Setting the file. One moment. 19
Workflow Orchestration Patterns
57
Nx Workspace Patterns
Trace To Training Data
Web Component Design
assets/deployment-template.yaml
assets/deployment-template.yaml
YAML·203 lines·5 KB
12
app.kubernetes.io/version
:
"<version>"
13 app.kubernetes.io/component: <component> # backend, frontend, database, cache
14 app.kubernetes.io/part-of: <system-name>
15 app.kubernetes.io/managed-by: kubectl
16 annotations:
17 description: "<application description>"
18 contact: "<team-email>"
19spec:
20 replicas: 3 # Minimum 3 for production HA
21 revisionHistoryLimit: 10
22
23 selector:
24 matchLabels:
25 app.kubernetes.io/name: <app-name>
26 app.kubernetes.io/instance: <instance-name>
27
28 strategy:
29 type: RollingUpdate
30 rollingUpdate:
31 maxSurge: 1
32 maxUnavailable: 0 # Zero-downtime deployment
33
34 minReadySeconds: 10
35 progressDeadlineSeconds: 600
36
37 template:
38 metadata:
39 labels:
40 app.kubernetes.io/name: <app-name>
41 app.kubernetes.io/instance: <instance-name>
42 app.kubernetes.io/version: "<version>"
43 annotations:
44 prometheus.io/scrape: "true"
45 prometheus.io/port: "9090"
46 prometheus.io/path: "/metrics"
47
48 spec:
49 serviceAccountName: <app-name>
50
51 # Pod-level security context
52 securityContext:
53 runAsNonRoot: true
54 runAsUser: 1000
55 runAsGroup: 1000
56 fsGroup: 1000
57 seccompProfile:
58 type: RuntimeDefault
59
60 # Init containers (optional)
61 initContainers:
62 - name: init-wait
63 image: busybox:1.36
64 command: ['sh', '-c', 'echo "Initializing..."']
65 securityContext:
66 allowPrivilegeEscalation: false
67 runAsNonRoot: true
68 runAsUser: 1000
69
70 containers:
71 - name: <container-name>
72 image: <registry>/<image>:<tag> # Never use :latest
73 imagePullPolicy: IfNotPresent
74
75 ports:
76 - name: http
77 containerPort: 8080
78 protocol: TCP
79 - name: metrics
80 containerPort: 9090
81 protocol: TCP
82
83 # Environment variables
84 env:
85 - name: POD_NAME
86 valueFrom:
87 fieldRef:
88 fieldPath: metadata.name
89 - name: POD_NAMESPACE
90 valueFrom:
91 fieldRef:
92 fieldPath: metadata.namespace
93 - name: POD_IP
94 valueFrom:
95 fieldRef:
96 fieldPath: status.podIP
97
98 # Load from ConfigMap and Secret
99 envFrom:
100 - configMapRef:
101 name: <app-name>-config
102 - secretRef:
103 name: <app-name>-secret
104
105 # Resource limits
106 resources:
107 requests:
108 memory: "256Mi"
109 cpu: "250m"
110 limits:
111 memory: "512Mi"
112 cpu: "500m"
113
114 # Startup probe (for slow-starting apps)
115 startupProbe:
116 httpGet:
117 path: /health/startup
118 port: http
119 initialDelaySeconds: 0
120 periodSeconds: 10
121 timeoutSeconds: 3
122 failureThreshold: 30 # 5 minutes to start
123
124 # Liveness probe
125 livenessProbe:
126 httpGet:
127 path: /health/live
128 port: http
129 initialDelaySeconds: 30
130 periodSeconds: 10
131 timeoutSeconds: 5
132 failureThreshold: 3
133
134 # Readiness probe
135 readinessProbe:
136 httpGet:
137 path: /health/ready
138 port: http
139 initialDelaySeconds: 5
140 periodSeconds: 5
141 timeoutSeconds: 3
142 failureThreshold: 3
143
144 # Volume mounts
145 volumeMounts:
146 - name: tmp
147 mountPath: /tmp
148 - name: cache
149 mountPath: /app/cache
150 # - name: data
151 # mountPath: /var/lib/app
152
153 # Container security context
154 securityContext:
155 allowPrivilegeEscalation: false
156 readOnlyRootFilesystem: true
157 runAsNonRoot: true
158 runAsUser: 1000
159 capabilities:
160 drop:
161 - ALL
162
163 # Lifecycle hooks
164 lifecycle:
165 preStop:
166 exec:
167 command: ["/bin/sh", "-c", "sleep 15"] # Graceful shutdown
168
169 # Volumes
170 volumes:
171 - name: tmp
172 emptyDir: {}
173 - name: cache
174 emptyDir:
175 sizeLimit: 1Gi
176 # - name: data
177 # persistentVolumeClaim:
178 # claimName: <app-name>-data
179
180 # Scheduling
181 affinity:
182 podAntiAffinity:
183 preferredDuringSchedulingIgnoredDuringExecution:
184 - weight: 100
185 podAffinityTerm:
186 labelSelector:
187 matchLabels:
188 app.kubernetes.io/name: <app-name>
189 topologyKey: kubernetes.io/hostname
190
191 topologySpreadConstraints:
192 - maxSkew: 1
193 topologyKey: topology.kubernetes.io/zone
194 whenUnsatisfiable: ScheduleAnyway
195 labelSelector:
196 matchLabels:
197 app.kubernetes.io/name: <app-name>
198
199 terminationGracePeriodSeconds: 30
200
201 # Image pull secrets (if using private registry)
202 # imagePullSecrets:
203 # - name: regcred