foxhunt/infra/k8s/services/web-gateway.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-gateway
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: web-gateway
    app.kubernetes.io/part-of: foxhunt
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: web-gateway
  template:
    metadata:
      annotations:
        gitlab.com/prometheus_scrape: "true"
        gitlab.com/prometheus_port: "9098"
        gitlab.com/prometheus_path: "/metrics"
      labels:
        app.kubernetes.io/name: web-gateway
        app.kubernetes.io/part-of: foxhunt
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      imagePullSecrets:
        - name: scw-registry
      nodeSelector:
        k8s.scaleway.com/pool-name: foxhunt
      initContainers:
        - name: fetch-binary
          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -e
              RCLONE_FLAGS="--s3-provider=Minio --s3-endpoint=https://minio.foxhunt.svc.cluster.local:9000 --s3-access-key-id=${MINIO_ACCESS_KEY} --s3-secret-access-key=${MINIO_SECRET_KEY} --s3-no-check-bucket --no-check-certificate"
              rclone copyto ":s3:foxhunt-binaries/services/web-gateway" "/binaries/web-gateway" $RCLONE_FLAGS
              chmod +x /binaries/web-gateway
              echo "Fetched web-gateway ($(stat -c%s /binaries/web-gateway) bytes)"
              rclone copy ":s3:foxhunt-binaries/static/" "/binaries/static/" $RCLONE_FLAGS
              echo "Fetched static assets"
          env:
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: minio-credentials
                  key: access-key
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: minio-credentials
                  key: secret-key
          volumeMounts:
            - name: binaries
              mountPath: /binaries
          resources:
            requests:
              cpu: 100m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
      containers:
        - name: web-gateway
          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          command: ["/binaries/web-gateway"]
          ports:
            - containerPort: 3000
              name: http
            - containerPort: 9098
              name: metrics
          env:
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: jwt-secret
                  key: secret
            - name: TRADING_SERVICE_URL
              value: "http://api-gateway:50051"
            - name: BACKTESTING_SERVICE_URL
              value: "http://backtesting-service:50053"
            - name: ML_TRAINING_SERVICE_URL
              value: "http://ml-training-service:50053"
            - name: TRADING_AGENT_SERVICE_URL
              value: "http://trading-agent-service:50055"
            - name: BROKER_GATEWAY_SERVICE_URL
              value: "http://broker-gateway:50056"
            - name: API_GATEWAY_URL
              value: "http://api-gateway:50051"
            - name: RUST_LOG
              value: "info,opentelemetry=warn,h2=warn,tonic=warn,hyper=warn"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://tempo.foxhunt.svc.cluster.local:4317"
          volumeMounts:
            - name: binaries
              mountPath: /binaries
              readOnly: true
            - name: tmp
              mountPath: /tmp
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 30
            periodSeconds: 15
            failureThreshold: 5
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
      volumes:
        - name: binaries
          emptyDir:
            sizeLimit: 500Mi
        - name: tmp
          emptyDir:
            sizeLimit: 50Mi
---
apiVersion: v1
kind: Service
metadata:
  name: web-gateway
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: web-gateway
    app.kubernetes.io/part-of: foxhunt
spec:
  selector:
    app.kubernetes.io/name: web-gateway
  ports:
    - port: 3000
      targetPort: 3000
      name: http
    - port: 9098
      targetPort: 9098
      name: metrics