added mcpacks application to server packwiz pack.toml files. initial

2026-09-04 11:56:08 +00:00
parent e5c018ce8f
commit e08b9dccc7
6 changed files with 164 additions and 0 deletions
@@ -0,0 +1,83 @@
+# SWS (Static Web Server) serves an image containing only committed Packwiz
+# files. There is no writable volume to drift from Git and no database to back
+# up; publishing a new image is the complete deployment operation.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mcpacks
+  namespace: mcpacks
+spec:
+  # Two copies allow one Pod to keep serving Minecraft clients while the other
+  # is replaced during an image rollout or rescheduled after a node failure.
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: mcpacks
+  template:
+    metadata:
+      labels:
+        app: mcpacks
+    spec:
+      # SWS only reads files from its image and never calls the Kubernetes API,
+      # so do not inject the namespace's default API credential into its Pods.
+      automountServiceAccountToken: false
+      # Keep normal replica placement balanced across nodes. maxSkew 1 still
+      # permits one temporary surge Pod during a zero-downtime rollout; strict
+      # anti-affinity would deadlock that rollout when only two workers exist.
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: mcpacks
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mcpacks
+          # The publishing workflow replaces this bootstrap tag with an
+          # immutable OCI digest. Never deploy the mutable latest tag after
+          # bootstrap: recording the digest makes rollbacks and audits reliable.
+          image: tea.ahmza.com/ahmza/mcpacks-site:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            # The upstream image does not declare USER itself. Set an explicit
+            # unprivileged identity so runAsNonRoot is enforceable rather than
+            # causing Kubernetes to reject the container as potentially root.
+            runAsUser: 10001
+            runAsGroup: 10001
+            capabilities:
+              drop:
+                - ALL
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 250m
+              memory: 64Mi