From 8c79a045fd03de9c20cd2302d04c96ab78ce4cec Mon Sep 17 00:00:00 2001 From: Cristian Felipe Cruz Buitron Date: Mon, 17 Aug 2026 00:52:15 -0500 Subject: [PATCH] refactor(medusa): migrar a base+overlay de platform-templates Reemplaza medusa.yaml (Deployment+Service en un solo archivo) por un overlay de Kustomize sobre el base remoto de platform-templates (workloads/ecommerce/commerce/medusa/). Agrega securityContext, incluyendo runAsUser: 1000 explicito desde el arranque (confirmado con 'docker run ... id node' contra la imagen real antes de asumir el UID -- ya se aprendio en la migracion de frontend que runAsNonRoot solo no alcanza si el USER de la imagen es un nombre). El podAffinity del workaround de MTU/PMTUD y los 2 initContainers (wait-for-postgres, migrations) se preservan igual, son campos aditivos que no forman parte del base. El Ingress generico del base se excluye via $patch:delete -- medusa no tiene Ingress propio, comparte commerce-ingress. Validado con kubectl kustomize contra el arbol completo de workloads/ecommerce antes de aplicar. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011FqYP3Wf1W63Qmh7qgXAAT --- .../ecommerce/commerce/kustomization.yaml | 2 +- .../commerce/medusa/kustomization.yaml | 62 +++++++++++++++++++ .../patches/deployment.yaml} | 52 +++++++++------- .../commerce/medusa/patches/service.yaml | 11 ++++ 4 files changed, 102 insertions(+), 25 deletions(-) create mode 100644 workloads/ecommerce/commerce/medusa/kustomization.yaml rename workloads/ecommerce/commerce/{medusa.yaml => medusa/patches/deployment.yaml} (67%) create mode 100644 workloads/ecommerce/commerce/medusa/patches/service.yaml diff --git a/workloads/ecommerce/commerce/kustomization.yaml b/workloads/ecommerce/commerce/kustomization.yaml index b607179..3ff2459 100644 --- a/workloads/ecommerce/commerce/kustomization.yaml +++ b/workloads/ecommerce/commerce/kustomization.yaml @@ -7,5 +7,5 @@ resources: - redis.yaml - minio.yaml - minio-bootstrap-job.yaml - - medusa.yaml + - medusa/ - ingress-commerce.yaml diff --git a/workloads/ecommerce/commerce/medusa/kustomization.yaml b/workloads/ecommerce/commerce/medusa/kustomization.yaml new file mode 100644 index 0000000..3fd3017 --- /dev/null +++ b/workloads/ecommerce/commerce/medusa/kustomization.yaml @@ -0,0 +1,62 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: ecommerce + +# Solo Deployment + Service -- el Ingress de commerce vive en +# ingress-commerce.yaml dentro de workloads/ecommerce/commerce/, +# separado de este Deployment/Service, no le toca al overlay. +resources: + - https://gitea.cruzcloud.net/devops/platform-templates.git//k8s-manifests/base?ref=main + +patches: + # medusa no tiene Ingress propio (el commerce-ingress vive aparte, + # en workloads/ecommerce/commerce/ingress-commerce.yaml) -- mismo + # patrón que frontend, borrar el Ingress genérico del base. + - target: + kind: Ingress + name: app-ingress + patch: |- + $patch: delete + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: app-ingress + + - target: + kind: Deployment + name: app-deployment + path: patches/deployment.yaml + - target: + kind: Service + name: app-svc + path: patches/service.yaml + + - target: + kind: Deployment + name: app-deployment + patch: |- + - op: replace + path: /metadata/name + value: medusa-deploy + - op: replace + path: /spec/template/spec/containers/0/ports + value: + - name: http + containerPort: 9000 + - target: + kind: Service + name: app-svc + patch: |- + - op: replace + path: /metadata/name + value: medusa-svc + # Mismo motivo que el ports de la Deployment: el puerto de Medusa + # (9000) no coincide con el default del base (80), así que un + # patch de merge normal duplica en vez de reemplazar. + - op: replace + path: /spec/ports + value: + - name: http + port: 9000 + targetPort: 9000 diff --git a/workloads/ecommerce/commerce/medusa.yaml b/workloads/ecommerce/commerce/medusa/patches/deployment.yaml similarity index 67% rename from workloads/ecommerce/commerce/medusa.yaml rename to workloads/ecommerce/commerce/medusa/patches/deployment.yaml index 628060b..223c3f7 100644 --- a/workloads/ecommerce/commerce/medusa.yaml +++ b/workloads/ecommerce/commerce/medusa/patches/deployment.yaml @@ -1,7 +1,9 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: medusa-deploy + name: app-deployment + labels: + app: medusa spec: replicas: 1 strategy: @@ -17,9 +19,20 @@ spec: labels: app: medusa spec: - imagePullSecrets: - - name: gitea-registry-secret - + # runAsNonRoot solo no alcanza si el USER de la imagen es un + # nombre, no un UID -- confirmado en vivo migrando frontend + # (mismo problema exacto, error real: "cannot verify user is + # non-root"). Acá el Dockerfile usa el usuario "node" que ya trae + # la imagen base node:22.18.0-bookworm-slim -- confirmado con + # `docker run ... id node` antes de asumir el UID: 1000. + securityContext: + runAsUser: 1000 + # Workaround del blackhole MTU/PMTUD cross-node (ver + # docs/known-issues.md en apps-registry) -- ya no es + # estrictamente necesario (el fix real de fondo se aplicó + # 2026-08-16), pero se deja como red de contención a propósito. + # No es un campo del base -- se agrega entero acá, es aditivo, + # no pisa nada. affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: @@ -54,10 +67,6 @@ spec: - name: migrations image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.112 imagePullPolicy: IfNotPresent - # node directo, sin npx: la imagen ya no trae npm (ver - # Dockerfile de commerce-backend, remediacion de - # CVE-2026-59873) -- mismo binario que ya invoca el CMD de - # runtime de esa misma imagen. command: - node - node_modules/@medusajs/cli/dist/index.js @@ -76,7 +85,7 @@ spec: memory: 768Mi containers: - - name: medusa + - name: app image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.112 imagePullPolicy: IfNotPresent envFrom: @@ -84,9 +93,6 @@ spec: name: commerce-config - secretRef: name: commerce-secrets - ports: - - name: http - containerPort: 9000 readinessProbe: httpGet: path: /health @@ -103,6 +109,16 @@ spec: periodSeconds: 20 timeoutSeconds: 5 failureThreshold: 6 + # Puerto 9000, no privilegiado -- a diferencia de + # frontend/docs-portal, acá el drop: ALL del base no + # necesita ningún add de vuelta. Medusa ya corre como + # usuario "node" no-root (ver Dockerfile de commerce-backend). + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL resources: requests: cpu: 150m @@ -110,15 +126,3 @@ spec: limits: cpu: 750m memory: 1Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: medusa-svc -spec: - selector: - app: medusa - ports: - - name: http - port: 9000 - targetPort: 9000 diff --git a/workloads/ecommerce/commerce/medusa/patches/service.yaml b/workloads/ecommerce/commerce/medusa/patches/service.yaml new file mode 100644 index 0000000..19f6bb9 --- /dev/null +++ b/workloads/ecommerce/commerce/medusa/patches/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: app-svc +spec: + selector: + app: medusa + ports: + - name: http + port: 9000 + targetPort: 9000