atlas-botandClaude Opus 5.5
21a7583523
Comments that pointed at other YAML as `file.yaml:N` went stale on any edit above the cited line; three drift fixes had been merged by hand (REN-181). The cited block now carries `# anchor: <name>` and the comment cites `path.yaml#<name>`. - Sweep: all 32 line-number citations in YAML comments converted. Several were already stale at head and now point at the right block (see PR). Vendored files (Flux gotk-components, IMC CRD) get no anchor; those two citations name the object/schema path instead. - Guard: scripts/ci/yaml-citations.sh in ci-manifests-test.yml; fails on a line-number citation or a path#name whose file/anchor is gone. Self-test in ci-scripts-test.yml. - CONTRIBUTING.md: the convention in three lines. Comment-only under kubernetes/: every file parses to identical objects before and after, so Flux applies nothing and no ConfigMap data changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
91 lines
2.9 KiB
YAML
91 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gatus
|
|
namespace: apps
|
|
labels:
|
|
app: gatus
|
|
annotations:
|
|
# anchor: reloader
|
|
# Gatus reads its config once at startup and never re-reads the file, so
|
|
# without this a ConfigMap change reconciles cleanly and then does nothing:
|
|
# git and the running checks drift apart silently, with no failed resource
|
|
# to notice. Adding a check would not take effect either.
|
|
configmap.reloader.stakater.com/reload: gatus-config
|
|
spec:
|
|
replicas: 1
|
|
# RWO PVC (`gatus-data`, ceph-block) — RollingUpdate's default 25% surge
|
|
# tries to start the new pod before terminating the old one, but the
|
|
# RWO claim can't be mounted twice and the new pod hangs in
|
|
# ContainerCreating forever (no event, just stuck). Recreate guarantees
|
|
# the old pod releases the volume first.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: gatus
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gatus
|
|
spec:
|
|
# The upstream image is FROM scratch with no USER, so without this the
|
|
# pod runs as root and trips PodSecurity restricted on four counts.
|
|
#
|
|
# The uid is numeric because a scratch image carries no /etc/passwd for
|
|
# the kubelet to resolve a name against. fsGroup is what makes the switch
|
|
# survivable: the only write path is the sqlite store on the RWO volume
|
|
# (/data/gatus.db, see the storage stanza in the ConfigMap), and fsGroup
|
|
# both chowns the existing volume and leaves the directory group-writable
|
|
# so sqlite can create its -wal and -journal siblings next to the db.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: gatus
|
|
image: twinproduction/gatus:v5.37.0 # {"$imagepolicy": "flux-system:gatus"}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config/config.yaml
|
|
subPath: config.yaml
|
|
readOnly: true
|
|
- name: data
|
|
mountPath: /data
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 256Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: gatus-config
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: gatus-data
|