feat: add Go workload deployment artifacts and split Ingress routing
This commit is contained in:
zn-admin committed
1 parent
ca019abb14
commit
4a8f2d56e2
13 files changed
+452
-26
No files matched your search
@@ -0,0 +1,207 @@
|
||||
# Go API workload: owns /api, /uploads, and /generated-results from the first
|
||||
# production deployment. The embedded WorkerLoop replaces the Node Worker; do
|
||||
# not deploy zhinian-worker in production.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: zhinian-go-api
|
||||
namespace: zhinian
|
||||
spec:
|
||||
# Keep one replica until generated assets live in shared OSS storage and the
|
||||
# RDS/provider connection budget is measured for more.
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: zhinian
|
||||
app.kubernetes.io/component: go-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: zhinian
|
||||
app.kubernetes.io/component: go-api
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: go-api
|
||||
image: REGISTRY/PROJECT/zhinian-go-api:REPLACE_TAG
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: zhinian-go-runtime
|
||||
env:
|
||||
- name: DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-db
|
||||
key: DATABASE_URL
|
||||
# The session secret must be the same value Next.js uses so the
|
||||
# frontend middleware and the Go backend verify the same cookies.
|
||||
- name: ZHINIAN_AUTH_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-web-auth
|
||||
key: ZHINIAN_AUTH_SESSION_SECRET
|
||||
- name: ZHINIAN_BOOTSTRAP_ADMIN_PHONE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-bootstrap
|
||||
key: ZHINIAN_BOOTSTRAP_ADMIN_PHONE
|
||||
- name: ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-bootstrap
|
||||
key: ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD
|
||||
- name: ZHINIAN_BOOTSTRAP_ADMIN_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-bootstrap
|
||||
key: ZHINIAN_BOOTSTRAP_ADMIN_NAME
|
||||
optional: true
|
||||
- name: VOLCENGINE_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: VOLCENGINE_ACCESS_KEY_ID
|
||||
optional: true
|
||||
- name: VOLCENGINE_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: VOLCENGINE_SECRET_ACCESS_KEY
|
||||
optional: true
|
||||
- name: JIMENG_IMAGE_GENERATE_46_REQ_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: JIMENG_IMAGE_GENERATE_46_REQ_KEY
|
||||
optional: true
|
||||
- name: EVOLINK_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: EVOLINK_API_KEY
|
||||
optional: true
|
||||
- name: SEEDANCE_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: SEEDANCE_API_KEY
|
||||
optional: true
|
||||
- name: BAILIAN_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: BAILIAN_API_KEY
|
||||
optional: true
|
||||
- name: DASHSCOPE_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: DASHSCOPE_API_KEY
|
||||
optional: true
|
||||
- name: ALI_OSS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: ALI_OSS_ACCESS_KEY_ID
|
||||
optional: true
|
||||
- name: ALI_OSS_ACCESS_KEY_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-providers
|
||||
key: ALI_OSS_ACCESS_KEY_SECRET
|
||||
optional: true
|
||||
- name: ZHINIAN_WEBHOOK_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-secrets
|
||||
key: ZHINIAN_WEBHOOK_SECRET
|
||||
- name: ZHINIAN_API_KEYS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-secrets
|
||||
key: ZHINIAN_API_KEYS
|
||||
optional: true
|
||||
- name: ZHINIAN_INTERNAL_WORKER_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zhinian-go-secrets
|
||||
key: ZHINIAN_INTERNAL_WORKER_TOKEN
|
||||
optional: true
|
||||
volumeMounts:
|
||||
- name: rds-ca
|
||||
mountPath: /etc/zhinian/rds
|
||||
readOnly: true
|
||||
- name: data
|
||||
mountPath: /var/lib/zhinian
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
failureThreshold: 24
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/ready
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: http
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
readOnlyRootFilesystem: true
|
||||
volumes:
|
||||
- name: rds-ca
|
||||
secret:
|
||||
secretName: zhinian-rds-ca
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zhinian-go-api
|
||||
namespace: zhinian
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: zhinian
|
||||
app.kubernetes.io/component: go-api
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
Reference in new issue
Block a user