9165f1e9ab
Espelho do routines: NestJS 10 + Fastify + TypeORM, modulos catalog (override por UF), document (versoes + storage GCS), compliance (mesmo score do painel), alerts (regua de vencimento, envio e v1.2) e analise plugavel (KeywordAnalyzer -> OCR/LLM). 38 testes. Deploy aguarda banco 'documents' e secrets no hml2 — por isso o [skip ci] no bootstrap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
129 lines
4.2 KiB
YAML
129 lines
4.2 KiB
YAML
# Deployment do serviço documents no hml2 (lab).
|
|
# Aplicar uma vez à mão: kubectl --context=hml2-corepetro apply -f k8s/hml/
|
|
# Depois disso o cd.yml só faz `kubectl set image` na imagem nova.
|
|
#
|
|
# Pré-requisitos no cluster (mesmos do routines, nenhum secret novo):
|
|
# - secret `secret-token` → JWT compartilhado do core
|
|
# - secret `sqluserhomolgeneric` → usuário/senha do Cloud SQL
|
|
# - secret `cloudsql-instance-credentials`→ credencial do cloudsql-proxy
|
|
# - database `documents` criado na instância clubpetro-homologation
|
|
# - bucket privado `corepetro_store_documents` (PDFs; URL assinada na leitura)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: documents-deployment
|
|
labels:
|
|
app: documents
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: documents
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: documents
|
|
spec:
|
|
containers:
|
|
- name: documents
|
|
image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/documents:lab-1
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- containerPort: 3000
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 512Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 3000
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 3000
|
|
initialDelaySeconds: 45
|
|
periodSeconds: 30
|
|
env:
|
|
- name: PORT
|
|
value: '3000'
|
|
- name: NODE_ENV
|
|
value: homologation
|
|
- name: ERROR_CODE
|
|
value: DOC
|
|
# SEM isto o JwtAuthGuard do authmodule libera TODA request
|
|
# (`''.includes('')` === true). O boot falha se estiver vazio.
|
|
- name: INTERNAL_PATH
|
|
value: default.svc.cluster.local
|
|
- name: TZ
|
|
value: America/Sao_Paulo
|
|
- name: DOCUMENTS_TIMEZONE
|
|
value: America/Sao_Paulo
|
|
- name: DOCUMENTS_BUCKET
|
|
value: corepetro_store_documents
|
|
- name: URL_HOMOLOGATION
|
|
value: https://lab.clubpetro.com/api/v2/documents
|
|
- name: SECRET_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-token
|
|
key: secret
|
|
- name: TYPEORM_CONNECTION
|
|
value: postgres
|
|
# 127.0.0.1 = sidecar cloudsql-proxy abaixo
|
|
- name: TYPEORM_HOST
|
|
value: 127.0.0.1
|
|
- name: TYPEORM_PORT
|
|
value: '5432'
|
|
- name: TYPEORM_SLAVE
|
|
value: 127.0.0.1
|
|
- name: TYPEORM_SLAVE_PORT
|
|
value: '5432'
|
|
- name: TYPEORM_DATABASE
|
|
value: documents
|
|
- name: TYPEORM_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sqluserhomolgeneric
|
|
key: username
|
|
- name: TYPEORM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sqluserhomolgeneric
|
|
key: passphrase
|
|
- name: TYPEORM_SYNCHRONIZE
|
|
value: 'false'
|
|
- name: TYPEORM_MIGRATIONS_RUN
|
|
value: 'true'
|
|
- name: TYPEORM_LOGGING
|
|
value: 'false'
|
|
|
|
- name: cloudsql-proxy
|
|
image: gcr.io/cloudsql-docker/gce-proxy:1.14
|
|
resources:
|
|
requests:
|
|
cpu: 2m
|
|
memory: 32Mi
|
|
command:
|
|
[
|
|
'/cloud_sql_proxy',
|
|
'-instances=corepetro:us-central1:clubpetro-homologation=tcp:5432',
|
|
'-credential_file=/secrets/cloudsql/credentials.json',
|
|
]
|
|
securityContext:
|
|
runAsUser: 2
|
|
allowPrivilegeEscalation: false
|
|
volumeMounts:
|
|
- name: cloudsql-instance-credentials
|
|
mountPath: /secrets/cloudsql
|
|
readOnly: true
|
|
|
|
volumes:
|
|
- name: cloudsql-instance-credentials
|
|
secret:
|
|
secretName: cloudsql-instance-credentials
|