a628adeb35
Replace DaemonSet with direct host API access in favor of a regular Deployment using Service trafficDistribution: PreferClose. This provides prefer-local routing to the nearest cozystack-api pod with fallback to remote pods when local one is unavailable. - Replace DaemonSet/Deployment toggle with always-Deployment - Replace internalTrafficPolicy: Local with trafficDistribution: PreferClose - Remove KUBERNETES_SERVICE_HOST/PORT override (use default kubernetes service) - Replace hard nodeSelector with soft nodeAffinity for control-plane nodes - Simplify migration hook to always clean up DaemonSet if present Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cozystack-api
|
|
namespace: cozy-system
|
|
labels:
|
|
app: cozystack-api
|
|
spec:
|
|
replicas: {{ .Values.cozystackAPI.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
app: cozystack-api
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: cozystack-api
|
|
spec:
|
|
tolerations:
|
|
- operator: Exists
|
|
serviceAccountName: cozystack-api
|
|
affinity:
|
|
nodeAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
preference:
|
|
matchExpressions:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
containers:
|
|
- name: cozystack-api
|
|
args:
|
|
- --tls-cert-file=/tmp/cozystack-api-certs/tls.crt
|
|
- --tls-private-key-file=/tmp/cozystack-api-certs/tls.key
|
|
image: "{{ .Values.cozystackAPI.image }}"
|
|
ports:
|
|
- containerPort: 443
|
|
name: https
|
|
volumeMounts:
|
|
- name: cozystack-api-certs
|
|
mountPath: /tmp/cozystack-api-certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: cozystack-api-certs
|
|
secret:
|
|
secretName: cozystack-api-cert
|
|
defaultMode: 0400
|