feat/app-refs-pg-resources #353

Open

johnride wants to merge 3 commits from feat/app-refs-pg-resources into master

Author	SHA1	Message	Date
Jean-Gabriel Gill-Couture	a0c1da4c51	feat(k8s): K8sDeploymentScore renders a hardened web workload All checks were successful Run Check Script / check (pull_request) Successful in 3m24s Details - builder: port or health_checked_port (+ ClusterIP Service, HTTP probes), typed env (EnvValue), pull secret, replicas, recreate, resources, wait - labels/selector: component, managed-by, part-of (same as the removed Application lowering, so its Deployments apply in place) - restricted pod: non-root, RuntimeDefault seccomp, drop ALL, no SA token - lamp: runs as its uid 1000 user and gets the Service its Ingress targets; its selector changes from app=<name>, so delete an existing lamp Deployment once - examples: frontends on nginx-unprivileged (8080); docs follow the API	2026-10-23 09:43:52 -04:00
Jean-Gabriel Gill-Couture	5afa41f65e	feat: typed Refs for app env (ADR-028) - k8s::env: SecretKey, ConfigMapKey, EnvValue -> native EnvVar - K8sPostgreSQLScore::app_account_ref (uri, jdbc_uri on {cluster}-app) - ObjectBucketScore::bucket_ref (endpoint, bucket, region, keys) - Zitadel contract outputs: client_id(), project_id()	2026-10-23 09:35:10 -04:00
Jean-Gabriel Gill-Couture	e902cf39cb	feat(postgresql): set CPU and memory resources on CNPG clusters - PostgreSQLConfig.resources maps to Cluster spec.resources (primary and replica) - K8sPostgreSQLScore::resources builder - primary_cluster() extracted so the render is unit-tested	2026-10-23 09:04:21 -04:00

Author

SHA1

Message

Date

Jean-Gabriel Gill-Couture

a0c1da4c51

feat(k8s): K8sDeploymentScore renders a hardened web workload

Run Check Script / check (pull_request) Successful in 3m24s

Details

- builder: port or health_checked_port (+ ClusterIP Service, HTTP probes),
  typed env (EnvValue), pull secret, replicas, recreate, resources, wait
- labels/selector: component, managed-by, part-of (same as the removed
  Application lowering, so its Deployments apply in place)
- restricted pod: non-root, RuntimeDefault seccomp, drop ALL, no SA token
- lamp: runs as its uid 1000 user and gets the Service its Ingress targets;
  its selector changes from app=<name>, so delete an existing lamp
  Deployment once
- examples: frontends on nginx-unprivileged (8080); docs follow the API

2026-10-23 09:43:52 -04:00

Jean-Gabriel Gill-Couture

5afa41f65e

feat: typed Refs for app env (ADR-028)

- k8s::env: SecretKey, ConfigMapKey, EnvValue -> native EnvVar
- K8sPostgreSQLScore::app_account_ref (uri, jdbc_uri on {cluster}-app)
- ObjectBucketScore::bucket_ref (endpoint, bucket, region, keys)
- Zitadel contract outputs: client_id(), project_id()

2026-10-23 09:35:10 -04:00

Jean-Gabriel Gill-Couture

e902cf39cb

feat(postgresql): set CPU and memory resources on CNPG clusters

- PostgreSQLConfig.resources maps to Cluster spec.resources (primary and replica)
- K8sPostgreSQLScore::resources builder
- primary_cluster() extracted so the render is unit-tested

2026-10-23 09:04:21 -04:00

feat/app-refs-pg-resources #353

3 Commits