Trey t
bc3da007db
Step 1 — OTel SDK: cmd/api and cmd/worker initialize a tracer provider that exports OTLP/HTTP to obs.88oakapps.com (Jaeger all-in-one). Sampling is AlwaysSample in dev (DEBUG=true) and TraceIDRatioBased(0.1) in prod, overridable via OTEL_TRACES_SAMPLER_ARG. Service names are honeydue-api and honeydue-worker. otelecho.Middleware opens a span per HTTP request. Step 2 — Manual spans: storage_service.Upload now takes ctx and emits storage.upload + b2.PutObject spans (size_bytes, key, mime_type, bucket, result attrs). APNs Send/SendWithCategory and FCM sendOne emit per-token spans with topic, status_code, reason. Asynq middleware emits asynq.handle:<task_type> per job with retry/payload attrs and records asynq_job_duration_seconds. Step 3 — Database: otelgorm plugin registered in database.Connect, so any SQL emitted via db.WithContext(ctx) attaches to the request span. Every repository now exposes WithContext(ctx) *XRepository as the migration helper. TaskService.ListTasks and GetTasksByResidence are migrated end-to-end (ctx threaded through handler → service → repo); remaining services adopt the same pattern incrementally — pre-migration methods still emit untraced SQL via the unchanged db field. OBS_TRACES_URL and OBS_INGEST_TOKEN flow from deploy/prod.env → honeydue-secrets → api+worker Deployments via secretKeyRef (optional). 02-setup-secrets.sh sources them from prod.env on next run; manifests mark both env vars optional so the deployment rolls without traces if the secret is absent. ch15 observability doc now lists what produces spans today vs the remaining migration work, with the explicit per-method pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
155 lines
4.9 KiB
YAML
155 lines
4.9 KiB
YAML
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: api
|
||
namespace: honeydue
|
||
labels:
|
||
app.kubernetes.io/name: api
|
||
app.kubernetes.io/part-of: honeydue
|
||
spec:
|
||
replicas: 3
|
||
strategy:
|
||
type: RollingUpdate
|
||
rollingUpdate:
|
||
maxUnavailable: 0
|
||
maxSurge: 1
|
||
selector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: api
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app.kubernetes.io/name: api
|
||
app.kubernetes.io/part-of: honeydue
|
||
spec:
|
||
serviceAccountName: api
|
||
imagePullSecrets:
|
||
- name: ghcr-credentials
|
||
securityContext:
|
||
runAsNonRoot: true
|
||
runAsUser: 1000
|
||
runAsGroup: 1000
|
||
fsGroup: 1000
|
||
seccompProfile:
|
||
type: RuntimeDefault
|
||
containers:
|
||
- name: api
|
||
image: IMAGE_PLACEHOLDER # Replaced by 03-deploy.sh
|
||
ports:
|
||
- containerPort: 8000
|
||
protocol: TCP
|
||
securityContext:
|
||
allowPrivilegeEscalation: false
|
||
readOnlyRootFilesystem: true
|
||
capabilities:
|
||
drop: ["ALL"]
|
||
envFrom:
|
||
- configMapRef:
|
||
name: honeydue-config
|
||
env:
|
||
- name: POSTGRES_PASSWORD
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: POSTGRES_PASSWORD
|
||
- name: SECRET_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: SECRET_KEY
|
||
- name: EMAIL_HOST_PASSWORD
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: EMAIL_HOST_PASSWORD
|
||
- name: FCM_SERVER_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: FCM_SERVER_KEY
|
||
- name: REDIS_PASSWORD
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: REDIS_PASSWORD
|
||
optional: true
|
||
# B2 (Backblaze) credentials. With both set, StorageConfig.IsS3()
|
||
# returns true and uploads stream to B2 via minio-go. With either
|
||
# missing, code falls back to local filesystem — and since
|
||
# readOnlyRootFilesystem is true on this container, that fallback
|
||
# silently fails. So both must be wired or uploads break.
|
||
- name: B2_KEY_ID
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: B2_KEY_ID
|
||
- name: B2_APP_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: B2_APP_KEY
|
||
# Observability — push traces (and any future OTLP metrics) to
|
||
# obs.88oakapps.com. Token gates ingest at nginx; URL is the
|
||
# same one vmagent uses for metric remote-write. Both come from
|
||
# honeydue-secrets so they aren't world-readable in ConfigMap.
|
||
- name: OBS_TRACES_URL
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: OBS_TRACES_URL
|
||
optional: true
|
||
- name: OBS_INGEST_TOKEN
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: honeydue-secrets
|
||
key: OBS_INGEST_TOKEN
|
||
optional: true
|
||
volumeMounts:
|
||
- name: apns-key
|
||
mountPath: /secrets/apns
|
||
readOnly: true
|
||
- name: tmp
|
||
mountPath: /tmp
|
||
resources:
|
||
requests:
|
||
cpu: 100m
|
||
memory: 128Mi
|
||
limits:
|
||
cpu: "1"
|
||
memory: 512Mi
|
||
startupProbe:
|
||
httpGet:
|
||
path: /api/health/
|
||
port: 8000
|
||
# MigrateWithLock in cmd/api/main.go runs pg_advisory_lock on
|
||
# every startup. On a cold boot with 3 replicas, the first does
|
||
# AutoMigrate (~90s) and the others wait on the lock, so real
|
||
# startup runs 90–240s. 48 × 5s = 240s grace absorbs it without
|
||
# healthcheck killing a still-starting replica.
|
||
failureThreshold: 48
|
||
periodSeconds: 5
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /api/health/
|
||
port: 8000
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /api/health/
|
||
port: 8000
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 30
|
||
timeoutSeconds: 10
|
||
volumes:
|
||
- name: apns-key
|
||
secret:
|
||
secretName: honeydue-apns-key
|
||
items:
|
||
- key: apns_auth_key.p8
|
||
path: apns_auth_key.p8
|
||
- name: tmp
|
||
emptyDir:
|
||
sizeLimit: 64Mi
|