初始提交：DSH 多租户平台（dshs）

deploy/02-control-plane.yaml

@@ -0,0 +1,104 @@
+# 控制面 Deployment + Service（Phase 3：deployMode=k8s 起每用户 DSH Pod）。
+# 依赖：secret `dsh-pg`（key: url = Postgres DSN）、`dsh-secret`（key: key =
+# 共享加密密钥）、imagePullSecret `dsh-acr-pull`、ServiceAccount
+# `dsh-orchestrator`（deploy/03-rbac.yaml）。镜像由 CI push 到 ACR。
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dsh-orchestrator
+  namespace: dsh
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: dsh-orchestrator
+  template:
+    metadata:
+      labels:
+        app: dsh-orchestrator
+    spec:
+      imagePullSecrets:
+        - name: dsh-acr-pull
+      serviceAccountName: dsh-orchestrator
+      containers:
+        - name: orchestrator
+          image: registry.example.com/dsh/dshs:0.2.0
+          imagePullPolicy: Always
+          args: ["--host", "0.0.0.0"]
+          env:
+            - name: DSHS_DB_URL
+              valueFrom:
+                secretKeyRef:
+                  name: dsh-pg
+                  key: url
+            - name: DSHS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: dsh-secret
+                  key: key
+            - name: DSHS_SECURE_COOKIES
+              value: "true"
+            - name: DSHS_BASE_DOMAIN
+              value: "dsh.example.com"
+            - name: DSHS_COOKIE_DOMAIN
+              value: ".dsh.example.com"
+            - name: DSHS_DEPLOY_MODE
+              value: "k8s"
+            - name: DSHS_NAMESPACE
+              value: "dsh"
+            - name: DSHS_DSH_IMAGE
+              value: "registry.example.com/dsh/dsh:0.1.1-rc.2"
+            - name: DSHS_CONTROL_PLANE_IMAGE
+              value: "registry.example.com/dsh/dshs:0.2.0"
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          ports:
+            - containerPort: 3080
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+            readOnlyRootFilesystem: true
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "256Mi"
+            limits:
+              cpu: "1"
+              memory: "1Gi"
+      volumes:
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dsh-orchestrator
+  namespace: dsh
+spec:
+  selector:
+    app: dsh-orchestrator
+  ports:
+    - port: 3080
+      targetPort: 3080
+  type: ClusterIP
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: dsh-orchestrator
+  namespace: dsh
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: dsh-orchestrator