Refactoring

kubernetes/afterwork-deployment.yaml

@@ -1,14 +1,20 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: afterwork-api
+  name: mic-after-work-server-impl-quarkus-main
   namespace: applications
   labels:
-    app: afterwork-api
+    app: mic-after-work-server-impl-quarkus-main
     version: "1.0.0"
     environment: production
+    component: application
+    project: lions-infrastructure-2025
+  annotations:
+    description: "AfterWork API - Application sociale déployée via lionsctl"
+    lionsctl.lions.dev/deployed-by: "lionsctl"
 spec:
-  replicas: 2
+  replicas: 1
+  revisionHistoryLimit: 3
   strategy:
     type: RollingUpdate
     rollingUpdate:
@@ -16,37 +22,86 @@ spec:
       maxUnavailable: 0
   selector:
     matchLabels:
-      app: afterwork-api
+      app: mic-after-work-server-impl-quarkus-main
   template:
     metadata:
       labels:
-        app: afterwork-api
+        app: mic-after-work-server-impl-quarkus-main
         version: "1.0.0"
+        component: application
+        project: lions-infrastructure-2025
       annotations:
+        # Prometheus scraping - Lions Prometheus auto-découvre via ces annotations
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"
         prometheus.io/path: "/afterwork/q/metrics"
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 30
       containers:
-      - name: afterwork-api
-        image: registry.lions.dev/lionsdev/mic-after-work-server-impl-quarkus-main:d659416
+      - name: mic-after-work-server-impl-quarkus-main
+        image: registry.lions.dev/lionsdev/mic-after-work-server-impl-quarkus-main:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
           name: http
           protocol: TCP
+        # Variables d'environnement depuis ConfigMap et Secrets
         envFrom:
         - configMapRef:
             name: afterwork-config
         - secretRef:
             name: afterwork-secrets
+        env:
+        # Override explicites pour Quarkus
+        - name: QUARKUS_DATASOURCE_DB_KIND
+          value: "postgresql"
+        - name: QUARKUS_DATASOURCE_USERNAME
+          valueFrom:
+            configMapKeyRef:
+              name: afterwork-config
+              key: DB_USERNAME
+        - name: QUARKUS_DATASOURCE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: afterwork-secrets
+              key: DB_PASSWORD
+        - name: QUARKUS_DATASOURCE_JDBC_URL
+          value: "jdbc:postgresql://$(DB_HOST):$(DB_PORT)/$(DB_NAME)"
+        # Kafka - Lions Kafka cluster
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          valueFrom:
+            configMapKeyRef:
+              name: afterwork-config
+              key: KAFKA_BOOTSTRAP_SERVERS
+        # JWT
+        - name: SMALLRYE_JWT_SIGN_KEY
+          valueFrom:
+            secretKeyRef:
+              name: afterwork-secrets
+              key: JWT_SECRET
+        - name: MP_JWT_VERIFY_ISSUER
+          valueFrom:
+            configMapKeyRef:
+              name: afterwork-config
+              key: JWT_ISSUER
+        # Java options
+        - name: JAVA_OPTS
+          value: "-Xms256m -Xmx512m -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
         resources:
           requests:
             memory: "512Mi"
-            cpu: "250m"
+            cpu: "200m"
           limits:
             memory: "1Gi"
             cpu: "1000m"
+        # Health checks HTTP (utilisent les endpoints SmallRye Health)
         livenessProbe:
           httpGet:
             path: /afterwork/q/health/live
@@ -67,13 +122,35 @@ spec:
           timeoutSeconds: 5
           successThreshold: 1
           failureThreshold: 3
+        # Startup probe pour éviter les kills pendant le démarrage
+        startupProbe:
+          httpGet:
+            path: /afterwork/q/health/started
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 30
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1001
+          runAsGroup: 1001
+          capabilities:
+            drop:
+              - ALL
         volumeMounts:
-        - name: temp-uploads
-          mountPath: /tmp/uploads
+        - name: tmp-volume
+          mountPath: /tmp
+        - name: logs-volume
+          mountPath: /app/logs
       volumes:
-      - name: temp-uploads
-        emptyDir:
-          sizeLimit: 1Gi
+      - name: tmp-volume
+        emptyDir: {}
+      - name: logs-volume
+        emptyDir: {}
       imagePullSecrets:
       - name: lionsregistry-secret
       restartPolicy: Always