hrbox-helm-chart/.helm/templates/02-web.yaml

{{- $name := include "hrbox.component" (dict "ctx" . "name" "web") -}}
{{/*
Веб-под: PHP-FPM, nginx перед ним и экспортёр метрик FPM.
При app.tracing.enabled рядом поднимается коллектор OpenTelemetry.

Аннотации checksum перезапускают поды, когда меняется конфигурация nginx или
секрет приложения: без них правка ConfigMap остаётся незамеченной до
следующего рестарта.
*/}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $name }}
  labels:
    {{- include "hrbox.labels" (dict "ctx" . "name" "web") | nindent 4 }}
spec:
  minReadySeconds: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  replicas: {{ .Values.app.replicas.web }}
  selector:
    matchLabels:
      {{- include "hrbox.selectorLabels" (dict "ctx" . "name" "web") | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "hrbox.selectorLabels" (dict "ctx" . "name" "web") | nindent 8 }}
        app: web
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9253'
        checksum/nginx-config: {{ include (print $.Template.BasePath "/01-nginx-configmap.yaml") . | sha256sum }}
        checksum/app-secret: {{ include (print $.Template.BasePath "/00-app-secret.yaml") . | sha256sum }}
    spec:
      terminationGracePeriodSeconds: 30
      {{- include "hrbox.imagePullSecrets" . | nindent 6 }}
      containers:
        - name: fpm
          image: {{ .Values.image.hrbox | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["/usr/local/sbin/php-fpm", "-c", "/usr/local/etc/php-fpm"]
          ports:
            - name: fpm
              containerPort: 9000
          env:
            {{- include "envs_all" . | indent 12 }}
            {{- include "envs_nanabush_player_signing" . | indent 12 }}
            - name: VIDEO_CONVERTER_ENABLED
              value: {{ .Values.app.videoConverter.enabled | quote }}
            {{- if .Values.app.tracing.enabled }}
            {{- include "envs_tracing" . | indent 12 }}
            {{- end }}
          {{- include "hrbox.resources" (dict "ctx" . "component" "app") | indent 10 }}
          lifecycle:
            # Пауза даёт ingress-контроллеру убрать под из балансировки,
            # прежде чем FPM начнёт корректное завершение.
            preStop:
              exec:
                command:
                  - sh
                  - '-c'
                  - sleep 15 && kill -SIGQUIT 1
          readinessProbe:
            tcpSocket:
              port: 9000
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: 9000
            initialDelaySeconds: 5
            periodSeconds: 10

        - name: nginx
          image: {{ .Values.image.hrbox | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["/usr/sbin/nginx", "-g", "daemon off;"]
          ports:
            - name: http
              containerPort: 80
          env:
            {{- include "envs_all" . | indent 12 }}
          {{- include "hrbox.resources" (dict "ctx" . "component" "nginx") | indent 10 }}
          lifecycle:
            preStop:
              exec:
                command:
                  - sh
                  - '-c'
                  - sleep 15 && /usr/sbin/nginx -s quit
          # /healthz отвечает сам nginx, /health-check проверяет,
          # что за ним жив PHP-FPM.
          livenessProbe:
            httpGet:
              path: /healthz
              port: 80
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /health-check
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 5
            timeoutSeconds: 10
            failureThreshold: 3
          volumeMounts:
            - name: configs
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            - name: assetlinks
              mountPath: /var/www/assetlinks/assetlinks.json
              subPath: assetlinks.json
            - name: assetlinks
              mountPath: /var/www/assetlinks/apple-app-site-association
              subPath: apple-app-site-association

        {{- if .Values.app.tracing.enabled }}
        - name: otel-collector
          image: {{ .Values.image.otelCollector | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["--config=/etc/otel-config/otel-collector-config.yaml"]
          ports:
            - containerPort: 4317
              name: otlp-grpc
            - containerPort: 4318
              name: otlp-http
          volumeMounts:
            - name: otel-config
              mountPath: /etc/otel-config/otel-collector-config.yaml
              subPath: config.yml
        {{- end }}

        - name: phpfpm-exporter
          image: {{ .Values.image.phpFpmExporter | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - containerPort: 9253
              name: metrics
          env:
            - name: PHP_FPM_SCRAPE_URI
              value: "tcp://127.0.0.1:9000/hrbox-fpm-status"

      volumes:
        - name: configs
          configMap:
            name: web-configuration
            defaultMode: 420
        - name: assetlinks
          configMap:
            name: assetlinks
            defaultMode: 420
        {{- if .Values.app.tracing.enabled }}
        - name: otel-config
          configMap:
            name: otel-config
            defaultMode: 420
        {{- end }}

---
apiVersion: v1
kind: Service
metadata:
  name: {{ $name }}
  labels:
    {{- include "hrbox.labels" (dict "ctx" . "name" "web") | nindent 4 }}
spec:
  selector:
    {{- include "hrbox.selectorLabels" (dict "ctx" . "name" "web") | nindent 4 }}
  ports:
    - name: http
      port: 80
      protocol: TCP