initial

k8s/deployment.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: k8s-pilot
+  namespace: k8s-pilot
+  labels:
+    app: k8s-pilot
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: k8s-pilot
+  # Recreate one pod at a time — always keep 1 running
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 0
+  template:
+    metadata:
+      labels:
+        app: k8s-pilot
+    spec:
+      serviceAccountName: k8s-pilot
+
+      # Spread across nodes — one pod on Pi5, one on Pi4
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: k8s-pilot
+
+      # Hard anti-affinity: never two pods on the same node
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: k8s-pilot
+              topologyKey: kubernetes.io/hostname
+
+      # Must tolerate control-plane taint so Pi5 is eligible
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+
+      containers:
+        - name: k8s-pilot
+          # Replace with your Gitea registry path:
+          # image: git.it-microevo.com/<user>/k8s-pilot:latest
+          image: k8s-pilot:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+          env:
+            - name: PORT
+              value: "3000"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10

k8s/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: k8s-pilot
+  namespace: k8s-pilot
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: k8s-pilot

k8s/rbac.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: k8s-pilot
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: k8s-pilot
+  namespace: k8s-pilot
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: k8s-pilot
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces", "nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "patch", "update"]
+  # Trivy Operator CRDs (optional — only needed if Trivy Operator is installed)
+  - apiGroups: ["aquasecurity.github.io"]
+    resources: ["vulnerabilityreports", "configauditreports", "exposedsecretreports"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: k8s-pilot
+subjects:
+  - kind: ServiceAccount
+    name: k8s-pilot
+    namespace: k8s-pilot
+roleRef:
+  kind: ClusterRole
+  name: k8s-pilot
+  apiGroup: rbac.authorization.k8s.io

k8s/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: k8s-pilot
+  namespace: k8s-pilot
+spec:
+  selector:
+    app: k8s-pilot
+  ports:
+    - port: 80
+      targetPort: 3000
+  type: ClusterIP
+  # Sticky sessions — keeps SSE log streams and WebSocket
+  # connections on the same pod after initial connection
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 3600