# KCA — Kubernetes deployment sketch (namespace: kca).
#
# Replace every REPLACE_ME. Postgres and the OIDC provider are external; Redis
# is included because sessions are disposable. KCA_MASTER_KEY is the AES key
# protecting private keys at rest: generate it once and never lose it.
#
#   kubectl apply -f deploy/k8s/kca.yaml
#   kubectl port-forward -n kca svc/kca 8080:80
---
apiVersion: v1
kind: Namespace
metadata:
  name: kca
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kca-config
  namespace: kca
data:
  REDIS_URL: redis://redis.kca.svc.cluster.local:6379/0
  DATABASE_ENGINE: postgres
  DATABASE_HOST: REPLACE_ME
  DATABASE_PORT: "5432"
  DATABASE_NAME: kca
  DATABASE_USER: kca
  STATIC_DIR: /app/web/dist
  OIDC_0_PROVIDER: default
  OIDC_0_CLIENT_ID: kca
  OIDC_0_ISSUER: REPLACE_ME
  OIDC_0_REDIRECT_URI: REPLACE_ME
  OIDC_0_POST_LOGIN_REDIRECT: /
  OIDC_0_POST_LOGOUT_REDIRECT: /
---
apiVersion: v1
kind: Secret
metadata:
  name: kca-secrets
  namespace: kca
type: Opaque
stringData:
  DATABASE_PASSWORD: REPLACE_ME
  OIDC_0_CLIENT_SECRET: REPLACE_ME
  # openssl rand -base64 32
  KCA_MASTER_KEY: REPLACE_ME
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: kca
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kca-redis
  template:
    metadata:
      labels:
        app: kca-redis
    spec:
      containers:
        - name: redis
          image: redis:8-alpine
          ports:
            - containerPort: 6379
          resources:
            requests: {cpu: 10m, memory: 32Mi}
            limits: {memory: 128Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: kca
spec:
  selector:
    app: kca-redis
  ports:
    - port: 6379
      targetPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kca
  namespace: kca
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kca
  template:
    metadata:
      labels:
        app: kca
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
        - name: kca
          image: gitea.woggioni.net/woggioni/kca:latest
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: kca-config
            - secretRef:
                name: kca-secrets
          readinessProbe:
            httpGet:
              path: /api/health
              port: 8080
          livenessProbe:
            httpGet:
              path: /api/health
              port: 8080
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {memory: 512Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: kca
  namespace: kca
spec:
  selector:
    app: kca
  ports:
    - port: 80
      targetPort: 8080