
- `beer-service.yaml` — the NodePort service.
- `beer_namespace.yaml` — the namespace.

The credentials are NOT in these files. `MONGO_PASS` and `SECRET_KEY` come
from the live `beer-db` and `beer-app` Secrets, so applying the manifests
cannot clobber a hand-provisioned credential.

Notes on the pod security context
---------------------------------
`runAsNonRoot: true` cannot be set on the container when the image's user is
a *named* user - kubelet can only verify a numeric UID. The pod-level
security context therefore sets `runAsUser: 999`, which matches the `beer`
user the image creates (verified with `id` in the built image).

The container also drops all capabilities and refuses privilege escalation.

2026-11-09 11:45:41 +10:00

7 lines

83 B

YAML

Raw Blame History

 apiVersion: v1
 kind: Namespace
 metadata:
   name: beer
   labels:
     app: beer-data