Reduces apps default resource usage.

ghost/versions/5/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ghost
-  namespace: ghost
+  namespace: {{ .namespace }}
 spec:
   replicas: 1
   strategy:
@@ -15,118 +15,91 @@ spec:
       labels:
         component: web
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: ghost
-          image: docker.io/bitnami/ghost:5.118.1-debian-12-r0
+          image: ghost:5.130.6-alpine
           ports:
             - name: http
               containerPort: 2368
               protocol: TCP
           env:
-            - name: BITNAMI_DEBUG
-              value: "false"
-            - name: ALLOW_EMPTY_PASSWORD
-              value: "yes"
-            - name: GHOST_DATABASE_HOST
-              value: {{ .db.host }}
-            - name: GHOST_DATABASE_PORT_NUMBER
+            - name: NODE_ENV
+              value: production
+            - name: url
+              value: "https://{{ .domain }}"
+            - name: database__client
+              value: mysql
+            - name: database__connection__host
+              value: "{{ .db.host }}"
+            - name: database__connection__port
               value: "{{ .db.port }}"
-            - name: GHOST_DATABASE_NAME
-              value: {{ .db.name }}
-            - name: GHOST_DATABASE_USER
-              value: {{ .db.user }}
-            - name: GHOST_DATABASE_PASSWORD
+            - name: database__connection__database
+              value: "{{ .db.name }}"
+            - name: database__connection__user
+              value: "{{ .db.user }}"
+            - name: database__connection__password
               valueFrom:
                 secretKeyRef:
                   name: ghost-secrets
                   key: dbPassword
-            - name: GHOST_HOST
-              value: {{ .domain }}
-            - name: GHOST_PORT_NUMBER
-              value: "2368"
-            - name: GHOST_USERNAME
-              value: {{ .adminUser }}
-            - name: GHOST_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: ghost-secrets
-                  key: adminPassword
-            - name: GHOST_EMAIL
-              value: {{ .adminEmail }}
-            - name: GHOST_BLOG_TITLE
-              value: {{ .blogTitle }}
-            - name: GHOST_ENABLE_HTTPS
-              value: "yes"
-            - name: GHOST_EXTERNAL_HTTP_PORT_NUMBER
-              value: "80"
-            - name: GHOST_EXTERNAL_HTTPS_PORT_NUMBER
-              value: "443"
-            - name: GHOST_SKIP_BOOTSTRAP
-              value: "no"
-            - name: GHOST_SMTP_SERVICE
+            - name: mail__transport
               value: SMTP
-            - name: GHOST_SMTP_HOST
-              value: {{ .smtp.host }}
-            - name: GHOST_SMTP_PORT
+            - name: mail__options__host
+              value: "{{ .smtp.host }}"
+            - name: mail__options__port
               value: "{{ .smtp.port }}"
-            - name: GHOST_SMTP_USER
-              value: {{ .smtp.user }}
-            - name: GHOST_SMTP_PASSWORD
+            - name: mail__options__auth__user
+              value: "{{ .smtp.user }}"
+            - name: mail__options__auth__pass
               valueFrom:
                 secretKeyRef:
                   name: ghost-secrets
                   key: smtpPassword
-            - name: GHOST_SMTP_FROM_ADDRESS
-              value: {{ .smtp.from }}
+            - name: mail__from
+              value: "{{ .smtp.from }}"
           resources:
             limits:
-              cpu: 375m
+              cpu: 1000m
               ephemeral-storage: 2Gi
-              memory: 384Mi
+              memory: 512Mi
             requests:
-              cpu: 250m
+              cpu: 50m
               ephemeral-storage: 50Mi
               memory: 256Mi
           volumeMounts:
             - name: ghost-data
-              mountPath: /bitnami/ghost
+              mountPath: /var/lib/ghost/content
           livenessProbe:
-            tcpSocket:
+            httpGet:
+              path: /ghost/api/admin/site/
               port: 2368
             initialDelaySeconds: 120
             timeoutSeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
+            periodSeconds: 30
             failureThreshold: 6
           readinessProbe:
             httpGet:
-              path: /
-              port: http
-              scheme: HTTP
-              httpHeaders:
-                - name: x-forwarded-proto
-                  value: https
-            initialDelaySeconds: 30
-            timeoutSeconds: 3
-            periodSeconds: 5
-            successThreshold: 1
-            failureThreshold: 6
+              path: /ghost/api/admin/site/
+              port: 2368
+            initialDelaySeconds: 60
+            timeoutSeconds: 5
+            periodSeconds: 15
+            failureThreshold: 3
           securityContext:
+            allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
-            privileged: false
-            runAsUser: 1001
-            runAsGroup: 1001
-            runAsNonRoot: true
             readOnlyRootFilesystem: false
-            allowPrivilegeEscalation: false
-            seccompProfile:
-              type: RuntimeDefault
       volumes:
         - name: ghost-data
           persistentVolumeClaim:
             claimName: ghost-data
       restartPolicy: Always
-      securityContext:
-        fsGroup: 1001