mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 05:34:43 +02:00
101 lines
3.3 KiB
YAML
101 lines
3.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: finlab
|
|
namespace: ai
|
|
spec:
|
|
replicas: 1
|
|
# HOME + workspace sur un volume RWO (NFS) → pas de rolling à 2 pods sur le même volume.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: finlab
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: finlab
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: ghcr-pull
|
|
# PodSecurity « restricted » (ns ai). fsGroup 1000 → PVC NFS monté en /home/finlab.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
# initContainer : prépare le workspace (seed robuste NFS) AVANT console + dashboard,
|
|
# pour qu'il soit peuplé et inscriptible quand les deux conteneurs démarrent.
|
|
initContainers:
|
|
- name: seed
|
|
image: ghcr.io/alkatrazz24/funk-finlab:sha-ff37d27
|
|
command: ["/usr/local/bin/entrypoint-seed.sh"]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /home/finlab
|
|
containers:
|
|
# ── CONSOLE : Claude Code dans un terminal web (ttyd), sous /console ──
|
|
- name: console
|
|
image: ghcr.io/alkatrazz24/funk-finlab:sha-ff37d27
|
|
command: ["/usr/local/bin/entrypoint-console.sh"]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: console
|
|
containerPort: 7681
|
|
readinessProbe:
|
|
tcpSocket: { port: 7681 }
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
tcpSocket: { port: 7681 }
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
resources:
|
|
requests: { cpu: 150m, memory: 512Mi }
|
|
limits: { cpu: "1", memory: 1536Mi }
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /home/finlab
|
|
# ── DASHBOARD : interface web (FastAPI), graphiques + données finlab ──
|
|
- name: dashboard
|
|
image: ghcr.io/alkatrazz24/funk-finlab:sha-ff37d27
|
|
command:
|
|
- /opt/venv/bin/uvicorn
|
|
- dashboard.server:app
|
|
- --host=0.0.0.0
|
|
- --port=8800
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: web
|
|
containerPort: 8800
|
|
# FINLAB_HOME/PYTHONPATH viennent de l'image ; FINLAB_HOME = workspace (configs live).
|
|
readinessProbe:
|
|
httpGet: { path: /healthz, port: 8800 }
|
|
initialDelaySeconds: 8
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
httpGet: { path: /healthz, port: 8800 }
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
resources:
|
|
requests: { cpu: 100m, memory: 256Mi }
|
|
limits: { cpu: 500m, memory: 768Mi }
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /home/finlab
|
|
volumes:
|
|
- name: home
|
|
persistentVolumeClaim:
|
|
claimName: finlab-data
|