Kubernetes¶

The repository contains a Helm chart in helmchart/. It deploys the app as a Deployment with Service, Ingress (Traefik, TLS via cert-manager), optionally a PodDisruptionBudget and a PodMonitor.

Values¶

Value	Default	Description
`image.repository`, `image.tag`	empty	the image; the tag is set by the pipeline
`imagePullSecrets`	`[]`	e.g. `[{name: regcred}]` for the private registry
`envFromSecret`	empty	existing Secret whose keys become environment variables (`DATABASE_URL`, `TARGETLOG_ADMIN_TOKEN`)
`env`	`TARGETLOG_TRUST_PROXY: "true"`, `TARGETLOG_LOG_LEVEL: info`	plain environment variables
`web.replicas`	`2`	replicas; with more than one a PodDisruptionBudget is created
`metrics.podMonitor.enabled`	`false`	needs the Prometheus operator CRDs
`ingress.hosts`	`[]`	host names
`ingress.tls.clusterIssuer`	`letsencrypt`	cert-manager ClusterIssuer
`priorityClassName`	empty	e.g. `production` or `staging`

The pods run as non-root with a read-only root filesystem and all capabilities dropped.

Example¶

kubectl -n targetlog create secret generic targetlog-env \
  --from-literal=DATABASE_URL='postgres://targetlog:secret@pg-rw.postgres:5432/targetlog?sslmode=require' \
  --from-literal=TARGETLOG_ADMIN_TOKEN="$(openssl rand -base64 32)"

helm upgrade --install targetlog-app helmchart -n targetlog \
  --set image.repository=registry.berg-systems.ch/targetlog/server \
  --set image.tag=v0.3.0 \
  --set envFromSecret=targetlog-env \
  --set 'ingress.hosts[0]=targetlog.example.org'

Do not put a connection pooler in transaction mode between the app and PostgreSQL: every replica keeps one LISTEN connection for realtime events.

The hosted installation¶

app.targetlog.ch runs on this chart, deployed by GitLab CI; see CI/CD. Per environment, deploy/staging.yaml and deploy/production.yaml hold the deviations from the defaults.