Files
cloud-host/backend/helm/cloudhost-platform/templates/backend-deployment.yaml
T
keyhan 837f0fa63f Harden platform security, reliability, and CI after full audit.
Close deployment IDOR and gate stub payment endpoints, add production
secret validation, health probes, Redis-backed build progress, GitHub
Actions CI, expanded tests, billing/k8s refactors, and ops runbooks.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-29 20:59:49 +03:30

117 lines
3.9 KiB
YAML

{{- if .Values.backend.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "cloudhost-platform.backend.fullname" . }}
namespace: {{ include "cloudhost-platform.namespace" . }}
labels:
app: {{ include "cloudhost-platform.backend.fullname" . }}
{{- include "cloudhost-platform.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.backend.replicas }}
strategy:
type: Recreate
selector:
matchLabels:
app: {{ include "cloudhost-platform.backend.fullname" . }}
template:
metadata:
labels:
app: {{ include "cloudhost-platform.backend.fullname" . }}
spec:
initContainers:
{{- if .Values.postgres.enabled }}
- name: wait-postgres
image: {{ .Values.images.busybox | quote }}
command:
- sh
- -c
- |
until nc -z {{ include "cloudhost-platform.postgres.fullname" . }} 5432; do
echo "waiting for postgres..."
sleep 2
done
{{- end }}
{{- if .Values.redis.enabled }}
- name: wait-redis
image: {{ .Values.images.busybox | quote }}
command:
- sh
- -c
- |
until nc -z {{ include "cloudhost-platform.redis.fullname" . }} 6379; do
echo "waiting for redis..."
sleep 2
done
{{- end }}
containers:
- name: backend
image: {{ include "cloudhost-platform.backendImage" . | quote }}
imagePullPolicy: {{ .Values.images.backend.pullPolicy }}
ports:
- containerPort: 4000
env:
- name: DB_HOST
value: {{ include "cloudhost-platform.postgres.fullname" . }}
- name: DB_PORT
value: "5432"
- name: DB_USERNAME
value: {{ .Values.postgres.username | quote }}
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "cloudhost-platform.secretName" . }}
key: postgres-password
- name: DB_DATABASE
value: {{ .Values.postgres.database | quote }}
- name: REDIS_HOST
value: {{ include "cloudhost-platform.redis.fullname" . }}
- name: REDIS_PORT
value: "6379"
- name: JWT_SECRET
valueFrom:
secretKeyRef:
name: {{ include "cloudhost-platform.secretName" . }}
key: jwt-secret
- name: JWT_REFRESH_SECRET
valueFrom:
secretKeyRef:
name: {{ include "cloudhost-platform.secretName" . }}
key: jwt-refresh-secret
- name: FRONTEND_URL
value: {{ include "cloudhost-platform.corsOrigins" . | quote }}
{{- range $key, $val := .Values.backend.env }}
- name: {{ $key }}
value: {{ $val | quote }}
{{- end }}
{{- range $key, $val := .Values.backend.extraEnv }}
- name: {{ $key }}
value: {{ $val | quote }}
{{- end }}
volumeMounts:
- name: uploads
mountPath: /app/uploads
livenessProbe:
httpGet:
path: /api/v1/health
port: 4000
initialDelaySeconds: 60
periodSeconds: 15
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /api/v1/ready
port: 4000
initialDelaySeconds: 20
periodSeconds: 10
timeoutSeconds: 5
{{- with .Values.backend.resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
volumes:
- name: uploads
persistentVolumeClaim:
claimName: {{ include "cloudhost-platform.backend.fullname" . }}-uploads
{{- end }}