Graham McIntire
ae949b4a0b
Secrets are now managed directly in the cluster rather than generated from .envrc files. This fixes FluxCD reconciliation errors since .envrc is gitignored and cannot be used in GitOps workflows. All secrets have been backed up to 1Password for disaster recovery.
33 lines
926 B
Markdown
33 lines
926 B
Markdown
# Kubernetes Deployment
|
|
|
|
## Secrets Management
|
|
|
|
Secrets are managed directly in the cluster and must be created before deploying the application.
|
|
|
|
Required secrets in the `towerops` namespace:
|
|
- `gitlab-registry` - Docker registry credentials for pulling images
|
|
- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE)
|
|
- `towerops-db` - Database connection credentials
|
|
- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION)
|
|
|
|
For local development, the project root `.envrc` is used by direnv.
|
|
|
|
## Deploying
|
|
|
|
Apply all resources using kustomize:
|
|
|
|
```bash
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
Or individually:
|
|
|
|
```bash
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f k8s/secret.yaml
|
|
kubectl apply -f k8s/deployment.yaml
|
|
kubectl apply -f k8s/service.yaml
|
|
kubectl apply -f k8s/service-headless.yaml
|
|
kubectl apply -f k8s/certificate.yaml
|
|
kubectl apply -f k8s/ingressroute.yaml
|
|
```
|