dibs/deploy/deployment.yaml at main · hivecommons/dibs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dibs
  namespace: dibs
  labels:
    app: dibs
spec:
  # Single replica; the RWX volume lets the replacement pod start
  # before the old one stops, so rollouts serve traffic throughout.
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: dibs
  template:
    metadata:
      labels:
        app: dibs
    spec:
      # Must stay above shutdownTimeout (20s, cmd/dibs/main.go) so SIGTERM
      # drains in-flight requests before the kubelet sends SIGKILL.
      terminationGracePeriodSeconds: 30
      # Dibs never calls the Kubernetes API (hub, GitHub and the LLM gateway
      # are all plain HTTP), so the pod has no use for a service-account
      # token; leaving one mounted only hands it to anyone who finds a hole
      # in the public HTTP surface.
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: dibs
          # Pin to a commit sha in production; latest tracks main.
          image: ghcr.io/hivecommons/dibs:latest
          ports:
            - name: http
              containerPort: 8080
            - name: metrics
              containerPort: 9090
          envFrom:
            - configMapRef:
                name: dibs-config
            - secretRef:
                name: dibs-secrets
                optional: true
          volumeMounts:
            - name: data
              mountPath: /data
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 2
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              memory: 256Mi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: dibs-data-rwx