Create Kubernetes deployment manifests and Helm chart

[haasonsaas]

Summary

No deployment artifacts exist. Getting ASB into a Kubernetes cluster currently requires hand-rolling manifests.

Required work

• Helm chart with templates for:
  • Deployment for asb-api (configurable replicas, resource limits, probes)
  • CronJob or Deployment for asb-worker (configurable interval, single-replica)
  • Job for asb-migrate (run-once, pre-upgrade hook)
  • ServiceAccount with appropriate RBAC
  • Service and optional Ingress/IngressRoute
  • ConfigMap for non-secret configuration
  • ExternalSecret or Secret for signing keys, Vault token, GitHub credentials
  • PodDisruptionBudget for API
• values.yaml with sensible defaults and clear comments
• HA topology documentation: how many API replicas are safe, what happens if Redis goes down (fall back to in-memory budgets?), Postgres failover behavior
• Failure mode guide: what happens when each dependency fails, what degrades vs. what goes hard-down
• Dockerfile (multi-stage build, distroless base, non-root user)
• CI job to build and push container image with sha-<full_git_sha> tag

Files

• deploy/helm/asb/ — chart directory
• Dockerfile — multi-stage build
• .github/workflows/ — image build and push job

Priority

Low-medium — required for any real deployment but not blocking development.

🤖 Generated with Claude Code