# Kubernetes Deployment

## Secrets Management

Secrets are managed directly in the cluster and must be created before deploying the application.

Required secrets in the `towerops` namespace:
- `gitlab-registry` - Docker registry credentials for pulling images
- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE)
- `towerops-db` - Database connection credentials
- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION)

Optional secrets:
- `towerops-llm` - DeepSeek API credentials for LLM-powered insight enrichment.
  Optional — when missing, insights still display without an AI summary.
  See `k8s/towerops-llm-secret.example.yaml` for the template, or create with:

  ```bash
  kubectl create secret generic towerops-llm \
    --from-literal=DEEPSEEK_API_KEY="<your-key>" \
    --from-literal=DEEPSEEK_MODEL="deepseek-v4-pro" \
    -n towerops
  kubectl rollout restart deployment/towerops -n towerops
  ```

For local development, the project root `.envrc` is used by direnv.

## Deployment Timestamp

The application footer displays the deployment timestamp to track when the current version was deployed. This is automatically set by GitLab CI during deployment:

```yaml
# GitLab CI sets this during deploy
- kubectl set env deployment/towerops DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ") -n towerops
```

All pods in the deployment share the same timestamp (when the deployment was initiated), regardless of when individual pods were created. This is displayed in the footer as "Last deployed X ago · YYYY-MM-DD HH:MM:SS UTC".

For manual deployments without GitLab CI, set the timestamp:
```bash
kubectl set env deployment/towerops DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ") -n towerops
```

## Deploying

Apply all resources using kustomize:

```bash
kubectl apply -k k8s/
```

Or individually:

```bash
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secret.yaml
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml
kubectl apply -f k8s/service-headless.yaml
kubectl apply -f k8s/certificate.yaml
kubectl apply -f k8s/ingressroute.yaml
```