# Kubernetes Deployment

## Secrets Management

Secrets are managed directly in the cluster and must be created before deploying the application.

Required secrets in the `towerops` namespace:
- `gitlab-registry` - Docker registry credentials for pulling images
- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE)
- `towerops-db` - Database connection credentials
- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION)

For local development, the project root `.envrc` is used by direnv.

## Deploying

Apply all resources using kustomize:

```bash
kubectl apply -k k8s/
```

Or individually:

```bash
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secret.yaml
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml
kubectl apply -f k8s/service-headless.yaml
kubectl apply -f k8s/certificate.yaml
kubectl apply -f k8s/ingressroute.yaml
```