From 684531a569066f36aaff25ebd3af0fef4fe712cf Mon Sep 17 00:00:00 2001
From: devops <devops@local>
Date: Wed, 16 Sep 2026 16:26:17 +0000
Subject: [PATCH] hello-api: gitops manifests

---
 apps/hello-api.yaml                     | 29 ++++++++++++
 manifests/hello-api/deployment.yaml     | 63 +++++++++++++++++++++++++
 manifests/hello-api/externalsecret.yaml | 22 +++++++++
 manifests/hello-api/namespace.yaml      |  4 ++
 manifests/hello-api/service.yaml        | 13 +++++
 5 files changed, 131 insertions(+)
 create mode 100644 apps/hello-api.yaml
 create mode 100644 manifests/hello-api/deployment.yaml
 create mode 100644 manifests/hello-api/externalsecret.yaml
 create mode 100644 manifests/hello-api/namespace.yaml
 create mode 100644 manifests/hello-api/service.yaml

diff --git a/apps/hello-api.yaml b/apps/hello-api.yaml
new file mode 100644
index 0000000..6bd7c57
--- /dev/null
+++ b/apps/hello-api.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hello-api
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://ns31240276.ip-51-195-4.eu/devops/gitops.git
+    targetRevision: main
+    path: manifests/hello-api
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: hello-api
+  syncPolicy:
+    # Koi kubectl se chhed de to ArgoCD wapas git wali state laa dega.
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 10s
+        maxDuration: 3m
+        factor: 2
diff --git a/manifests/hello-api/deployment.yaml b/manifests/hello-api/deployment.yaml
new file mode 100644
index 0000000..36b9176
--- /dev/null
+++ b/manifests/hello-api/deployment.yaml
@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hello-api
+  namespace: hello-api
+spec:
+  replicas: 2
+  revisionHistoryLimit: 5
+  selector:
+    matchLabels:
+      app: hello-api
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: hello-api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
+        # isliye numeric uid dena zaroori hai.
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          # ye tag pipeline commit karti hai - haath se mat badlo
+          image: ns31240276.ip-51-195-4.eu:5000/swim/hello-api:14
+          # Secrets Vault se aate hain - git me kabhi nahi.
+          envFrom:
+            - secretRef:
+                name: hello-api-secrets
+          ports:
+            - containerPort: 8000
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests: { cpu: "50m",  memory: "64Mi" }
+            limits:   { cpu: "500m", memory: "256Mi" }
+          readinessProbe:
+            httpGet: { path: /health, port: 8000 }
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /health, port: 8000 }
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      volumes:
+        - name: tmp
+          emptyDir: {}
diff --git a/manifests/hello-api/externalsecret.yaml b/manifests/hello-api/externalsecret.yaml
new file mode 100644
index 0000000..aef792c
--- /dev/null
+++ b/manifests/hello-api/externalsecret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hello-api-secrets
+  namespace: hello-api
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-swim
+    kind: ClusterSecretStore
+  target:
+    name: hello-api-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: GREETING
+      remoteRef:
+        key: hello-api
+        property: greeting
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        key: hello-api
+        property: db_password
diff --git a/manifests/hello-api/namespace.yaml b/manifests/hello-api/namespace.yaml
new file mode 100644
index 0000000..aa17857
--- /dev/null
+++ b/manifests/hello-api/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hello-api
diff --git a/manifests/hello-api/service.yaml b/manifests/hello-api/service.yaml
new file mode 100644
index 0000000..7f3122d
--- /dev/null
+++ b/manifests/hello-api/service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hello-api
+  namespace: hello-api
+spec:
+  type: NodePort
+  selector:
+    app: hello-api
+  ports:
+    - port: 80
+      targetPort: 8000
+      nodePort: 30894