Graham McIntire
be818b49b8
Removing all Valkey (Redis) resources from Kubernetes due to instability caused by Flannel CNI networking issues. Redis will now run on Proxmox hosts for better stability and performance. Changes: - Delete Valkey StatefulSet (master + 2 replicas) - Delete Valkey Sentinel StatefulSet (3 instances) - Delete Valkey services (headless and sentinel) - Delete Valkey ConfigMap - Remove Valkey resources from kustomization.yaml - Update deployment to use towerops-redis secret for connection Next Steps: - Set up Redis Sentinel on 3 Proxmox hosts/LXC containers - Create towerops-redis secret with REDIS_HOST and REDIS_PORT - Test failover and application connectivity Benefits: - Not affected by K8s networking issues (Flannel failures) - More stable (no restarts from node issues) - Better performance (no K8s overhead) - Independent lifecycle from K8s cluster
139 lines
4.3 KiB
YAML
139 lines
4.3 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: towerops
|
|
namespace: towerops
|
|
spec:
|
|
replicas: 3
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1 # Allow 1 extra pod during rollout
|
|
maxUnavailable: 0 # Keep all pods running during rollout
|
|
minReadySeconds: 20 # Wait 20s after pod is ready for cluster sync before continuing
|
|
selector:
|
|
matchLabels:
|
|
app: towerops
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: towerops
|
|
spec:
|
|
# Use system-cluster-critical priority to ensure towerops starts after CNI is ready
|
|
priorityClassName: system-cluster-critical
|
|
terminationGracePeriodSeconds: 60 # Allow 60s for Horde graceful shutdown (30s) + drain time
|
|
imagePullSecrets:
|
|
- name: gitlab-registry
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
fsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: towerops
|
|
image: registry.gitlab.com/towerops/towerops:latest
|
|
imagePullPolicy: Always
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
ports:
|
|
- containerPort: 4000
|
|
name: http
|
|
- containerPort: 4369
|
|
name: epmd
|
|
- containerPort: 9000
|
|
name: dist
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Stop accepting new connections
|
|
# Give etcd coordinator time to release locks (watches trigger instant failover)
|
|
# This sleep allows graceful shutdown before SIGTERM is sent
|
|
sleep 10
|
|
env:
|
|
- name: POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: DEPLOY_TIMESTAMP
|
|
value: "1970-01-01T00:00:00Z" # Placeholder, updated by GitLab CI on deploy
|
|
- name: ETCD_ENABLED
|
|
value: "true"
|
|
- name: RELEASE_DISTRIBUTION
|
|
value: "name"
|
|
- name: RELEASE_NODE
|
|
value: "towerops@$(POD_IP)"
|
|
- name: PORT
|
|
value: "4000"
|
|
- name: PHX_HOST
|
|
value: "towerops.net"
|
|
- name: MIX_ENV
|
|
value: "prod"
|
|
- name: RELEASE_COOKIE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: towerops-secrets
|
|
key: RELEASE_COOKIE
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: towerops-secrets
|
|
key: SECRET_KEY_BASE
|
|
envFrom:
|
|
# Redis connection configured via towerops-redis secret
|
|
- secretRef:
|
|
name: towerops-redis
|
|
- secretRef:
|
|
name: towerops-db
|
|
- secretRef:
|
|
name: towerops-aws
|
|
resources:
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "500m"
|
|
startupProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 4000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 12 # 10s + (12 * 5s) = 70s max startup time
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 4000
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 4000
|
|
periodSeconds: 3
|
|
timeoutSeconds: 2
|
|
successThreshold: 1
|
|
failureThreshold: 1 # Fast deregistration from service during shutdown
|