REFACTOR(apps): migrate to app-template

- docusaurus: Replace with app-template, configmap in manifests/
- homer: Replace with app-template, configMapGenerator for config.yml
- crafty: Replace with app-template, pvc/ingress/service in manifests/
- mas: Replace with app-template, rbac/external-secret in manifests/
- All apps use app-template chart v3.6.1

crafty/argocd.yaml

@@ -8,6 +8,15 @@ metadata:
 spec:
   project: default
   sources:
+  - repoURL: https://bjw-s.github.io/helm-charts
+    chart: app-template
+    targetRevision: 3.6.1
+    helm:
+      valueFiles:
+      - $values/crafty/helm-values.yaml
+  - repoURL: https://github.com/K3S-HOME/applications.git
+    targetRevision: main
+    ref: values
   - repoURL: https://github.com/K3S-HOME/applications.git
     targetRevision: main
     path: crafty

crafty/deployment.yaml

@@ -1,68 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: crafty
-  namespace: crafty
-  labels:
-    app: crafty
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: crafty
-  template:
-    metadata:
-      labels:
-        app: crafty
-    spec:
-      securityContext:
-        fsGroup: 0
-      initContainers:
-      - name: init-permissions
-        image: busybox:latest
-        command: ['sh', '-c', 'chown -R 1000:0 /crafty && chmod -R g+rwX /crafty']
-        volumeMounts:
-        - name: servers
-          mountPath: /crafty/servers
-        - name: config
-          mountPath: /crafty/app/config
-        securityContext:
-          runAsUser: 0
-      containers:
-      - name: crafty
-        image: registry.gitlab.com/crafty-controller/crafty-4:latest
-        env:
-        - name: TZ
-          value: Asia/Seoul
-        ports:
-        - name: https
-          containerPort: 8443
-          protocol: TCP
-        - name: dynmap
-          containerPort: 8123
-          protocol: TCP
-        - name: bedrock
-          containerPort: 19132
-          protocol: UDP
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "250m"
-          limits:
-            memory: "2Gi"
-        volumeMounts:
-        - name: servers
-          mountPath: /crafty/servers
-        - name: config
-          mountPath: /crafty/app/config
-        securityContext:
-          allowPrivilegeEscalation: false
-      volumes:
-      - name: servers
-        persistentVolumeClaim:
-          claimName: crafty-servers
-      - name: config
-        persistentVolumeClaim:
-          claimName: crafty-config

crafty/helm-values.yaml

@@ -0,0 +1,67 @@
+# crafty - bjw-s/app-template values
+# Minecraft server manager
+
+defaultPodOptions:
+  securityContext:
+    fsGroup: 0
+
+controllers:
+  main:
+    strategy: Recreate
+    initContainers:
+      init-permissions:
+        image:
+          repository: busybox
+          tag: latest
+        command:
+          - sh
+          - -c
+          - "chown -R 1000:0 /crafty && chmod -R g+rwX /crafty"
+        securityContext:
+          runAsUser: 0
+    containers:
+      main:
+        image:
+          repository: registry.gitlab.com/crafty-controller/crafty-4
+          tag: latest
+        env:
+          TZ: Asia/Seoul
+        resources:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            memory: 2Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+
+service:
+  main:
+    controller: main
+    ports:
+      https:
+        port: 8443
+      dynmap:
+        port: 8123
+
+persistence:
+  servers:
+    enabled: true
+    type: persistentVolumeClaim
+    existingClaim: crafty-servers
+    advancedMounts:
+      main:
+        init-permissions:
+          - path: /crafty/servers
+        main:
+          - path: /crafty/servers
+  config:
+    enabled: true
+    type: persistentVolumeClaim
+    existingClaim: crafty-config
+    advancedMounts:
+      main:
+        init-permissions:
+          - path: /crafty/app/config
+        main:
+          - path: /crafty/app/config

crafty/kustomization.yaml

@@ -1,9 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 resources:
-  - pvc.yaml
+- manifests/pvc.yaml
-  - deployment.yaml
+- manifests/minecraft-service.yaml
-  - service.yaml
+- manifests/serverstransport.yaml
-  - serverstransport.yaml
+- manifests/ingress.yaml
-  - ingress.yaml

crafty/manifests/minecraft-service.yaml

@@ -1,26 +1,5 @@
 apiVersion: v1
 kind: Service
-metadata:
-  name: crafty
-  namespace: crafty
-  labels:
-    app: crafty
-spec:
-  type: ClusterIP
-  selector:
-    app: crafty
-  ports:
-  - name: https
-    port: 8443
-    targetPort: 8443
-    protocol: TCP
-  - name: dynmap
-    port: 8123
-    targetPort: 8123
-    protocol: TCP
----
-apiVersion: v1
-kind: Service
 metadata:
   name: crafty-minecraft
   namespace: crafty
@@ -29,7 +8,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    app: crafty
+    app.kubernetes.io/name: crafty
   ports:
   - name: bedrock
     port: 19132

docusaurus/argocd.yaml

@@ -8,6 +8,15 @@ metadata:
 spec:
   project: default
   sources:
+  - repoURL: https://bjw-s.github.io/helm-charts
+    chart: app-template
+    targetRevision: 3.6.1
+    helm:
+      valueFiles:
+      - $values/docusaurus/helm-values.yaml
+  - repoURL: https://github.com/K3S-HOME/applications.git
+    targetRevision: main
+    ref: values
   - repoURL: https://github.com/K3S-HOME/applications.git
     targetRevision: main
     path: docusaurus
@@ -18,11 +27,8 @@ spec:
     automated:
       prune: true
       selfHeal: true
-      allowEmpty: false
     syncOptions:
     - CreateNamespace=true
-    - PrunePropagationPolicy=foreground
-    - PruneLast=true
     retry:
       limit: 5
       backoff:
@@ -32,15 +38,3 @@ spec:
     managedNamespaceMetadata:
       labels:
         goldilocks.fairwinds.com/enabled: 'true'
-  revisionHistoryLimit: 10
-  ignoreDifferences:
-  - group: apps
-    kind: Deployment
-    jqPathExpressions:
-    - .metadata.annotations
-  - group: ''
-    kind: Service
-    name: docusaurus
-    namespace: docusaurus
-    jsonPointers:
-    - /spec/clusterIP

docusaurus/deployment.yaml

@@ -1,118 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docusaurus
-  namespace: docusaurus
-  labels:
-    app: docusaurus
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: docusaurus
-  template:
-    metadata:
-      labels:
-        app: docusaurus
-      annotations:
-        docusaurus/source-hash: "2024-12-30-v1"
-    spec:
-      initContainers:
-      - name: build-docusaurus
-        image: node:18-alpine
-        workingDir: /workspace
-        command:
-        - sh
-        - -c
-        - |
-          apk add --no-cache git
-          echo "Cloning repository..."
-          git clone https://github.com/K3S-HOME/applications.git /tmp/repo
-          cd /tmp/repo/docusaurus/asset
-          echo "Installing dependencies..."
-          npm install --legacy-peer-deps
-          echo "Building Docusaurus site..."
-          npm run build
-          echo "Copying build output..."
-          cp -r build/. /build/
-          echo "Build complete!"
-        volumeMounts:
-        - name: build-output
-          mountPath: /build
-      containers:
-      - name: nginx
-        image: nginx:alpine
-        ports:
-        - containerPort: 80
-          name: http
-        volumeMounts:
-        - name: build-output
-          mountPath: /usr/share/nginx/html
-        - name: nginx-config
-          mountPath: /etc/nginx/conf.d/default.conf
-          subPath: default.conf
-        resources:
-          requests:
-            cpu: 50m
-            memory: 64Mi
-          limits:
-            memory: 128Mi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 5
-          periodSeconds: 5
-      volumes:
-      - name: build-output
-        emptyDir: {}
-      - name: nginx-config
-        configMap:
-          name: nginx-config
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nginx-config
-  namespace: docusaurus
-data:
-  default.conf: |
-    server {
-        listen 80;
-        server_name _;
-        root /usr/share/nginx/html;
-        index index.html;
-
-        # Enable gzip compression
-        gzip on;
-        gzip_vary on;
-        gzip_min_length 1024;
-        gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
-
-        # Redirect root to intro page
-        location = / {
-            return 301 /intro/;
-        }
-
-        # SPA fallback
-        location / {
-            try_files $uri $uri/ /intro/index.html;
-        }
-
-        # Cache static assets
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-            expires 1y;
-            add_header Cache-Control "public, immutable";
-        }
-
-        # Security headers
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-    }

docusaurus/helm-values.yaml

@@ -0,0 +1,104 @@
+# docusaurus - bjw-s/app-template values
+# Documentation site with build-time static generation
+
+controllers:
+  main:
+    annotations:
+      docusaurus/source-hash: "2024-12-30-v1"
+    initContainers:
+      build-docusaurus:
+        image:
+          repository: node
+          tag: 18-alpine
+        command:
+          - sh
+          - -c
+          - |
+            apk add --no-cache git
+            echo "Cloning repository..."
+            git clone https://github.com/K3S-HOME/applications.git /tmp/repo
+            cd /tmp/repo/docusaurus/asset
+            echo "Installing dependencies..."
+            npm install --legacy-peer-deps
+            echo "Building Docusaurus site..."
+            npm run build
+            echo "Copying build output..."
+            cp -r build/. /build/
+            echo "Build complete!"
+    containers:
+      main:
+        image:
+          repository: nginx
+          tag: alpine
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 128Mi
+        probes:
+          liveness:
+            enabled: true
+            custom: true
+            spec:
+              httpGet:
+                path: /
+                port: 80
+              initialDelaySeconds: 10
+              periodSeconds: 10
+          readiness:
+            enabled: true
+            custom: true
+            spec:
+              httpGet:
+                path: /
+                port: 80
+              initialDelaySeconds: 5
+              periodSeconds: 5
+
+service:
+  main:
+    controller: main
+    ports:
+      http:
+        port: 80
+
+ingress:
+  main:
+    enabled: true
+    className: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+    hosts:
+      - host: docusaurus0213.kro.kr
+        paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+    tls:
+      - secretName: docusaurus-tls
+        hosts:
+          - docusaurus0213.kro.kr
+
+persistence:
+  build-output:
+    enabled: true
+    type: emptyDir
+    globalMounts:
+      - path: /build
+    advancedMounts:
+      main:
+        build-docusaurus:
+          - path: /build
+        main:
+          - path: /usr/share/nginx/html
+  nginx-config:
+    enabled: true
+    type: configMap
+    name: nginx-config
+    advancedMounts:
+      main:
+        main:
+          - path: /etc/nginx/conf.d/default.conf
+            subPath: default.conf

docusaurus/ingress.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: docusaurus-ingress
-  namespace: docusaurus
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - docusaurus0213.kro.kr
-    secretName: docusaurus-tls
-  rules:
-  - host: docusaurus0213.kro.kr
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: docusaurus
-            port:
-              number: 80

docusaurus/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-- deployment.yaml
-- service.yaml
-- ingress.yaml
 namespace: docusaurus
+resources:
+- manifests/configmap.yaml

docusaurus/manifests/configmap.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-config
+  namespace: docusaurus
+data:
+  default.conf: |
+    server {
+        listen 80;
+        server_name _;
+        root /usr/share/nginx/html;
+        index index.html;
+
+        # Enable gzip compression
+        gzip on;
+        gzip_vary on;
+        gzip_min_length 1024;
+        gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
+
+        # Redirect root to intro page
+        location = / {
+            return 301 /intro/;
+        }
+
+        # SPA fallback
+        location / {
+            try_files $uri $uri/ /intro/index.html;
+        }
+
+        # Cache static assets
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }
+
+        # Security headers
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+    }

docusaurus/service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: docusaurus
-  namespace: docusaurus
-  labels:
-    app: docusaurus
-spec:
-  type: ClusterIP
-  ports:
-  - name: http
-    port: 80
-    targetPort: 80
-    protocol: TCP
-  selector:
-    app: docusaurus

homer/argocd.yaml

@@ -8,6 +8,15 @@ metadata:
 spec:
   project: default
   sources:
+  - repoURL: https://bjw-s.github.io/helm-charts
+    chart: app-template
+    targetRevision: 3.6.1
+    helm:
+      valueFiles:
+      - $values/homer/helm-values.yaml
+  - repoURL: https://github.com/K3S-HOME/applications.git
+    targetRevision: main
+    ref: values
   - repoURL: https://github.com/K3S-HOME/applications.git
     targetRevision: main
     path: homer

homer/deployment.yaml

@@ -1,68 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: homer
-  namespace: homer
-  labels:
-    app: homer
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: homer
-  template:
-    metadata:
-      labels:
-        app: homer
-    spec:
-      initContainers:
-      - name: copy-homer-files
-        image: b4bz/homer:latest
-        command: ['sh', '-c']
-        args:
-          - |
-            # Homer의 기본 파일들을 emptyDir로 복사
-            cp -r /www/* /tmp/www/
-        volumeMounts:
-        - name: www
-          mountPath: /tmp/www
-      - name: copy-assets
-        image: alpine/git:latest
-        command: ['sh', '-c']
-        args:
-          - |
-            # Git에서 assets 복사
-            git clone --depth 1 --branch main https://github.com/K3S-HOME/applications.git /tmp/repo
-            # assets 폴더 덮어쓰기
-            rm -rf /www/assets
-            cp -r /tmp/repo/homer/assets /www/assets
-            # config.yml 복사
-            cp /config/config.yml /www/assets/config.yml
-            # lighttpd 사용자(uid=1000)가 읽을 수 있도록 권한 변경
-            chmod -R 755 /www/assets
-            chown -R 1000:65533 /www/assets
-        volumeMounts:
-        - name: config
-          mountPath: /config
-        - name: www
-          mountPath: /www
-      containers:
-      - name: homer
-        image: b4bz/homer:latest
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 8080
-          name: http
-        volumeMounts:
-        - name: www
-          mountPath: "/www"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "5m"
-      volumes:
-      - name: config
-        configMap:
-          name: homer-config
-      - name: www
-        emptyDir: {}

homer/helm-values.yaml

@@ -0,0 +1,93 @@
+# homer - bjw-s/app-template values
+# Dashboard for self-hosted services
+
+controllers:
+  main:
+    initContainers:
+      copy-homer-files:
+        image:
+          repository: b4bz/homer
+          tag: latest
+        command:
+          - sh
+          - -c
+          - |
+            cp -r /www/* /tmp/www/
+      copy-assets:
+        image:
+          repository: alpine/git
+          tag: latest
+        command:
+          - sh
+          - -c
+          - |
+            git clone --depth 1 --branch main https://github.com/K3S-HOME/applications.git /tmp/repo
+            rm -rf /www/assets
+            cp -r /tmp/repo/homer/assets /www/assets
+            cp /config/config.yml /www/assets/config.yml
+            chmod -R 755 /www/assets
+            chown -R 1000:65533 /www/assets
+    containers:
+      main:
+        image:
+          repository: b4bz/homer
+          tag: latest
+          pullPolicy: IfNotPresent
+        resources:
+          requests:
+            cpu: 5m
+            memory: 64Mi
+
+service:
+  main:
+    controller: main
+    ports:
+      http:
+        port: 80
+        targetPort: 8080
+
+ingress:
+  main:
+    enabled: true
+    className: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+    hosts:
+      - host: mayne.kro.kr
+        paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+      - host: www.mayne.kro.kr
+        paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+    tls:
+      - secretName: homer-tls
+        hosts:
+          - mayne.kro.kr
+          - www.mayne.kro.kr
+
+persistence:
+  www:
+    enabled: true
+    type: emptyDir
+    advancedMounts:
+      main:
+        copy-homer-files:
+          - path: /tmp/www
+        copy-assets:
+          - path: /www
+        main:
+          - path: /www
+  config:
+    enabled: true
+    type: configMap
+    name: homer-config
+    advancedMounts:
+      main:
+        copy-assets:
+          - path: /config

homer/ingress.yaml

@@ -1,35 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: homer-ingress
-  namespace: homer
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - mayne.kro.kr
-    - www.mayne.kro.kr
-    secretName: homer-tls
-  rules:
-  - host: mayne.kro.kr
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: homer
-            port:
-              number: 80
-  - host: www.mayne.kro.kr
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: homer
-            port:
-              number: 80

homer/kustomization.yaml

@@ -1,11 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-- deployment.yaml
-- service.yaml
-- ingress.yaml
 configMapGenerator:
 - name: homer-config
   namespace: homer
   files:
   - config.yml
+generatorOptions:
+  disableNameSuffixHash: true

homer/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: homer
-  namespace: homer
-spec:
-  type: ClusterIP
-  ports:
-  - name: http
-    port: 80
-    targetPort: 8080
-  selector:
-    app: homer

mas/argocd.yaml

@@ -8,6 +8,15 @@ metadata:
 spec:
   project: default
   sources:
+  - repoURL: https://bjw-s.github.io/helm-charts
+    chart: app-template
+    targetRevision: 3.6.1
+    helm:
+      valueFiles:
+      - $values/mas/helm-values.yaml
+  - repoURL: https://github.com/K3S-HOME/applications.git
+    targetRevision: main
+    ref: values
   - repoURL: https://github.com/K3S-HOME/applications.git
     targetRevision: main
     path: mas
@@ -18,11 +27,8 @@ spec:
     automated:
       prune: true
       selfHeal: true
-      allowEmpty: false
     syncOptions:
     - CreateNamespace=true
-    - PrunePropagationPolicy=foreground
-    - PruneLast=true
     retry:
       limit: 5
       backoff:
@@ -32,4 +38,3 @@ spec:
     managedNamespaceMetadata:
       labels:
         goldilocks.fairwinds.com/enabled: 'true'
-  revisionHistoryLimit: 10

mas/deployment.yaml

@@ -1,77 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mas
-  labels:
-    app: mas
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mas
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
-  revisionHistoryLimit: 3
-  template:
-    metadata:
-      labels:
-        app: mas
-    spec:
-      hostPID: true
-      serviceAccountName: mas
-      imagePullSecrets:
-      - name: ghcr-secret
-      containers:
-      - name: mas
-        image: ghcr.io/mayne0213/mas:latest
-        imagePullPolicy: Always
-        securityContext:
-          privileged: true
-        ports:
-        - containerPort: 8000
-          name: http
-        env:
-        - name: ANTHROPIC_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: mas-api-keys
-              key: anthropic-api-key
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: postgresql-password
-              key: password
-        - name: CHAINLIT_DATABASE_URL
-          value: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
-        - name: DATABASE_URL
-          value: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
-        - name: POSTGRES_HOST
-          value: "postgresql-rw.postgresql.svc.cluster.local"
-        - name: POSTGRES_PORT
-          value: "5432"
-        - name: POSTGRES_USER
-          value: "bluemayne"
-        - name: REDIS_URL
-          value: "redis://redis:6379/0"
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 100m
-          limits:
-            memory: 1Gi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 8000
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 8000
-          initialDelaySeconds: 10
-          periodSeconds: 5
-      restartPolicy: Always

mas/helm-values.yaml

@@ -0,0 +1,102 @@
+# mas - bjw-s/app-template values
+# Multi-Agent System
+
+defaultPodOptions:
+  hostPID: true
+  imagePullSecrets:
+    - name: ghcr-secret
+
+serviceAccount:
+  create: false
+  name: mas
+
+controllers:
+  main:
+    strategy: RollingUpdate
+    rollingUpdate:
+      unavailable: 0
+      surge: 1
+    revisionHistoryLimit: 3
+    containers:
+      main:
+        image:
+          repository: ghcr.io/mayne0213/mas
+          tag: latest
+          pullPolicy: Always
+        securityContext:
+          privileged: true
+        env:
+          ANTHROPIC_API_KEY:
+            valueFrom:
+              secretKeyRef:
+                name: mas-api-keys
+                key: anthropic-api-key
+          POSTGRES_PASSWORD:
+            valueFrom:
+              secretKeyRef:
+                name: postgresql-password
+                key: password
+          CHAINLIT_DATABASE_URL: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
+          DATABASE_URL: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
+          POSTGRES_HOST: "postgresql-rw.postgresql.svc.cluster.local"
+          POSTGRES_PORT: "5432"
+          POSTGRES_USER: "bluemayne"
+          REDIS_URL: "redis://redis:6379/0"
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            memory: 1Gi
+        probes:
+          liveness:
+            enabled: true
+            custom: true
+            spec:
+              httpGet:
+                path: /
+                port: 8000
+              initialDelaySeconds: 30
+              periodSeconds: 10
+          readiness:
+            enabled: true
+            custom: true
+            spec:
+              httpGet:
+                path: /
+                port: 8000
+              initialDelaySeconds: 10
+              periodSeconds: 5
+
+service:
+  main:
+    controller: main
+    ports:
+      http:
+        port: 8000
+
+ingress:
+  main:
+    enabled: true
+    className: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+      traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
+    hosts:
+      - host: mas0213.kro.kr
+        paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+      - host: www.mas0213.kro.kr
+        paths:
+          - path: /
+            service:
+              identifier: main
+              port: http
+    tls:
+      - secretName: mas-tls
+        hosts:
+          - mas0213.kro.kr
+          - www.mas0213.kro.kr

mas/ingress.yaml

@@ -1,35 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mas-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - mas0213.kro.kr
-    - www.mas0213.kro.kr
-    secretName: mas-tls
-  rules:
-  - host: mas0213.kro.kr
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: mas
-            port:
-              number: 8000
-  - host: www.mas0213.kro.kr
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: mas
-            port:
-              number: 8000

mas/kustomization.yaml

@@ -2,8 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: mas
 resources:
-- deployment.yaml
+- manifests/rbac.yaml
-- service.yaml
+- manifests/external-secret.yaml
-- ingress.yaml
-- external-secret.yaml
-- rbac.yaml

mas/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: mas
-  labels:
-    app: mas
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8000
-    targetPort: 8000
-    protocol: TCP
-    name: http
-  selector:
-    app: mas