deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-services
  labels:
    app: backend-services
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: backend-services
  template:
    metadata:
      labels:
        app: backend-services
    spec:
      # Allow 60 seconds for graceful shutdown: complete in-flight requests,
      # close database connections, and clean up resources before forced termination.
      terminationGracePeriodSeconds: 60
      # IMPORTANT: When scaling this deployment, use gradual scaling or update the
      # deployment's replicas field (which triggers rolling updates). Do NOT use
      # `kubectl scale --replicas=N` to jump from 1->N replicas instantly, as this
      # would cause N pods to start simultaneously and race to run migrations.
      # With RollingUpdate strategy (maxSurge: 1), new pods start sequentially during
      # normal deployments, so the migrate-db initContainer runs safely one at a time.
      initContainers:
      - name: migrate-db
        # Tag is resolved only when a NEW pod is created. After pushing a new image, run: oc rollout restart deployment/backend-services -n <namespace>
        image: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services:main-latest
        imagePullPolicy: Always
        workingDir: /app
        # Use the installed Prisma version from node_modules to avoid npx installing latest
        # This ensures we use the version specified in package.json (7.0.1) instead of latest
        # Note: Permissions on public schema are granted via PostgresCluster postInitSQL
        # Crunchy Postgres on OpenShift requires SSL; use libpq-compat so sslmode=require accepts self-signed certs
        command:
          - sh
          - -c
          - |
            u="$DATABASE_URL"
            if [ -n "$PGSSLMODE" ]; then
              sep="?"
              case "$u" in *\?*) sep="&";; esac
              export DATABASE_URL="${u}${sep}sslmode=${PGSSLMODE}&uselibpqcompat=true"
            fi
            node_modules/.bin/prisma migrate deploy --schema=/app/shared/prisma/schema.prisma || npx prisma@7.0.1 migrate deploy --schema=/app/shared/prisma/schema.prisma
        env:
        # DATABASE_URL should be provided via a Secret containing the PostgreSQL connection string
        # Format: postgresql://username:password@postgres-cluster-primary:5432/api
        # The Secret should be created from the PostgresCluster credentials
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: app-pg-pguser-admin
              key: uri
        - name: PGSSLMODE
          value: "require"
        # Crunchy Postgres uses self-signed certs; disable TLS cert verification
        - name: PGSSLREJECTUNAUTHORIZED
          value: "false"
        # Prisma CLI (migrate) uses Node TLS; allow self-signed for init container only
        - name: NODE_TLS_REJECT_UNAUTHORIZED
          value: "0"
        - name: NODE_ENV
          value: "production"
        # Optimize Node.js memory usage for migrations
        - name: NODE_OPTIONS
          value: "--max-old-space-size=384"
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      containers:
      - name: backend-services
        # Tag is resolved only when a NEW pod is created. After pushing a new image, run: oc rollout restart deployment/backend-services -n <namespace>
        image: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services:main-latest
        imagePullPolicy: Always
        command: ["sh", "-c"]
        args: ["node dist/main 2>&1 | tee -a /var/log/app/backend.log"]
        ports:
        - containerPort: 3002
          name: http
          protocol: TCP
        env:
        - name: PORT
          value: "3002"
        - name: NODE_ENV
          value: "production"
        - name: FRONTEND_URL
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: FRONTEND_URL
        - name: BOOTSTRAP_ADMIN_EMAIL
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: BOOTSTRAP_ADMIN_EMAIL
              optional: true
        - name: BACKEND_URL
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: BACKEND_URL
        - name: DATABASE_API_URL
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: DATABASE_API_URL
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: app-pg-pguser-admin
              key: uri
        - name: PGSSLMODE
          value: "require"
        # Crunchy Postgres uses self-signed certs; disable TLS cert verification
        - name: PGSSLREJECTUNAUTHORIZED
          value: "false"
        - name: SSO_AUTH_SERVER_URL
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: SSO_AUTH_SERVER_URL
        - name: SSO_REALM
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: SSO_REALM
        - name: SSO_CLIENT_ID
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: SSO_CLIENT_ID
        - name: SSO_REDIRECT_URI
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: SSO_REDIRECT_URI
        - name: SSO_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: backend-services-secrets
              key: SSO_CLIENT_SECRET
        - name: AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT
        - name: DOCUMENT_INTELLIGENCE_MODE
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: DOCUMENT_INTELLIGENCE_MODE
        - name: AZURE_DOC_INTELLIGENCE_MODELS
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: AZURE_DOC_INTELLIGENCE_MODELS
        - name: AZURE_DOCUMENT_INTELLIGENCE_API_KEY
          valueFrom:
            secretKeyRef:
              name: backend-services-secrets
              key: AZURE_DOCUMENT_INTELLIGENCE_API_KEY
        - name: TEMPORAL_ADDRESS
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: TEMPORAL_ADDRESS
        - name: TEMPORAL_NAMESPACE
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: TEMPORAL_NAMESPACE
        - name: TEMPORAL_TASK_QUEUE
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: TEMPORAL_TASK_QUEUE
        - name: BENCHMARK_TASK_QUEUE
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: BENCHMARK_TASK_QUEUE
        - name: ENABLE_BENCHMARK_QUEUE
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: ENABLE_BENCHMARK_QUEUE
        - name: BLOB_STORAGE_PROVIDER
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: BLOB_STORAGE_PROVIDER
        - name: MINIO_ENDPOINT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: MINIO_ENDPOINT
              optional: true
        - name: MINIO_DOCUMENT_BUCKET
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: MINIO_DOCUMENT_BUCKET
              optional: true
        - name: MINIO_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: minio-credentials
              key: MINIO_ROOT_USER
              optional: true
        - name: MINIO_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: minio-credentials
              key: MINIO_ROOT_PASSWORD
              optional: true
        - name: AZURE_STORAGE_CONTAINER_NAME
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: AZURE_STORAGE_CONTAINER_NAME
        - name: AZURE_STORAGE_CONNECTION_STRING
          valueFrom:
            secretKeyRef:
              name: backend-services-secrets
              key: AZURE_STORAGE_CONNECTION_STRING
        - name: AZURE_STORAGE_ACCOUNT_NAME
          valueFrom:
            secretKeyRef:
              name: backend-services-secrets
              key: AZURE_STORAGE_ACCOUNT_NAME
        - name: AZURE_STORAGE_ACCOUNT_KEY
          valueFrom:
            secretKeyRef:
              name: backend-services-secrets
              key: AZURE_STORAGE_ACCOUNT_KEY
        - name: BODY_LIMIT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: BODY_LIMIT
        - name: THROTTLE_GLOBAL_TTL_MS
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_GLOBAL_TTL_MS
        - name: THROTTLE_GLOBAL_LIMIT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_GLOBAL_LIMIT
        - name: THROTTLE_AUTH_TTL_MS
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_AUTH_TTL_MS
        - name: THROTTLE_AUTH_LIMIT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_AUTH_LIMIT
        - name: THROTTLE_AUTH_REFRESH_TTL_MS
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_AUTH_REFRESH_TTL_MS
        - name: THROTTLE_AUTH_REFRESH_LIMIT
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: THROTTLE_AUTH_REFRESH_LIMIT
        - name: DB_POOL_MAX
          valueFrom:
            configMapKeyRef:
              name: backend-services-config
              key: DB_POOL_MAX
        volumeMounts:
        - name: storage
          mountPath: /app/data/blobs
        - name: logs
          mountPath: /var/log/app
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health/live
            port: 3002
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 3002
            scheme: HTTP
          initialDelaySeconds: 15
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
      - name: logrotate
        image: debian:bookworm-slim
        command: ["sh", "-c"]
        args:
          - |
            while true; do
              logrotate /etc/logrotate.conf
              sleep 3600
            done
        volumeMounts:
        - name: logs
          mountPath: /var/log/app
        - name: logrotate-config
          mountPath: /etc/logrotate.d
          readOnly: true
        - name: logrotate-state
          mountPath: /var/lib/logrotate
        resources:
          requests:
            memory: "32Mi"
            cpu: "10m"
          limits:
            memory: "64Mi"
            cpu: "50m"
      - name: promtail
        image: grafana/promtail:3.4.2
        args:
          - -config.file=/etc/promtail/promtail.yaml
        volumeMounts:
        - name: logs
          mountPath: /var/log/app
          readOnly: true
        - name: promtail-config
          mountPath: /etc/promtail
          readOnly: true
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
      volumes:
      - name: storage
        persistentVolumeClaim:
          claimName: backend-services-storage
      - name: logs
        persistentVolumeClaim:
          claimName: backend-services-logs
      - name: logrotate-config
        configMap:
          name: backend-services-logrotate
      - name: logrotate-state
        emptyDir: {}
      - name: promtail-config
        configMap:
          name: backend-services-promtail