forust
11e92fdf4e
A connection that died silently used to hang until the job timeout, and the stage was never re-run. One flaky TCP session cost a whole 45-minute apply, and the symptom - a job that stops mid-output with no error - is what made the last few deploy failures expensive to read. ServerAliveInterval/CountMax cap how long a dead peer goes unnoticed at ~60s, ConnectTimeout caps setup. Only exit 255 - ssh's own transport failures - is retried, up to three attempts with a growing gap. A stage that fails on its own merits exits with the remote's status, so a real failure surfaces its own log immediately instead of being repeated three times over 45 minutes. The stages are declarative applies, so re-running one that had already committed is harmless. The stage environment now goes through `env` as separate argv entries rather than one interpolated string, so nothing in REPO, DEPLOY_SHA or DEPLOY_SNAPSHOT_DIR is re-split by the remote shell. Verified against a stubbed ssh: clean run attempts once, a single transport failure recovers on attempt 2 and exits 0, three failures give up preserving 255, and a stage failing with 1 or 7 attempts once and passes the code through unchanged. Also records why USERBOT_IMAGE stays on the prod tag: render_pinned rewrites only plain `image:` lines, and this ref is what the panel injects into the per-instance Deployments it creates, so those instances track the tag rather than the panel's own resolved digest. The two panel-created instances currently in the cluster are digest-pinned, so the panel does accept one either way; the tag is the choice, not a limitation.
272 lines
5.2 KiB
YAML
272 lines
5.2 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: userbot
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: userbot-runtime
|
|
namespace: userbot
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: userbot-common-config
|
|
namespace: userbot
|
|
data:
|
|
DATABASE_TYPE: ""
|
|
DATABASE_NAME: ""
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
rules:
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments/scale
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- persistentvolumeclaims
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- metrics.k8s.io
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: userbot-panel
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: userbot-panel-legacy
|
|
namespace: default
|
|
rules:
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- patch
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments/scale
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- persistentvolumeclaims
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- metrics.k8s.io
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: userbot-panel-legacy
|
|
namespace: default
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: userbot-panel-legacy
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
labels:
|
|
app: userbot-panel
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: userbot-panel
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: userbot-panel
|
|
spec:
|
|
serviceAccountName: userbot-panel
|
|
containers:
|
|
- name: userbot-panel
|
|
image: gcr.forust.xyz/forust/userbot-panel:prod
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
env:
|
|
- name: USERBOT_NAMESPACE
|
|
value: userbot
|
|
- name: USERBOT_LEGACY_NAMESPACES
|
|
value: default
|
|
- name: USERBOT_IMAGE
|
|
# The build pushes main/prod only. The deploy resolves every gcr ref in
|
|
# this file, so a :latest here aborts the whole apply as unresolvable.
|
|
# Deliberately left on the tag: render_pinned only rewrites plain
|
|
# `image:` lines to a digest, and this ref is what the panel injects
|
|
# into the per-instance Deployments it creates. Instances track prod
|
|
# rather than the panel's own resolved digest.
|
|
value: gcr.forust.xyz/forust/userbot:prod
|
|
- name: USERBOT_STORAGE_CLASS
|
|
value: local-path-retain
|
|
- name: USERBOT_DOWNLOADS_HOST_PATH
|
|
value: /srv/homelab/userbot/Downloads
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 96Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 384Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: userbot-panel
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: userbot-panel-route
|
|
namespace: userbot
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`userbot.workstation.internal`)
|
|
kind: Rule
|
|
services:
|
|
- name: userbot-panel
|
|
port: 8080
|
|
tls:
|
|
secretName: internal-wildcard-tls
|