unkin-agent
51243d8145
The traefik gateway terminates TLS for ghp.unkin.net and forwards cleartext to the ghp Service port 80 -> container :8080. But :8080 was GHP_SERVER_HTTP_LISTEN, ghp's http->https 308 REDIRECT listener, so ghp bounced every request back to https, which the gateway forwarded to :8080 again: an infinite ghp.unkin.net -> ghp.unkin.net 308 loop. Per ghp source (internal/server/server.go Run/serveTLS/servePlain, redirect.go), the app is served on either GHP_SERVER_LISTEN (plain, full handler incl. mgmt UI + API) OR GHP_SERVER_HTTPS_LISTEN (own TLS) - it is strictly either/or: any non-empty https_listen sets hasTLS and runs serveTLS, in which GHP_SERVER_LISTEN is ignored and http_listen only ever redirects. To serve cleartext on :8080 behind the TLS-terminating gateway, ghp must run in plain mode: - configmap: drop GHP_SERVER_HTTPS_LISTEN + GHP_SERVER_HTTP_LISTEN; set GHP_SERVER_LISTEN ":8080" so :8080 SERVES the app; add GHP_SERVER_TRUST_PROXY_HEADERS so ghp trusts the gateway's X-Forwarded-*/Forwarded for scheme/host. - deployment + vmservicescrape: the metrics server only wraps TLS when hasTLS is true, so in plain mode it is cleartext - switch the /metrics probes and the scrape from HTTPS/https to HTTP/http. Service, HTTPRoute and Gateway are unchanged.
152 lines
4.7 KiB
YAML
152 lines
4.7 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ghp
|
|
namespace: ghp
|
|
annotations:
|
|
# Wave 2: serve only after the wave-1 migrate Job completes.
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
secret.reloader.stakater.com/reload: "ghp-github-app,ghp-app,ghp-tls,postgres-app"
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: ghp
|
|
strategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: ghp
|
|
spec:
|
|
serviceAccountName: default
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: ghp
|
|
image: ghcr.io/goodtune/ghp:0.20.0
|
|
imagePullPolicy: IfNotPresent
|
|
# Drop the image's default --migrate so replicas never race migrations;
|
|
# schema is applied by the wave-1 migrate hook Job instead.
|
|
command: ["/ghp", "serve"]
|
|
ports:
|
|
- containerPort: 8443
|
|
name: https
|
|
protocol: TCP
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
- containerPort: 9136
|
|
name: metrics
|
|
protocol: TCP
|
|
envFrom:
|
|
- configMapRef:
|
|
name: ghp-env
|
|
optional: false
|
|
env:
|
|
# DSN assembled from the CNPG-generated postgres-app Secret; $(VAR)
|
|
# expansion resolves the two env entries defined above it.
|
|
- name: GHP_DB_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-app
|
|
key: username
|
|
- name: GHP_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-app
|
|
key: password
|
|
- name: GHP_DATABASE_DSN
|
|
value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
|
|
- name: GHP_GITHUB_APP_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: app_id
|
|
- name: GHP_GITHUB_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: client_id
|
|
- name: GHP_GITHUB_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: client_secret
|
|
- name: GHP_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-app
|
|
key: encryption_key
|
|
volumeMounts:
|
|
- name: github-app
|
|
mountPath: /etc/ghp/github-app
|
|
readOnly: true
|
|
- name: tls
|
|
mountPath: /etc/ghp/tls
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /metrics
|
|
port: metrics
|
|
# Plain HTTP: ghp only serves metrics over TLS in TLS mode
|
|
# (hasTLS). In reverse-proxy/plain mode the metrics server is
|
|
# cleartext, so probe with HTTP.
|
|
scheme: HTTP
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /metrics
|
|
port: metrics
|
|
# Plain HTTP: ghp only serves metrics over TLS in TLS mode
|
|
# (hasTLS). In reverse-proxy/plain mode the metrics server is
|
|
# cleartext, so probe with HTTP.
|
|
scheme: HTTP
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
volumes:
|
|
- name: github-app
|
|
secret:
|
|
secretName: ghp-github-app
|
|
- name: tls
|
|
secret:
|
|
secretName: ghp-tls
|
|
# Writable scratch: root FS is read-only. Disk-backed (not memory medium)
|
|
# so codeload tarball staging doesn't count against the pod memory limit.
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
restartPolicy: Always
|