svcforge: reference implementation

Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
2026-07-17 10:44:54 +00:00
commit 50c2fe2a1e
102 changed files with 12018 additions and 0 deletions
@@ -0,0 +1,84 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "svcforge.fullname" . }}-api
+  labels:
+    {{- include "svcforge.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api
+spec:
+  replicas: {{ .Values.api.replicas }}
+  selector:
+    matchLabels:
+      {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "api") | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "svcforge.labels" . | nindent 8 }}
+        {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "api") | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "api") }}
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      # 60s: an in-flight POST must finish and the pool must close cleanly. The api holds
+      # no lease, so this is generosity, not correctness — the worker's 60s is the one
+      # that matters.
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        {{- include "svcforge.podSecurityContext" . | nindent 8 }}
+      containers:
+        - name: api
+          image: {{ include "svcforge.image" (dict "ctx" $ "component" "api") }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- include "svcforge.containerSecurityContext" . | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.api.service.targetPort }}
+          envFrom:
+            - secretRef:
+                name: {{ include "svcforge.secretName" . }}
+          env:
+            {{- include "svcforge.env" . | nindent 12 }}
+            - name: SVCFORGE_JWKS_URL
+              value: {{ .Values.auth.jwksUrl | quote }}
+            - name: SVCFORGE_JWT_ISSUER
+              value: {{ .Values.auth.issuer | quote }}
+            - name: SVCFORGE_JWT_AUDIENCE
+              value: {{ .Values.auth.audience | quote }}
+            - name: OTEL_SERVICE_NAME
+              value: svcforge-api
+          # readiness gates traffic, liveness restarts. They must not be the same probe:
+          # /readyz checks the pool, and a pool that is briefly exhausted should stop
+          # taking traffic, not get the pod killed.
+          readinessProbe:
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 5
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            {{- toYaml .Values.api.resources | nindent 12 }}
+          volumeMounts:
+            # readOnlyRootFilesystem: true, so anything that writes needs a mount.
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}