deployment.yaml

{{- if .Values.appEnabled -}}
{{- $fullName := include "generic-govuk-app.fullname" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $fullName }}
  labels:
    {{- include "generic-govuk-app.labels" . | nindent 4 }}
    app: {{ $fullName }}
    app.kubernetes.io/name: {{ $fullName }}
    app.kubernetes.io/component: app
spec:
  replicas: {{ .Values.replicaCount }}
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: {{ $fullName }}
  template:
    metadata:
      labels:
        {{- include "generic-govuk-app.labels" . | nindent 8 }}
        app: {{ $fullName }}
        app.kubernetes.io/name: {{ $fullName }}
        app.kubernetes.io/component: app
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      securityContext:
        fsGroup: {{ .Values.securityContext.runAsGroup }}
        runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
        runAsUser: {{ .Values.securityContext.runAsUser }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
      {{- with .Values.dnsConfig }}
      dnsConfig:
        {{- . | toYaml | trim | nindent 8 }}
      {{- end }}
      volumes:
        - name: {{ .Values.nginxConfigMap.name | default (printf "%s-nginx-conf" $fullName) }}
          configMap:
            name: {{ .Values.nginxConfigMap.name | default (printf "%s-nginx-conf" $fullName) }}
        - name: app-tmp
          emptyDir: {}
        - name: nginx-tmp
          emptyDir: {}
        {{- if .Values.serveRailsAssetsFromFilesystem }}
        - name: assets
          emptyDir: {}
        {{- end }}
        {{- with .Values.extraVolumes }}
          {{- . | toYaml | trim | nindent 8 }}
        {{- end }}
      {{- if .Values.serveRailsAssetsFromFilesystem }}
      initContainers:
        - name: copy-assets
          image: "{{ .Values.appImage.repository }}:{{ .Values.appImage.tag }}"
          imagePullPolicy: {{ .Values.appImage.pullPolicy | default "Always" }}
          {{- $sourcePath := .Values.uploadAssets.path | default (printf "/app/public/assets/%s" .Values.repoName) }}
          command: ["cp", "-R", "{{ $sourcePath }}", "/assets"]
          volumeMounts:
            - name: assets
              mountPath: /assets
      {{- end }}
      containers:
        - name: app
          image: "{{ .Values.appImage.repository }}:{{ .Values.appImage.tag }}"
          imagePullPolicy: {{ .Values.appImage.pullPolicy | default "Always" }}
          ports:
            - name: http
              containerPort: {{ .Values.appPort }}
            - name: metrics
              containerPort: {{ .Values.metricsPort }}
          envFrom:
            - configMapRef:
                name: govuk-apps-env
          env:
            - name: PORT
              value: "{{ .Values.appPort }}"
            {{- if .Values.rails.enabled }}
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.rails.secretKeyBaseName | default (printf "%s-rails-secret-key-base" .Values.repoName) }}
                  key: secret-key-base
            {{- end }}
            {{- if .Values.sentry.enabled }}
            - name: SENTRY_DSN
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.sentry.dsnSecretName | default (printf "%s-sentry" .Values.repoName) }}
                  key: dsn
            - name: SENTRY_RELEASE
              value: "{{ .Values.appImage.tag }}"
            {{- end }}
            {{- with .Values.extraEnv }}
              {{- (tpl (toYaml .) $) | trim | nindent 12 }}
            {{- end }}
          {{- with .Values.appResources }}
          resources:
            {{- . | toYaml | trim | nindent 12 }}
          {{- end }}
          {{- with .Values.appProbes }}
            {{- . | toYaml | trim | nindent 10 }}
          {{- else }}
          livenessProbe: &app-probe
            httpGet:
              path: /healthcheck/live
              port: http
            failureThreshold: 3
            periodSeconds: 5
            timeoutSeconds: 30
          readinessProbe:
            <<: *app-probe  # Intentionally same path as liveness.
            failureThreshold: 2
          startupProbe:
            <<: *app-probe
            failureThreshold: 15
            periodSeconds: 2
            timeoutSeconds: 2
          {{- end }}
          securityContext:
            allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation }}
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: app-tmp
              mountPath: /tmp
            {{- with .Values.appExtraVolumeMounts }}
              {{- . | toYaml | trim | nindent 12 }}
            {{- end }}
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "15"] # To allow time for ALB to deregister pod before termination
        - name: nginx
          image: "{{ .Values.nginxImage.repository }}:{{ .Values.nginxImage.tag }}"
          imagePullPolicy: {{ .Values.nginxImage.pullPolicy | default "Always" }}
          ports:
            - name: http
              containerPort: {{ .Values.nginxPort }}
          livenessProbe: &nginx-probe
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 2
            failureThreshold: 3
            periodSeconds: 5
            timeoutSeconds: 20
          readinessProbe:
            <<: *nginx-probe  # Intentionally same path as liveness.
            failureThreshold: 2
            timeoutSeconds: 15
          {{- with .Values.nginxResources }}
          resources:
            {{- . | toYaml | trim | nindent 12 }}
          {{- end }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: {{ .Values.nginxConfigMap.name | default (printf "%s-nginx-conf" $fullName) }}
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            - name: nginx-tmp
              mountPath: /tmp
            {{- if .Values.serveRailsAssetsFromFilesystem }}
            - name: assets
              mountPath: /assets
            {{- end }}
            {{- with .Values.nginxExtraVolumeMounts }}
              {{ . | toYaml | trim | nindent 12 }}
            {{- end }}
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "15"] # To allow time for ALB to deregister pod before termination
{{- end }}