P2: Reference deployment manifests — k8s + prod Compose (#179)#196
Open
dkijania wants to merge 1 commit into
Open
P2: Reference deployment manifests — k8s + prod Compose (#179)#196dkijania wants to merge 1 commit into
dkijania wants to merge 1 commit into
Conversation
There were no production deployment artifacts — operators had npm/Docker/Compose for dev but no opinionated manifest with probes, resource limits, and a hardened runtime. Add deploy/: - kubernetes.yaml — Deployment + Service + HPA (+ placeholder Secret) with liveness (/healthcheck) and readiness (/readiness) probes, resource requests/limits, a 2→6 CPU autoscaler, Prometheus scrape annotations for /metrics, a hardened pod securityContext (non-root, readOnlyRootFilesystem, no privilege escalation, all caps dropped, RuntimeDefault seccomp), and a 30s termination grace period matching the graceful-shutdown drain. - docker-compose.prod.yml — the published image against an external read-only Postgres, with CPU/memory caps. - README.md — usage and how this maps to the security deployment contract. Linked from the root README. References the probe/metrics endpoints delivered by the sibling P1 PRs. Closes #179. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QSuak9smCHbp4N17xjjLF6
dkijania
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Part of the production-readiness epic (#163). Closes #179.
There were no production deployment artifacts — operators had npm/Docker/Compose for dev but no opinionated manifest with probes, resource limits, and a hardened runtime.
Adds
deploy/kubernetes.yaml—Deployment+Service+HorizontalPodAutoscaler(+ placeholderSecret) with production defaults:/healthcheck, readiness on/readinessreadOnlyRootFilesystem, no privilege escalation, all caps dropped,RuntimeDefaultseccomp)/metricsterminationGracePeriodSeconds: 30matching the graceful-shutdown draindocker-compose.prod.yml— the published image against an external read-only Postgres, with CPU/memory caps.README.md— usage + how it maps to the security deployment contract.Linked from the root README. References the probe/metrics endpoints delivered by the sibling P1 PRs (#169/#173).
Testing
Docs/manifests only.
prettier --debug-check .clean; YAML structure validated. No application code changed.🤖 Generated with Claude Code