hello-api: gitops manifests

apps/hello-api.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hello-api
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://ns31240276.ip-51-195-4.eu/devops/gitops.git
+    targetRevision: main
+    path: manifests/hello-api
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: hello-api
+  syncPolicy:
+    # Koi kubectl se chhed de to ArgoCD wapas git wali state laa dega.
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 10s
+        maxDuration: 3m
+        factor: 2

manifests/hello-api/deployment.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hello-api
+  namespace: hello-api
+spec:
+  replicas: 2
+  revisionHistoryLimit: 5
+  selector:
+    matchLabels:
+      app: hello-api
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: hello-api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
+        # isliye numeric uid dena zaroori hai.
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          # ye tag pipeline commit karti hai - haath se mat badlo
+          image: ns31240276.ip-51-195-4.eu:5000/swim/hello-api:14
+          # Secrets Vault se aate hain - git me kabhi nahi.
+          envFrom:
+            - secretRef:
+                name: hello-api-secrets
+          ports:
+            - containerPort: 8000
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests: { cpu: "50m",  memory: "64Mi" }
+            limits:   { cpu: "500m", memory: "256Mi" }
+          readinessProbe:
+            httpGet: { path: /health, port: 8000 }
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /health, port: 8000 }
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      volumes:
+        - name: tmp
+          emptyDir: {}

manifests/hello-api/externalsecret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hello-api-secrets
+  namespace: hello-api
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-swim
+    kind: ClusterSecretStore
+  target:
+    name: hello-api-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: GREETING
+      remoteRef:
+        key: hello-api
+        property: greeting
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        key: hello-api
+        property: db_password

manifests/hello-api/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hello-api

manifests/hello-api/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hello-api
+  namespace: hello-api
+spec:
+  type: NodePort
+  selector:
+    app: hello-api
+  ports:
+    - port: 80
+      targetPort: 8000
+      nodePort: 30894