Add Kubernetes manifests for communitarian application including deployments, services, ingress, middleware, PVC, and kustomization

communitarian/deployment-api.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: communitarian-api
+  namespace: "{{ .namespace }}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      component: api
+  template:
+    metadata:
+      labels:
+        component: api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+      - name: fix-permissions
+        image: busybox:1.36
+        command: ['sh', '-c']
+        args:
+        - |
+          mkdir -p /app/data/citizens /app/data/communities /app/data/content
+          chmod -R 777 /app/data
+          echo "Permissions fixed"
+        volumeMounts:
+        - name: data
+          mountPath: /app/data
+        securityContext:
+          runAsUser: 0
+          runAsNonRoot: false
+      containers:
+      - name: communitarian-api
+        image: "{{ .apiImage }}"
+        ports:
+        - containerPort: {{ .apiPort }}
+          name: http
+        env:
+        - name: TZ
+          value: "{{ .timezone }}"
+        - name: API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: communitarian-secrets
+              key: apiKey
+        - name: JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: communitarian-secrets
+              key: jwtSecret
+        volumeMounts:
+        - name: data
+          mountPath: /app/data
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "1Gi"
+            cpu: "500m"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          readOnlyRootFilesystem: false
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: communitarian-data