feat: add platform infra sub2api deployment

2026-06-09 02:24:17 +00:00
parent 8c413aa557
commit 80ef698498
6 changed files with 1220 additions and 0 deletions
@@ -0,0 +1,412 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: platform-infra
+  labels:
+    app.kubernetes.io/name: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+    unidesk.ai/runtime-node: G14
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sub2api-config
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+data:
+  AUTO_SETUP: "true"
+  SERVER_HOST: "0.0.0.0"
+  SERVER_PORT: "8080"
+  SERVER_MODE: "release"
+  RUN_MODE: "standard"
+  DATABASE_HOST: "sub2api-postgres"
+  DATABASE_PORT: "5432"
+  DATABASE_USER: "sub2api"
+  DATABASE_DBNAME: "sub2api"
+  DATABASE_SSLMODE: "disable"
+  DATABASE_MAX_OPEN_CONNS: "10"
+  DATABASE_MAX_IDLE_CONNS: "2"
+  DATABASE_CONN_MAX_LIFETIME_MINUTES: "30"
+  DATABASE_CONN_MAX_IDLE_TIME_MINUTES: "5"
+  REDIS_HOST: "sub2api-redis"
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: ""
+  REDIS_DB: "0"
+  REDIS_POOL_SIZE: "32"
+  REDIS_MIN_IDLE_CONNS: "2"
+  REDIS_ENABLE_TLS: "false"
+  ADMIN_EMAIL: "admin@sub2api.platform-infra.local"
+  JWT_EXPIRE_HOUR: "24"
+  TZ: "Asia/Shanghai"
+  SECURITY_URL_ALLOWLIST_ENABLED: "false"
+  SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP: "false"
+  SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS: "false"
+  SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS: ""
+  UPDATE_PROXY_URL: ""
+  GATEWAY_OPENAI_RESPONSE_HEADER_TIMEOUT: "0"
+  GATEWAY_OPENAI_HTTP2_ENABLED: "true"
+  GATEWAY_OPENAI_HTTP2_ALLOW_PROXY_FALLBACK_TO_HTTP1: "true"
+  GATEWAY_OPENAI_HTTP2_FALLBACK_ERROR_THRESHOLD: "2"
+  GATEWAY_OPENAI_HTTP2_FALLBACK_WINDOW_SECONDS: "60"
+  GATEWAY_OPENAI_HTTP2_FALLBACK_TTL_SECONDS: "600"
+  GATEWAY_IMAGE_STREAM_DATA_INTERVAL_TIMEOUT: "900"
+  GATEWAY_IMAGE_STREAM_KEEPALIVE_INTERVAL: "10"
+  GATEWAY_IMAGE_CONCURRENCY_ENABLED: "false"
+  GATEWAY_IMAGE_CONCURRENCY_MAX_CONCURRENT_REQUESTS: "0"
+  GATEWAY_IMAGE_CONCURRENCY_OVERFLOW_MODE: "reject"
+  GATEWAY_IMAGE_CONCURRENCY_WAIT_TIMEOUT_SECONDS: "30"
+  GATEWAY_IMAGE_CONCURRENCY_MAX_WAITING_REQUESTS: "100"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sub2api-data
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api
+    app.kubernetes.io/component: app
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sub2api-redis-data
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api-redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sub2api-postgres
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api-postgres
+    app.kubernetes.io/component: postgres
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  selector:
+    app.kubernetes.io/name: sub2api-postgres
+    app.kubernetes.io/component: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sub2api-redis
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api-redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  selector:
+    app.kubernetes.io/name: sub2api-redis
+    app.kubernetes.io/component: redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: redis
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sub2api
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api
+    app.kubernetes.io/component: app
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  selector:
+    app.kubernetes.io/name: sub2api
+    app.kubernetes.io/component: app
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: sub2api-postgres
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api-postgres
+    app.kubernetes.io/component: postgres
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  serviceName: sub2api-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sub2api-postgres
+      app.kubernetes.io/component: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sub2api-postgres
+        app.kubernetes.io/component: postgres
+        app.kubernetes.io/part-of: platform-infra
+    spec:
+      securityContext:
+        fsGroup: 70
+      containers:
+        - name: postgres
+          image: postgres:18-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: sub2api
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sub2api-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              value: sub2api
+            - name: PGDATA
+              value: /var/lib/postgresql/data
+            - name: TZ
+              value: Asia/Shanghai
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U sub2api -d sub2api -h 127.0.0.1
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U sub2api -d sub2api -h 127.0.0.1
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+        labels:
+          app.kubernetes.io/name: sub2api-postgres
+          app.kubernetes.io/component: postgres
+          app.kubernetes.io/part-of: platform-infra
+          app.kubernetes.io/managed-by: unidesk
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        resources:
+          requests:
+            storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sub2api-redis
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api-redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sub2api-redis
+      app.kubernetes.io/component: redis
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sub2api-redis
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/part-of: platform-infra
+    spec:
+      securityContext:
+        fsGroup: 999
+      containers:
+        - name: redis
+          image: redis:8-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+          args:
+            - redis-server --save 60 1 --appendonly yes --appendfsync everysec
+          ports:
+            - name: redis
+              containerPort: 6379
+          env:
+            - name: TZ
+              value: Asia/Shanghai
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: sub2api-redis-data
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sub2api
+  namespace: platform-infra
+  labels:
+    app.kubernetes.io/name: sub2api
+    app.kubernetes.io/component: app
+    app.kubernetes.io/part-of: platform-infra
+    app.kubernetes.io/managed-by: unidesk
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sub2api
+      app.kubernetes.io/component: app
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sub2api
+        app.kubernetes.io/component: app
+        app.kubernetes.io/part-of: platform-infra
+    spec:
+      securityContext:
+        fsGroup: 1000
+      initContainers:
+        - name: wait-postgres
+          image: postgres:18-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - until pg_isready -h sub2api-postgres -U sub2api -d sub2api; do sleep 2; done
+        - name: wait-redis
+          image: redis:8-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - until redis-cli -h sub2api-redis ping | grep -q PONG; do sleep 2; done
+      containers:
+        - name: sub2api
+          image: __SUB2API_IMAGE__
+          imagePullPolicy: __SUB2API_IMAGE_PULL_POLICY__
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: sub2api-config
+          env:
+            - name: DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sub2api-secrets
+                  key: POSTGRES_PASSWORD
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sub2api-secrets
+                  key: ADMIN_PASSWORD
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: sub2api-secrets
+                  key: JWT_SECRET
+            - name: TOTP_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: sub2api-secrets
+                  key: TOTP_ENCRYPTION_KEY
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
+          volumeMounts:
+            - name: sub2api-data
+              mountPath: /app/data
+      volumes:
+        - name: sub2api-data
+          persistentVolumeClaim:
+            claimName: sub2api-data