mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 05:34:43 +02:00
72 lines
2.2 KiB
YAML
72 lines
2.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: finlab
|
|
namespace: ai
|
|
spec:
|
|
replicas: 1
|
|
# HOME + workspace sur un volume RWO (NFS) → pas de rolling à 2 pods sur le même volume.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: finlab
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: finlab
|
|
spec:
|
|
# Image privée sur GHCR → secret de pull créé manuellement dans le ns ai
|
|
# (cf. README : kubectl create secret docker-registry ghcr-pull ...).
|
|
imagePullSecrets:
|
|
- name: ghcr-pull
|
|
# Conformité PodSecurity « restricted » (namespace ai). fsGroup 1000 → le PVC NFS monté
|
|
# en /home/finlab (HOME : ~/.claude du login abonnement + workspace) est inscriptible.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: finlab
|
|
# Tag bumpé par la CI (build-finlab.yml) sur main.
|
|
image: ghcr.io/alkatrazz24/funk-finlab:sha-54f6f7c
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: web
|
|
containerPort: 7681
|
|
env:
|
|
- name: TZ
|
|
value: "Europe/Paris"
|
|
# ttyd écoute en TCP : sonde TCP (pas de endpoint HTTP de santé dédié). Démarrage
|
|
# rapide, mais on laisse de la marge (seed du workspace au 1er boot).
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 7681
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 7681
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
# Node + Claude Code peuvent consommer ; nœuds 8 Go (OOM actif) → limite raisonnable.
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1536Mi
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /home/finlab
|
|
volumes:
|
|
- name: home
|
|
persistentVolumeClaim:
|
|
claimName: finlab-data
|