mirror of
https://github.com/block/buzz.git
synced 2026-10-30 14:01:37 +00:00
42b42447b0
A few things to prepare for deploying the Buzz push gateway as implemented in #6269: - Cut `buzz-push-gateway` chart `0.2.0` from the current config (certificate auth, dogfood client) - Datadog-compatible metrics - Align the desired schema, metrics docs, and production ingress guidance with the current dogfood deployment contract ## Links - [BUZZ-17: Publish the MVP-compatible gateway chart](https://linear.app/squareup/issue/BUZZ-17/publish-the-mvp-compatible-gateway-chart) - [BUZZ-26: Add Datadog-compatible push-gateway metrics and correct source drift](https://linear.app/squareup/issue/BUZZ-26/add-datadog-compatible-push-gateway-metrics-and-correct-source-drift) --------- Signed-off-by: Tom Brow <tomb@block.xyz> Co-authored-by: Codex <noreply@openai.com>
70 lines
4.0 KiB
YAML
70 lines
4.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "push.name" . }}
|
|
labels: {{- include "push.runtimeLabels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
strategy: { type: RollingUpdate, rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } }
|
|
selector:
|
|
matchLabels: {{- include "push.runtimeLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels: {{- include "push.runtimeLabels" . | nindent 8 }}
|
|
{{- with .Values.podAnnotations }}
|
|
annotations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
terminationGracePeriodSeconds: 60
|
|
securityContext: { runAsNonRoot: true, runAsUser: 65532, runAsGroup: 65532, fsGroup: 65532, seccompProfile: { type: RuntimeDefault } }
|
|
{{- with .Values.image.pullSecrets }}
|
|
imagePullSecrets: {{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: gateway
|
|
image: "{{ .Values.image.repository }}{{ if .Values.image.digest }}@{{ .Values.image.digest }}{{ else }}:{{ required "image.tag or image.digest is required" .Values.image.tag }}{{ end }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: { drop: [ALL] } }
|
|
ports:
|
|
- { name: public, containerPort: 8080 }
|
|
- { name: health, containerPort: 8081 }
|
|
env:
|
|
- { name: BUZZ_PUSH_BIND_ADDR, value: "0.0.0.0:8080" }
|
|
- { name: BUZZ_PUSH_HEALTH_ADDR, value: "0.0.0.0:8081" }
|
|
- { name: BUZZ_PUSH_PUBLIC_DELIVERY_URL, value: {{ .Values.publicDeliveryUrl | quote }} }
|
|
- { name: BUZZ_PUSH_MAX_GRANT_LIFETIME_SECONDS, value: {{ .Values.maxGrantLifetimeSeconds | quote }} }
|
|
- { name: BUZZ_PUSH_APP_ATTEST_ROOT_CERT_PATH, value: /run/buzz/app-attest/root.pem }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APP_ATTEST_APP_ID, value: {{ .Values.profiles.dogfood.appAttestAppId | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_TOPIC, value: {{ .Values.profiles.dogfood.apnsTopic | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_ENVIRONMENT, value: {{ .Values.profiles.dogfood.apnsEnvironment | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_CERT_PATH, value: /run/buzz/apns-dogfood/identity.pem }
|
|
{{- range $name := list "DATABASE_URL" "BUZZ_PUSH_GRANT_KEYS" "BUZZ_PUSH_TOKEN_KEYS" }}
|
|
- name: {{ $name }}
|
|
valueFrom: { secretKeyRef: { name: {{ $.Values.existingSecret }}, key: {{ $name }} } }
|
|
{{- end }}
|
|
volumeMounts:
|
|
- { name: app-attest-root, mountPath: /run/buzz/app-attest, readOnly: true }
|
|
- { name: apns-dogfood, mountPath: /run/buzz/apns-dogfood, readOnly: true }
|
|
livenessProbe: { httpGet: { path: /_liveness, port: health }, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 3 }
|
|
readinessProbe: { httpGet: { path: /_readiness, port: health }, periodSeconds: 5, timeoutSeconds: 3, failureThreshold: 3 }
|
|
startupProbe: { httpGet: { path: /_liveness, port: health }, periodSeconds: 2, failureThreshold: 60 }
|
|
resources: {{- toYaml .Values.resources | nindent 12 }}
|
|
volumes:
|
|
- name: app-attest-root
|
|
secret: { secretName: {{ .Values.appAttestRoot.secretName }}, items: [{ key: {{ .Values.appAttestRoot.secretKey }}, path: root.pem }] }
|
|
- name: apns-dogfood
|
|
secret: { secretName: {{ .Values.profiles.dogfood.apnsCert.secretName }}, defaultMode: 0400, items: [{ key: {{ .Values.profiles.dogfood.apnsCert.secretKey }}, path: identity.pem }] }
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.topologySpreadConstraints }}
|
|
topologySpreadConstraints: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|