feat: Configure production deployment with math-tables namespace and ingress

Changes made:

- Remove problematic configuration-snippet from base ingress

- Add namespace creation for math-tables

- Configure ingress with nginx class and letsencrypt-prod issuer

- Set production hostname to math-tables.cl1.parano.ch

- Reduce production replicas to 1

- Update copyright year in index.html

deploy/base/configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: math-exercises-config
+data:
+  # Application configuration
+  PORT: "8000"
+  LOG_LEVEL: "INFO"
+  MAX_REQUEST_SIZE: "10mb"
+  
+  # Security configuration
+  SECURE_COOKIES: "true"
+  CORS_ORIGINS: "math-exercises.local"
+  REQUEST_TIMEOUT: "30s"

deploy/base/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: math-exercises-app
+  labels:
+    app: math-exercises
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: math-exercises
+  template:
+    metadata:
+      labels:
+        app: math-exercises
+    spec:
+      # Security context for the pod
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 2000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: math-exercises
+        image: math-exercises:latest
+        ports:
+        - containerPort: 8000
+        # Security context for the container
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+          capabilities:
+            drop:
+              - ALL
+        # Resource limits and requests
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "250m"
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        # Liveness probe
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        # Readiness probe
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 3
+        # Environment variables from ConfigMap
+        envFrom:
+        - configMapRef:
+            name: math-exercises-config
+        # Volume mounts for writable directories
+        volumeMounts:
+        - name: static-volume
+          mountPath: /app/app/static
+      # Volumes
+      volumes:
+      - name: static-volume
+        emptyDir: {}

deploy/base/ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: math-exercises-ingress
+  annotations:
+    # Security annotations
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/hsts: "true"
+    nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
+    nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"
+    nginx.ingress.kubernetes.io/hsts-preload: "true"
+spec:
+  tls:
+  - hosts:
+    - math-exercises.local
+    secretName: math-exercises-tls
+  rules:
+  - host: math-exercises.local
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: math-exercises-service
+            port:
+              number: 80

deploy/base/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- deployment.yaml
+- service.yaml
+- ingress.yaml
+- network-policy.yaml
+- pod-disruption-budget.yaml
+- configmap.yaml
+
+# Common labels to apply to all resources
+commonLabels:
+  app.kubernetes.io/name: math-exercises
+  app.kubernetes.io/instance: math-exercises-instance
+  app.kubernetes.io/version: "1.0"
+  app.kubernetes.io/component: web
+  app.kubernetes.io/part-of: math-suite
+  app.kubernetes.io/managed-by: kustomize

deploy/base/network-policy.yaml

@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: math-exercises-netpol
+spec:
+  podSelector:
+    matchLabels:
+      app: math-exercises
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow inbound traffic from the ingress controller only
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: ingress-nginx
+    ports:
+    - protocol: TCP
+      port: 8000
+  egress:
+  # Allow outbound DNS resolution
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+    ports:
+    - protocol: TCP
+      port: 53
+    - protocol: UDP
+      port: 53
+  # Allow outbound HTTPS for package updates or external APIs
+  - ports:
+    - protocol: TCP
+      port: 443

deploy/base/pod-disruption-budget.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: math-exercises-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: math-exercises

deploy/base/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: math-exercises-service
+  annotations:
+    # Security annotations
+    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
+spec:
+  selector:
+    app: math-exercises
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 8000
+  type: ClusterIP
+  # Only accessible within the cluster
+  internalTrafficPolicy: Local