Omar SobhandClaude Fable 5
70ec39f696
- S3BlobStore (object_store, path-style) behind the same BlobStore trait, tested against a REAL MinIO container (round trip, overwrite, NotFound on get and delete, nested keys); [storage] backend=local|s3 config with validation + server-side selection (S3 creds via env overlay) - Helm chart: server pod with the secret broker as a SIDECAR sharing a private emptyDir unix socket (no network hop carries credentials), frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE ingress annotations, NetworkPolicies (frontend->server only), hardened securityContexts; ci/check-helm.sh lints AND asserts the rendered topology properties - deploy/airgapped/install.sh: offline signature+checksum verification via the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode; ci/test-install.sh rehearses clean/tampered/wrong-key paths with the real binary - CI: helm gate + installer rehearsal wired in 149 Rust tests; helm lint + rendered assertions green; installer verify-path rehearsal green. Co-Authored-By: Claude Fable 5 <[email protected]>
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: teamclaw-frontend
|
|
labels: {{- include "teamclaw.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.frontend.replicas }}
|
|
selector:
|
|
matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "teamclaw.frontendSelector" . | nindent 8 }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile: { type: RuntimeDefault }
|
|
containers:
|
|
- name: frontend
|
|
image: "{{ .Values.image.registry }}/frontend:{{ .Values.image.tag }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
ports:
|
|
- { containerPort: 3000, name: http }
|
|
env:
|
|
- name: API_ORIGIN
|
|
value: http://teamclaw-server:8080
|
|
resources: {{- toYaml .Values.frontend.resources | nindent 12 }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: { drop: ["ALL"] }
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: teamclaw-frontend
|
|
labels: {{- include "teamclaw.labels" . | nindent 4 }}
|
|
spec:
|
|
selector: {{- include "teamclaw.frontendSelector" . | nindent 4 }}
|
|
ports:
|
|
- { name: http, port: 3000, targetPort: http }
|