Pink/k8s dev

k8s/base/backend-deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.kompose.service: backend
+  name: backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: backend
+  template:
+    metadata:
+      labels:
+        io.kompose.service: backend
+    spec:
+      serviceAccountName: ushadow-backend
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: ushadow-config
+            - secretRef:
+                name: ushadow-secret
+          env:
+            - name: BACKEND_PORT
+              value: "8000"
+            - name: CORS_ORIGINS
+              value: http://localhost:3000
+            - name: HOST
+              value: 0.0.0.0
+            - name: MONGODB_DATABASE
+              value: ushadow
+            - name: PORT
+              value: "8000"
+            - name: REDIS_URL
+              value: redis://redis:6379/0
+          image: registry.temp.skaffold/ushadow-backend
+          name: ushadow-backend
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+      restartPolicy: Always

k8s/backend-service.yaml → k8s/base/backend-service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   labels:
     io.kompose.service: backend
-  name: ushadow-backend
+  name: backend
 spec:
   ports:
     - name: "8000"

k8s/base/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - rbac.yaml
+  - backend-deployment.yaml
+  - backend-service.yaml
+  - webui-deployment.yaml
+  - webui-service.yaml

k8s/base/rbac.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ushadow-backend
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ushadow-backend-reader
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ushadow-backend-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ushadow-backend-reader
+subjects:
+  - kind: ServiceAccount
+    name: ushadow-backend

k8s/webui-deployment.yaml → k8s/base/webui-deployment.yaml

@@ -18,6 +18,9 @@ spec:
         - env:
             - name: NODE_ENV
               value: production
+            - name: VITE_BACKEND_URL
+              value: http://localhost:8000
+            - name: VITE_ENV_NAME
           image: registry.temp.skaffold/ushadow-frontend
           name: ushadow-webui
           ports:

k8s/webui-service.yaml → k8s/base/webui-service.yaml

@@ -3,11 +3,11 @@ kind: Service
 metadata:
   labels:
     io.kompose.service: webui
-  name: ushadow-frontend
+  name: webui
 spec:
   ports:
-    - name: "80"
-      port: 80
+    - name: "3000"
+      port: 3000
       targetPort: 80
   selector:
     io.kompose.service: webui

k8s/infra/kustomization.yaml

@@ -2,9 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - mongo-pvc.yaml
-  - mongo-deployment.yaml
-  - mongo-service.yaml
+  # mongo is managed separately — do not apply via kustomize to avoid selector conflicts
+  # - mongo-deployment.yaml
+  # - mongo-service.yaml
   - postgres-deployment.yaml
   - postgres-service.yaml
   - qdrant-deployment.yaml

k8s/infra/mongo-deployment.yaml

@@ -17,15 +17,15 @@ spec:
       containers:
         - image: mongo:8.0
           name: mongo
-          command: ["mongod", "--noauth"]
           ports:
             - containerPort: 27017
               protocol: TCP
-          volumeMounts:
-            - name: mongo-data
-              mountPath: /data/db
-      volumes:
-        - name: mongo-data
-          persistentVolumeClaim:
-            claimName: mongo-data
+          env:
+            - name: MONGO_INITDB_ROOT_USERNAME
+              value: "root"
+            - name: MONGO_INITDB_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ushadow-secret
+                  key: MONGO_ROOT_PASSWORD
       restartPolicy: Always

k8s/kustomization.yaml

@@ -4,39 +4,22 @@ kind: Kustomization
 namespace: ushadow
 
 resources:
-  # - namespace.yaml  # Namespace managed separately - DO NOT let Skaffold delete it!
-  # secret.yaml is gitignored (contains plaintext creds) - apply once manually:
-  #   kubectl apply -f k8s/secret.yaml   (copy from secret.yaml.example and fill in values)
-  #
-  # PVCs are NOT listed here — managed by seed-pvcs.sh so Skaffold never deletes them.
-  # Skaffold runs `skaffold delete` on `dev` teardown which would wipe PVC-stored overrides.
-  - backend-deployment.yaml
-  - backend-service.yaml
-  - webui-deployment.yaml
-  - webui-service.yaml
-  - ingress.yaml
-  - certificate.yaml
-  # - infra/  # Infrastructure managed separately
-
-# K8s-specific env vars loaded from .env.k8s (gitignored, copy from .env and update for K8s)
-# Provides: KC_HOSTNAME_URL, KC_URL, CORS_ORIGINS, USHADOW_PUBLIC_URL, etc.
-configMapGenerator:
-  - name: backend-k8s-env
-    envs:
-      - .env.k8s
-generatorOptions:
-  disableNameSuffixHash: true
+  - namespace.yaml
+  - configmap.yaml
+  # secret.yaml intentionally NOT included.
+  # ushadow-secret is the single responsibility of `just k8s-apply-secret`,
+  # which sources it from config/SECRETS/secrets_k8s.yaml (gitignored).
+  # skaffold's `deploy.hooks.before` runs that command pre-deploy.
+  - infra/
+  - base/
+  # - tweaks/ingress-example.yaml  # Uncomment when ready
 
 # Add common labels to all resources
-labels:
-  - pairs:
-      app: ushadow
-      env: purple
+commonLabels:
+  app: ushadow
+  env: ushadow
 
 # Add annotations
 commonAnnotations:
   managed-by: kustomize
   deployed-from: docker-compose
-
-# Note: Image replacement handled by Skaffold's --default-repo flag
-# No Kustomize image transformers needed when using Skaffold