Changed k8s installation files for a bit more sophisticated setup.

docs/install/k8s/50-deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: recipes
+  namespace: default
   labels:
     app: recipes
     environment: production
@@ -9,17 +10,78 @@ metadata:
 spec:
   replicas: 1
   strategy:
-    type: RollingUpdate
+    type: Recreate
   selector:
     matchLabels:
       app: recipes
       environment: production
   template:
     metadata:
+      annotations:
+        backup.velero.io/backup-volumes: media,static    
       labels:
         app: recipes
+        tier: frontend
         environment: production
     spec:
+      restartPolicy: Always
+      serviceAccount: recipes
+      serviceAccountName: recipes
+      initContainers:
+      - name: init-chmod-data
+        env:
+          - name: SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: recipes
+                key: secret-key
+          - name: DB_ENGINE
+            value: django.db.backends.postgresql_psycopg2
+          - name: POSTGRES_HOST
+            value: recipes-postgresql
+          - name: POSTGRES_PORT
+            value: "5432"
+          - name: POSTGRES_USER
+            value: postgres
+          - name: POSTGRES_DB
+            value: recipes
+          - name: POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: recipes
+                key: postgresql-postgres-password
+        image: vabene1111/recipes:1.0.1
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: 250m
+            memory: 64Mi
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          source venv/bin/activate
+          echo "Updating database"
+          python manage.py migrate
+          python manage.py collectstatic_js_reverse
+          python manage.py collectstatic --noinput
+          echo "Setting media file attributes"
+          chown -R 65534:65534 /opt/recipes/mediafiles
+          find /opt/recipes/mediafiles -type d | xargs -r chmod 755
+          find /opt/recipes/mediafiles -type f | xargs -r chmod 644
+          echo "Done"
+        securityContext:
+          runAsUser: 0
+        volumeMounts:
+        - mountPath: /opt/recipes/mediafiles
+          name: media
+          # mount as subPath due to lost+found on ext4 pvc
+          subPath: files
+        - mountPath: /opt/recipes/staticfiles
+          name: static
+          # mount as subPath due to lost+found on ext4 pvc
+          subPath: files
       containers:
       - name: recipes-nginx
         image: nginx:latest
@@ -28,69 +90,94 @@ spec:
           - containerPort: 80
             protocol: TCP
             name: http
+          - containerPort: 8080
+            protocol: TCP
+            name: gunicorn
+        resources:
+          requests:
+            cpu: 250m
+            memory: 64Mi
         volumeMounts:
-          - mountPath: '/media'
+          - mountPath: /media
             name: media
-          - mountPath: '/static'
+            # mount as subPath due to lost+found on ext4 pvc
+            subPath: files
+          - mountPath: /static
             name: static
+            # mount as subPath due to lost+found on ext4 pvc
+            subPath: files
           - name: nginx-config
             mountPath: /etc/nginx/nginx.conf
             subPath: nginx-config
             readOnly: true
       - name: recipes
-        image: 'vabene1111/recipes:latest'
+        image: vabene1111/recipes:1.0.1
         imagePullPolicy: IfNotPresent
+        command:
+          - /opt/recipes/venv/bin/gunicorn
+          - -b
+          - :8080
+          - --access-logfile
+          - "-"
+          - --error-logfile
+          - "-"
+          - --log-level
+          - INFO
+          - recipes.wsgi
         livenessProbe:
+          failureThreshold: 3
           httpGet:
             path: /
             port: 8080
+            scheme: HTTP
+          periodSeconds: 30
         readinessProbe:
           httpGet:
             path: /
             port: 8080
+            scheme: HTTP
+          periodSeconds: 30
+        resources:
+          requests:
+            cpu: 250m
+            memory: 64Mi
         volumeMounts:
-          - mountPath: '/opt/recipes/mediafiles'
+          - mountPath: /opt/recipes/mediafiles
             name: media
-          - mountPath: '/opt/recipes/staticfiles'
+            # mount as subPath due to lost+found on ext4 pvc
+            subPath: files
+          - mountPath: /opt/recipes/staticfiles
             name: static
+            # mount as subPath due to lost+found on ext4 pvc
+            subPath: files
         env:
           - name: DEBUG
             value: "0"
           - name: ALLOWED_HOSTS
             value: '*'
           - name: SECRET_KEY
-            value: # CHANGEME
+            valueFrom:
+              secretKeyRef:
+                name: recipes
+                key: secret-key
           - name: DB_ENGINE
             value: django.db.backends.postgresql_psycopg2
           - name: POSTGRES_HOST
-            value: localhost
+            value: recipes-postgresql
           - name: POSTGRES_PORT
             value: "5432"
           - name: POSTGRES_USER
-            value: recipes
+            value: postgres
           - name: POSTGRES_DB
             value: recipes
           - name: POSTGRES_PASSWORD
-            value: # CHANGEME
-      - name: recipes-db
-        image: 'postgres:latest'
-        imagePullPolicy: IfNotPresent
-        ports:
-          - containerPort: 5432
-        volumeMounts:
-          - mountPath: '/var/lib/postgresql/data'
-            name: database
-        env:
-          - name: POSTGRES_USER
-            value: recipes
-          - name: POSTGRES_DB
-            value: recipes
-          - name: POSTGRES_PASSWORD
-            value: # CHANGEME
+            valueFrom:
+              secretKeyRef:
+                name: recipes
+                key: postgresql-postgres-password
+        securityContext:
+          runAsUser: 65534
       volumes:
-        - name: database
-          persistentVolumeClaim:
-            claimName: recipes-db
         - name: media
           persistentVolumeClaim:
             claimName: recipes-media