129 lines
3.9 KiB
YAML
129 lines
3.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: app-deployment
|
|
labels:
|
|
app: medusa
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app: medusa
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: medusa
|
|
spec:
|
|
# runAsNonRoot solo no alcanza si el USER de la imagen es un
|
|
# nombre, no un UID -- confirmado en vivo migrando frontend
|
|
# (mismo problema exacto, error real: "cannot verify user is
|
|
# non-root"). Acá el Dockerfile usa el usuario "node" que ya trae
|
|
# la imagen base node:22.18.0-bookworm-slim -- confirmado con
|
|
# `docker run ... id node` antes de asumir el UID: 1000.
|
|
securityContext:
|
|
runAsUser: 1000
|
|
# Workaround del blackhole MTU/PMTUD cross-node (ver
|
|
# docs/known-issues.md en apps-registry) -- ya no es
|
|
# estrictamente necesario (el fix real de fondo se aplicó
|
|
# 2026-08-16), pero se deja como red de contención a propósito.
|
|
# No es un campo del base -- se agrega entero acá, es aditivo,
|
|
# no pisa nada.
|
|
affinity:
|
|
podAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: commerce-postgres
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
initContainers:
|
|
- name: wait-for-postgres
|
|
image: postgres:17-alpine
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
until pg_isready -h postgres-svc -p 5432 -U "$POSTGRES_USER" -d "$POSTGRES_DB" -t 5; do
|
|
echo "postgres no disponible aun, reintentando..."
|
|
sleep 2
|
|
done
|
|
envFrom:
|
|
- secretRef:
|
|
name: commerce-secrets
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
|
|
- name: migrations
|
|
image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.295
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- node
|
|
- node_modules/@medusajs/cli/dist/index.js
|
|
- db:migrate
|
|
envFrom:
|
|
- configMapRef:
|
|
name: commerce-config
|
|
- secretRef:
|
|
name: commerce-secrets
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 768Mi
|
|
|
|
containers:
|
|
- name: app
|
|
image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.295
|
|
imagePullPolicy: IfNotPresent
|
|
envFrom:
|
|
- configMapRef:
|
|
name: commerce-config
|
|
- secretRef:
|
|
name: commerce-secrets
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 18
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 20
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
# Puerto 9000, no privilegiado -- a diferencia de
|
|
# frontend/docs-portal, acá el drop: ALL del base no
|
|
# necesita ningún add de vuelta. Medusa ya corre como
|
|
# usuario "node" no-root (ver Dockerfile de commerce-backend).
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 150m
|
|
memory: 384Mi
|
|
limits:
|
|
cpu: 750m
|
|
memory: 1Gi
|