276 lines
8.6 KiB
YAML
276 lines
8.6 KiB
YAML
# FlowerCore Update Center
|
|
# GitOps adoption of the live fc-updater namespace after PUB-1/PUB-3.
|
|
# Runtime credentials remain in existing K8s Secrets; do not store them here.
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: fc-updater
|
|
labels:
|
|
app.kubernetes.io/part-of: flowercore
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: updatecenter-data
|
|
namespace: fc-updater
|
|
labels:
|
|
app.kubernetes.io/name: updatecenter-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
volumeMode: Filesystem
|
|
resources:
|
|
requests:
|
|
# Sized for fleet bundle storage (LocalFsBundleStore.MaxTotalBytes
|
|
# soft cap at 25 GiB per project_uc_remaining_4_apps_signed_2026_05_06).
|
|
# Mike Bundle alone is ~5.1 GiB; cluster live capacity is already
|
|
# 20 GiB after a manual expand. PVCs cannot shrink, so git must track
|
|
# at least the live size to avoid the OutOfSync loop.
|
|
storage: 25Gi
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: updatecenter-web
|
|
namespace: fc-updater
|
|
labels:
|
|
app: updatecenter-web
|
|
app.kubernetes.io/name: updatecenter-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 3
|
|
strategy:
|
|
# SQLite + local bundle storage live on a single RWO PVC. Recreate avoids
|
|
# two pods overlapping the same write path during future image bumps.
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: updatecenter-web
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
fc.flowercore.io/healthz-anon: "true"
|
|
fc.flowercore.io/probe-path: "/"
|
|
labels:
|
|
app: updatecenter-web
|
|
spec:
|
|
nodeName: rke2-server
|
|
containers:
|
|
- name: web
|
|
image: localhost/fc-updater-web:v202605310029-7974fc4
|
|
imagePullPolicy: Never
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
# fc-safe-to-expose: X-Forwarded-Proto handled by AddFlowerCoreWebAuth (ADR-178) before any future public/OIDC flip.
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:8080
|
|
- name: FlowerCore__Updater__Database__Provider
|
|
value: sqlite
|
|
- name: FlowerCore__Updater__Database__ConnectionString
|
|
value: Data Source=/data/updatecenter.db
|
|
- name: FlowerCore__Updater__BundleStorage__LocalFs__RootDirectory
|
|
value: /data/bundles
|
|
- name: FlowerCore__Updater__PublicShares__RequirePublicVisibilityOnPublicHosts
|
|
value: "true"
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__Code
|
|
value: 8f3c2a9e7d41
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__AppId
|
|
value: flowercore.faith-ai-mike
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__Channel
|
|
value: stable
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__RuntimeId
|
|
value: win-x64
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__DisplayName
|
|
value: Faith AI Mike Edition
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__Headline
|
|
value: Faith AI Mike Edition
|
|
- name: FlowerCore__Updater__PublicShares__Links__0__Description
|
|
value: Private release link for Mike's Faith AI bundle.
|
|
- name: FlowerCore__Audit__Sinks__Loki__Enabled
|
|
value: "false"
|
|
- name: FlowerCore__Updater__Auth__Bootstrap__Enabled
|
|
value: "true"
|
|
- name: FlowerCore__Updater__Auth__Bootstrap__Username
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-bootstrap-auth
|
|
key: username
|
|
- name: FlowerCore__Updater__Auth__Bootstrap__Password
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-bootstrap-auth
|
|
key: password
|
|
- name: FlowerCore__Updater__Auth__Bootstrap__SigningKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-bootstrap-auth
|
|
key: signing-key
|
|
- name: FlowerCore__Updater__Signing__AutoSignOnPublish
|
|
value: "true"
|
|
- name: FlowerCore__Updater__Signing__RequireSignatureOnPublish
|
|
value: "true"
|
|
- name: FlowerCore__Updater__Signing__PfxBase64
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-signing
|
|
key: pfx-base64
|
|
- name: FlowerCore__Updater__Signing__PfxPassword
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-signing
|
|
key: pfx-password
|
|
- name: FlowerCore__Updater__Signing__OpItemReference
|
|
value: op://FlowerCore/step-ca-codesign
|
|
- name: FlowerCore__Updater__Signing__TrustAnchorPath
|
|
value: /etc/flowercore-updater/signing/root-ca.pem
|
|
- name: FlowerCore__Updater__GitHub__Token
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-webhooks
|
|
key: github-token
|
|
- name: FlowerCore__Updater__GitHub__WebhookSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-webhooks
|
|
key: github-webhook-secret
|
|
- name: FlowerCore__Updater__Gitea__Token
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-webhooks
|
|
key: gitea-token
|
|
- name: FlowerCore__Updater__Gitea__WebhookSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: updater-webhooks
|
|
key: gitea-webhook-secret
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
- name: signing
|
|
mountPath: /etc/flowercore-updater/signing
|
|
readOnly: true
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: updatecenter-data
|
|
- name: signing
|
|
secret:
|
|
secretName: updater-signing
|
|
items:
|
|
- key: root-ca.pem
|
|
path: root-ca.pem
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: updatecenter-web
|
|
namespace: fc-updater
|
|
labels:
|
|
app: updatecenter-web
|
|
app.kubernetes.io/name: updatecenter-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: updatecenter-web
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: updatecenter-web-tls
|
|
namespace: fc-updater
|
|
spec:
|
|
secretName: updatecenter-web-tls
|
|
issuerRef:
|
|
name: step-ca-acme
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- updatecenter.iamworkin.lan
|
|
- updates.iamworkin.lan
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: updatecenter-web-internal-tls
|
|
namespace: fc-updater
|
|
spec:
|
|
secretName: updatecenter-web-internal-tls
|
|
issuerRef:
|
|
name: step-ca-acme
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- updatecenter-internal.iamworkin.lan
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: updatecenter-web
|
|
namespace: fc-updater
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
- websecure
|
|
routes:
|
|
- match: (Host(`updatecenter.iamworkin.lan`) || Host(`updates.iamworkin.lan`)) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
|
|
kind: Rule
|
|
services:
|
|
- name: updatecenter-web
|
|
port: 8080
|
|
tls:
|
|
secretName: updatecenter-web-tls
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: updatecenter-web-internal
|
|
namespace: fc-updater
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
- websecure
|
|
routes:
|
|
- match: Host(`updatecenter-internal.iamworkin.lan`)
|
|
kind: Rule
|
|
services:
|
|
- name: updatecenter-web
|
|
port: 8080
|
|
tls:
|
|
secretName: updatecenter-web-internal-tls
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: updatecenter-web-public
|
|
namespace: fc-updater
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: (Host(`update.flowercore.io`) || Host(`updates.flowercore.io`)) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
|
|
kind: Rule
|
|
services:
|
|
- name: updatecenter-web
|
|
port: 8080
|
|
tls:
|
|
secretName: cf-origin-flowercore-io
|