deployment.yaml

# audiomuse-ai-deployment.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: playlist
---
apiVersion: v1
kind: Secret
metadata:
  name: postgres-credentials
  namespace: playlist
type: Opaque
stringData:
  POSTGRES_USER: "audiomuse" # As used in app.py
  POSTGRES_PASSWORD: "audiomusepassword" # As used in app.py
  POSTGRES_DB: "audiomusedb" # As used in app.py
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: audiomuse-ai-config
  namespace: playlist
data:
  POSTGRES_HOST: "postgres-service.playlist" # Database host
  POSTGRES_PORT: "5432" # Database port
  REDIS_URL: "redis://redis-service.playlist:6379/0"
  # Timezone applied inside containers. Default is UTC but you may set this in the ConfigMap or via deployment overrides
  TZ: "UTC"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-master
  namespace: playlist
  labels:
    app: redis
    tier: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
      tier: backend
  template:
    metadata:
      labels:
        app: redis
        tier: backend
    spec:
      containers:
      - name: master
        image: redis:7-alpine # Lightweight Redis image
        env:
        - name: TZ
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: TZ
        resources:
          limits:
            cpu: 2000m
            memory: 8000Mi
          requests:
            cpu: 2000m
            memory: 8000Mi
        ports:
        - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: redis-service
  namespace: playlist
  labels:
    app: redis
    tier: backend
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
    tier: backend
  type: ClusterIP # Internal service only
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
  namespace: playlist
spec:
  accessModes:
    - ReadWriteOnce # Suitable for a single PostgreSQL instance
  resources:
    requests:
      storage: 5Gi # Adjust storage size as needed
  # storageClassName: "your-storage-class" # Uncomment and specify if you have a specific storage class
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment
  namespace: playlist
  labels:
    app: postgres
    tier: database
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
      tier: database
  template:
    metadata:
      labels:
        app: postgres
        tier: database
    spec:
      containers:
      - name: postgres
        image: postgres:15-alpine # Using PostgreSQL 15
        imagePullPolicy: "IfNotPresent"
        ports:
        - containerPort: 5432
        env:
        - name: TZ
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: TZ
        envFrom:
        - secretRef:
            name: postgres-credentials
        volumeMounts:
        - name: postgres-storage
          mountPath: /var/lib/postgresql/data
        resources:
          limits:
            cpu: "1"
            memory: "8Gi"
          requests:
            cpu: "250m"
            memory: "256Mi"
      volumes:
      - name: postgres-storage
        persistentVolumeClaim:
          claimName: postgres-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: postgres-service # Service name used in DATABASE_URL
  namespace: playlist
spec:
  selector:
    app: postgres
  ports:
  - protocol: TCP
    port: 5432 # Default PostgreSQL port
    targetPort: 5432
  type: ClusterIP # Internal service
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: audiomuse-ai-flask
  namespace: playlist
  labels:
    app: audiomuse-ai
    component: flask
spec:
  replicas: 1
  selector:
    matchLabels:
      app: audiomuse-ai
      component: flask
  template:
    metadata:
      labels:
        app: audiomuse-ai
        component: flask
    spec:
      securityContext:
        runAsUser: 0 # Or a non-root user if your image supports it
        runAsGroup: 0 # Added fsGroup for consistency if needed by volumes
        fsGroup: 0
      containers:
      - name: flask-app
        image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR
        imagePullPolicy: Always
        ports:
        - containerPort: 8000 # Flask app listens on 8000
        env:
        - name: SERVICE_TYPE
          value: "flask" # Tells the container to run the Flask app
        - name: TZ
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: TZ
        # --- Load PostgreSQL Credentials from Secret ---
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_USER
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_PASSWORD
        - name: POSTGRES_DB
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_DB
        # --- Load non-sensitive DB parts from ConfigMap ---
        - name: POSTGRES_HOST
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: POSTGRES_HOST
        - name: POSTGRES_PORT
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: POSTGRES_PORT
        # --- Load minimal connection configuration from the ConfigMap ---
        envFrom:
        - configMapRef:
            name: audiomuse-ai-config
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - name: app-temp-audio
          mountPath: /app/temp_audio
      volumes:
      - name: app-temp-audio
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: audiomuse-ai-flask-service
  namespace: playlist
  labels:
    app: audiomuse-ai
    component: flask
spec:
  selector:
    app: audiomuse-ai
    component: flask
  ports:
  - protocol: TCP
    port: 8000 # Service port (what you connect to)
    targetPort: 8000 # Container port (what the app listens on)
  type: LoadBalancer # Or NodePort/ClusterIP depending on your K3S setup
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: audiomuse-ai-worker
  namespace: playlist
  labels:
    app: audiomuse-ai
    component: worker
spec:
  replicas: 3 # Scale as needed. Each replica runs both a high-priority and a default-priority worker process.
  selector:
    matchLabels:
      app: audiomuse-ai
      component: worker
  template:
    metadata:
      labels:
        app: audiomuse-ai
        component: worker
    spec:
      securityContext:
        runAsUser: 0
        runAsGroup: 0
        fsGroup: 0
      containers:
      - name: rq-worker
        image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR
        imagePullPolicy: Always
        env:
        - name: SERVICE_TYPE
          value: "worker" # Tells the container to run the RQ worker
        - name: TZ
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: TZ
        # --- Load PostgreSQL Credentials from Secret ---
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_USER
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_PASSWORD
        - name: POSTGRES_DB
          valueFrom:
            secretKeyRef:
              name: postgres-credentials
              key: POSTGRES_DB
        # --- Load non-sensitive DB parts from ConfigMap ---
        - name: POSTGRES_HOST
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: POSTGRES_HOST
        - name: POSTGRES_PORT
          valueFrom:
            configMapKeyRef:
              name: audiomuse-ai-config
              key: POSTGRES_PORT
        # --- Load minimal connection configuration from the ConfigMap ---
        envFrom:
        - configMapRef:
            name: audiomuse-ai-config
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - name: app-temp-audio
          mountPath: /app/temp_audio
      volumes:
      - name: app-temp-audio
        emptyDir: {}