From dcc5bb2d57090e0955fa6e59f5f7eb500ce8be44 Mon Sep 17 00:00:00 2001 From: Cristian Felipe Cruz Buitron Date: Mon, 17 Aug 2026 00:28:32 -0500 Subject: [PATCH] refactor(docs-portal): migrar a base+overlay de platform-templates Reemplaza los manifiestos sueltos (deployment/service/ingress) por un overlay de Kustomize sobre el base remoto de platform-templates. Agrega readinessProbe/livenessProbe (no tenia ninguna) y securityContext (ajustado: runAsNonRoot=false + NET_BIND_SERVICE, porque la imagen actual de docs-portal corre como root en el puerto 80 -- se resuelve del todo cuando docs-portal adopte dockerfiles/static-nginx.Dockerfile de platform-templates, cambio de imagen aparte). Validado con kubectl kustomize contra el manifiesto real desplegado antes de aplicar. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011FqYP3Wf1W63Qmh7qgXAAT --- workloads/docs-portal/deployment.yaml | 28 ----------- workloads/docs-portal/ingress.yaml | 19 ------- workloads/docs-portal/kustomization.yaml | 47 ++++++++++++++++-- workloads/docs-portal/patches/deployment.yaml | 49 +++++++++++++++++++ workloads/docs-portal/patches/ingress.yaml | 16 ++++++ .../docs-portal/{ => patches}/service.yaml | 4 +- 6 files changed, 111 insertions(+), 52 deletions(-) delete mode 100644 workloads/docs-portal/deployment.yaml delete mode 100644 workloads/docs-portal/ingress.yaml create mode 100644 workloads/docs-portal/patches/deployment.yaml create mode 100644 workloads/docs-portal/patches/ingress.yaml rename workloads/docs-portal/{ => patches}/service.yaml (73%) diff --git a/workloads/docs-portal/deployment.yaml b/workloads/docs-portal/deployment.yaml deleted file mode 100644 index 4e801be..0000000 --- a/workloads/docs-portal/deployment.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: docs-portal-deployment -spec: - replicas: 1 - selector: - matchLabels: - app: docs-portal - template: - metadata: - labels: - app: docs-portal - spec: - imagePullSecrets: - - name: gitea-registry-secret - containers: - - name: docs-portal - image: gitea.cruzcloud.net/devops/docs-portal:v1.0.116 - ports: - - containerPort: 80 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - cpu: 200m - memory: 128Mi diff --git a/workloads/docs-portal/ingress.yaml b/workloads/docs-portal/ingress.yaml deleted file mode 100644 index eef7892..0000000 --- a/workloads/docs-portal/ingress.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: docs-portal-ingress - annotations: - traefik.ingress.kubernetes.io/router.entrypoints: web -spec: - ingressClassName: traefik - rules: - - host: docs.cruzcloud.net - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: docs-portal-svc - port: - number: 80 diff --git a/workloads/docs-portal/kustomization.yaml b/workloads/docs-portal/kustomization.yaml index b2a633d..659a7a5 100644 --- a/workloads/docs-portal/kustomization.yaml +++ b/workloads/docs-portal/kustomization.yaml @@ -1,7 +1,48 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization + namespace: docs-portal + resources: - - deployment.yaml - - service.yaml - - ingress.yaml + - https://gitea.cruzcloud.net/devops/platform-templates.git//k8s-manifests/base?ref=main + +patches: + - target: + kind: Deployment + name: app-deployment + path: patches/deployment.yaml + - target: + kind: Service + name: app-svc + path: patches/service.yaml + - target: + kind: Ingress + name: app-ingress + path: patches/ingress.yaml + + - target: + kind: Deployment + name: app-deployment + patch: |- + - op: replace + path: /metadata/name + value: docs-portal-deployment + - op: replace + path: /spec/template/spec/containers/0/ports + value: + - name: http + containerPort: 80 + - target: + kind: Service + name: app-svc + patch: |- + - op: replace + path: /metadata/name + value: docs-portal-svc + - target: + kind: Ingress + name: app-ingress + patch: |- + - op: replace + path: /metadata/name + value: docs-portal-ingress diff --git a/workloads/docs-portal/patches/deployment.yaml b/workloads/docs-portal/patches/deployment.yaml new file mode 100644 index 0000000..3565ab4 --- /dev/null +++ b/workloads/docs-portal/patches/deployment.yaml @@ -0,0 +1,49 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: app-deployment + labels: + app: docs-portal +spec: + replicas: 1 + selector: + matchLabels: + app: docs-portal + template: + metadata: + labels: + app: docs-portal + spec: + # El base fuerza runAsNonRoot: true a nivel pod. La imagen ACTUAL + # de docs-portal (nginx:1.27-alpine, sin USER) corre como root -- + # aplicar el default del base tal cual rompe el pod + # (CreateContainerConfigError). Override explícito acá hasta que + # docs-portal adopte dockerfiles/static-nginx.Dockerfile + # (nginx-unprivileged, no-root) como cambio de imagen aparte -- + # no es parte de esta migración de manifiestos. + securityContext: + runAsNonRoot: false + containers: + - name: app + image: gitea.cruzcloud.net/devops/docs-portal:v1.0.116 + # El base saca TODAS las capabilities. Corriendo como root en + # el puerto 80 (privilegiado), eso rompe el bind() -- incluso + # root necesita CAP_NET_BIND_SERVICE si se le sacan las demás. + # Mismo motivo que el runAsNonRoot de arriba: se resuelve del + # todo cuando docs-portal pase a nginx-unprivileged (puerto + # 8080, no privilegiado, no necesita esta capability). + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 200m + memory: 128Mi diff --git a/workloads/docs-portal/patches/ingress.yaml b/workloads/docs-portal/patches/ingress.yaml new file mode 100644 index 0000000..50e5406 --- /dev/null +++ b/workloads/docs-portal/patches/ingress.yaml @@ -0,0 +1,16 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: app-ingress +spec: + rules: + - host: docs.cruzcloud.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: docs-portal-svc + port: + number: 80 diff --git a/workloads/docs-portal/service.yaml b/workloads/docs-portal/patches/service.yaml similarity index 73% rename from workloads/docs-portal/service.yaml rename to workloads/docs-portal/patches/service.yaml index 884eff1..2aeb77b 100644 --- a/workloads/docs-portal/service.yaml +++ b/workloads/docs-portal/patches/service.yaml @@ -1,11 +1,11 @@ apiVersion: v1 kind: Service metadata: - name: docs-portal-svc + name: app-svc spec: selector: app: docs-portal ports: - - protocol: TCP + - name: http port: 80 targetPort: 80