4b934bb9fd
- 06-deployment-api.yaml: volumeMount /etc/repair-ssh + volumes secret defaultMode 0400 - 對應 K8s Secret: awoooi-repair-ssh-key Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
124 lines
3.3 KiB
YAML
124 lines
3.3 KiB
YAML
# AWOOOI Backend (FastAPI) Deployment
|
|
# 負責人: CIO
|
|
# 版本: v1.1
|
|
# 日期: 2026-03-20
|
|
# 更新: 2026-03-28 - 新增 startupProbe + revisionHistoryLimit:3 (Phase K0.5/K0.7)
|
|
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: awoooi-api
|
|
namespace: awoooi-prod
|
|
labels:
|
|
app: awoooi-api
|
|
system: awoooi
|
|
environment: prod
|
|
spec:
|
|
replicas: 2
|
|
revisionHistoryLimit: 3
|
|
selector:
|
|
matchLabels:
|
|
app: awoooi-api
|
|
environment: prod
|
|
system: awoooi
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: awoooi-api
|
|
system: awoooi
|
|
environment: prod
|
|
spec:
|
|
# Phase 7: 使用 RBAC ServiceAccount (最小權限)
|
|
serviceAccountName: awoooi-executor
|
|
automountServiceAccountToken: true
|
|
containers:
|
|
- name: api
|
|
# 映像標籤由 CI/CD 動態注入 (格式: {sha}-{run_id})
|
|
# Harbor 金庫: 110 主機 (192.168.0.110:5000)
|
|
image: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- containerPort: 8000
|
|
name: http
|
|
envFrom:
|
|
- configMapRef:
|
|
name: awoooi-config
|
|
- secretRef:
|
|
name: awoooi-secrets
|
|
# 2026-04-05 Claude Code: Sprint 3 — 掛載 SSH key 供 HostRepairAgent 使用
|
|
volumeMounts:
|
|
- name: repair-ssh-key
|
|
mountPath: /etc/repair-ssh
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: "200m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "1"
|
|
memory: "1Gi"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/v1/health
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/v1/health
|
|
port: 8000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
# Phase K0.5: Startup Probe (允許最多 60 秒啟動時間)
|
|
startupProbe:
|
|
httpGet:
|
|
path: /api/v1/health
|
|
port: 8000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 12
|
|
# 反親和性 - 分散到不同節點
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app: awoooi-api
|
|
topologyKey: kubernetes.io/hostname
|
|
# 2026-04-05 Claude Code: Sprint 3 — repair SSH key (defaultMode 0400)
|
|
volumes:
|
|
- name: repair-ssh-key
|
|
secret:
|
|
secretName: awoooi-repair-ssh-key
|
|
defaultMode: 0400
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: awoooi-api-svc
|
|
namespace: awoooi-prod
|
|
labels:
|
|
app: awoooi-api
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: awoooi-api
|
|
ports:
|
|
- port: 8000
|
|
targetPort: 8000
|
|
nodePort: 32334
|
|
name: http
|