cultivaia-api — Helm Chart Production-Grade

# Helm 3 only — never apiVersion: v1 apiVersion: v2 name: cultivaia-api description: "CULTIVA IA Platform API — REST service for AI content generation and automation" type: application version: 0.1.0 # chart semver — increment on chart changes appVersion: "1.4.2" # application image tag maintainers: - name: Álvaro Gimeno email: alvarogimeno2002@gmail.com keywords: [cultivaia, api, ai, automation] home: https://cultivaia.com

# -- Number of replicas. Overridden by HPA when autoscaling.enabled=true. replicaCount: 2 image: # -- Container registry and image name repository: registry.hetzner.com/cultivaia/api # -- Image pull policy: IfNotPresent | Always | Never pullPolicy: IfNotPresent # -- Image tag. Defaults to .Chart.AppVersion when empty. tag: "" # -- List of imagePullSecrets names if registry requires authentication imagePullSecrets: [] service: type: ClusterIP port: 3000 ingress: enabled: true className: nginx annotations: cert-manager.io/cluster-issuer: letsencrypt-prod nginx.ingress.kubernetes.io/proxy-body-size: "10m" hosts: - host: api.cultivaia.com paths: - path: / pathType: Prefix tls: - secretName: cultivaia-api-tls hosts: [api.cultivaia.com] resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi autoscaling: enabled: true minReplicas: 2 maxReplicas: 6 targetCPUUtilizationPercentage: 70 env: NODE_ENV: production PORT: "3000" LOG_LEVEL: info # -- External Secrets Operator: name of the SecretStore in the namespace externalSecrets: enabled: true refreshInterval: 1h secretStoreName: hetzner-vault secretStoreKind: ClusterSecretStore remoteRef: cultivaia/prod/api serviceAccount: create: true automountServiceAccountToken: false name: "" podDisruptionBudget: enabled: true minAvailable: 1 networkPolicy: enabled: true ingressNamespace: ingress-nginx probes: liveness: path: /health initialDelaySeconds: 15 periodSeconds: 30 readiness: path: /ready initialDelaySeconds: 5 periodSeconds: 10

apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "cultivaia-api.fullname" . }} labels: {{- include "cultivaia-api.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} {{- end }} selector: matchLabels: {{- include "cultivaia-api.selectorLabels" . | nindent 6 }} template: metadata: labels: {{- include "cultivaia-api.selectorLabels" . | nindent 8 }} spec: serviceAccountName: {{ include "cultivaia-api.serviceAccountName" . }} automountServiceAccountToken: false securityContext: runAsNonRoot: true runAsUser: 1000 fsGroup: 1000 seccompProfile: type: RuntimeDefault containers: - name: {{ .Chart.Name }} securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: [ALL] image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: - name: http containerPort: 3000 envFrom: - secretRef: name: {{ include "cultivaia-api.fullname" . }}-secrets env: {{- range $k, $v := .Values.env }} - name: {{ $k }} value: {{ $v | quote }} {{- end }} livenessProbe: httpGet: { path: {{ .Values.probes.liveness.path }}, port: http } initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.probes.liveness.periodSeconds }} readinessProbe: httpGet: { path: {{ .Values.probes.readiness.path }}, port: http } initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.probes.readiness.periodSeconds }} resources: {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: tmp mountPath: /tmp volumes: - name: tmp emptyDir: {} affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: {{- include "cultivaia-api.selectorLabels" . | nindent 20 }} topologyKey: kubernetes.io/hostname

{{- if .Values.networkPolicy.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: {{ include "cultivaia-api.fullname" . }} labels: {{- include "cultivaia-api.labels" . | nindent 4 }} spec: podSelector: matchLabels: {{- include "cultivaia-api.selectorLabels" . | nindent 6 }} policyTypes: [Ingress, Egress] ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: {{ .Values.networkPolicy.ingressNamespace }} ports: - protocol: TCP port: 3000 egress: - # Allow DNS ports: [{ protocol: UDP, port: 53 }, { protocol: TCP, port: 53 }] - # Allow HTTPS outbound (Anthropic, OpenAI, Supabase, Lemon Squeezy) ports: [{ protocol: TCP, port: 443 }] {{- end }}

{{- if .Values.externalSecrets.enabled }} apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: {{ include "cultivaia-api.fullname" . }}-secrets labels: {{- include "cultivaia-api.labels" . | nindent 4 }} spec: refreshInterval: {{ .Values.externalSecrets.refreshInterval }} secretStoreRef: name: {{ .Values.externalSecrets.secretStoreName }} kind: {{ .Values.externalSecrets.secretStoreKind }} target: name: {{ include "cultivaia-api.fullname" . }}-secrets creationPolicy: Owner dataFrom: - extract: key: {{ .Values.externalSecrets.remoteRef }} # Pulls: OPENAI_API_KEY, ANTHROPIC_API_KEY, SUPABASE_URL, # SUPABASE_KEY, LEMON_SQUEEZY_WEBHOOK_SECRET {{- end }}