GovOPlaN/govoplan
2
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Release v0.1.16
Dependency Audit / dependency-audit (push) Failing after 1m47s
Details
Deployment Installer / deployment-installer (push) Successful in 6s
Details
Security Audit / security-audit (push) Successful in 11m18s
Details
Developer Meta-package Release / publish-package (push) Successful in 11s
Details

Browse Source
This commit is contained in:
zemion
2026-08-05 19:52:32 +02:00
parent 61463a24cb
commit 3ca068f76a
42 changed files with 5433 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SCALING_AND_MULTI_HOST_DEPLOYMENT.md
+21 -4
View File
@@ -3,6 +3,8 @@
For the exact external handoff, least-privilege collector permissions and live
two-node acceptance procedure, see
[`PRODUCTION_TARGET_HANDOFF.md`](PRODUCTION_TARGET_HANDOFF.md).
For a reproducible local or multi-hypervisor libvirt/K3s target, use
[`KUBERNETES_TEST_LAB.md`](KUBERNETES_TEST_LAB.md).
## Implemented Contract
@@ -74,6 +76,7 @@ python tools/deployment/govoplan-deploy.py render-kubernetes \
--namespace govoplan \
--secret-name govoplan-runtime \
--tls-secret-name govoplan-tls \
--s3-ca-secret-name govoplan-s3-ca \
--ingress-class-name nginx \
--output /srv/govoplan/default/kubernetes.json
```
@@ -90,11 +93,25 @@ command prints the exact required key contract. Review the generated
`FORWARDED_ALLOW_IPS` value and replace it with the exact ingress-proxy network
before production use.
When an external S3 endpoint is signed by a private CA, create the optional CA
Secret with a `ca.crt` key and pass `--s3-ca-secret-name`. The renderer mounts
that Secret read-only and sets `AWS_CA_BUNDLE` for API, worker, scheduler,
migration and database-wait containers. It does not disable certificate
verification or replace the WebUI trust store.
The generated containers run as non-root with a read-only root filesystem and
an ephemeral `/tmp`. Runtime Deployments wait for the exact configured database
migration heads before starting. The API exposes `/health/ready`, which fails
while that API node is draining or cannot prove its runtime-coordination
heartbeat.
an ephemeral `/tmp`. Celery Beat keeps its replaceable schedule database there;
durable schedule definitions remain in shared state. The WebUI resolves its
configured API Service when the container starts, so Kubernetes deployments do
not inherit the Compose-only `load-balancer` hostname. Runtime Deployments wait
for the exact dependency-resolved database migration heads before starting.
The API exposes `/health/ready`, which fails while that API node is draining or
cannot prove its runtime-coordination heartbeat.
Replicated API, WebUI, and worker Deployments use a hard hostname-spread
constraint scoped to the current pod-template hash. A rollout therefore keeps
each replica set distributed across independently schedulable nodes instead of
allowing all replacement pods to settle on one node after the old set exits.
## Runtime Coordination