36 lines
2.1 KiB
Markdown
36 lines
2.1 KiB
Markdown
|
# 6.2 — Deployment, Service, NetworkPolicy (GREEN)
|
||
|
|
|
||
|
|
Phase: 6 — Deploy and cutover
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [6.1](6.1-hardened-image.md)
|
||
|
|
|
||
|
|
Manifests only. Nothing here exposes the gateway publicly — that is the cutover, and
|
||
|
|
it is a separate step.
|
||
|
|
|
||
|
|
- [ ] A Deployment runs the gateway with at least 2 replicas, matching Kong's current replica count
|
||
|
|
- [ ] The pod spec carries the hardening from 6.1: non-root, read-only rootfs, all capabilities dropped, `seccompProfile: RuntimeDefault`
|
||
|
|
- [ ] Liveness probes hit `/healthz` and readiness probes hit `/readyz`; readiness fails while config is invalid or JWKS has never been fetched
|
||
|
|
- [ ] Route configuration is mounted from a ConfigMap sourced from git — not a CRD, and not baked into the image
|
||
|
|
- [ ] A config change rolls the pods; a stale ConfigMap cannot be silently served by a long-lived pod
|
||
|
|
- [ ] Termination allows in-flight requests to drain, with a grace period long enough for the streaming timeouts in use
|
||
|
|
- [ ] A Service exposes the gateway in-cluster with a named port, resolvable at `http://<svc>.api.svc.cluster.local`
|
||
|
|
- [ ] No ServiceAccount with any RBAC is bound; the pod does not need or receive an API-server token (G2)
|
||
|
|
- [ ] A NetworkPolicy allows ingress only from `ingress-nginx`
|
||
|
|
- [ ] The same NetworkPolicy allows egress only to the proxied upstreams plus Authentik, plus DNS. Everything else is denied
|
||
|
|
- [ ] Resource requests and limits are set explicitly
|
||
|
|
- [ ] Every manifest is committed to git and applied by Argo. No `kubectl apply`, no `helm upgrade` (G7)
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl -n api get deploy homelab-frontend -o jsonpath='{.spec.replicas} {.spec.template.spec.securityContext}{"\n"}'
|
||
|
|
# expected: 2, with runAsNonRoot true and seccompProfile RuntimeDefault
|
||
|
|
|
||
|
|
kubectl -n api exec deploy/homelab-frontend -- true 2>&1
|
||
|
|
# expected: fails — distroless image has no shell to exec into
|
||
|
|
|
||
|
|
kubectl -n llm-serving run np-probe --rm -it --image=curlimages/curl --restart=Never -- \
|
||
|
|
curl -s -m 5 http://homelab-frontend.api.svc.cluster.local/healthz
|
||
|
|
# expected: times out or is refused — ingress is restricted to ingress-nginx only
|
||
|
|
```
|