AI overhaul

2026-10-23 12:49:53 -04:00
parent b040ca26c3
commit b4db1a0182
21 changed files with 1226 additions and 189 deletions
@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: membership-config
+  namespace: {{ www_namespace }}
+data:
+{% for key, value in www_membership_environment | dictsort %}
+  {{ key }}: {{ value | string | to_json }}
+{% endfor %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: membership-tiers
+  namespace: {{ www_namespace }}
+data:
+  tiers.json: {{ www_membership_tiers | to_json | to_json }}
+---
+# Only Apache may assert the trusted proxy headers to the membership service.
+# Requires a CNI which actually enforces NetworkPolicy.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: membership-web
+  namespace: {{ www_namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: membership
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: httpd
+      ports:
+        - protocol: TCP
+          port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: membership-worker
+  namespace: {{ www_namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: membership-worker
+  policyTypes: [Ingress]
+  ingress: []
+{% if www_membership_postgres_managed %}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: membership-db
+  namespace: {{ www_namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: membership-db
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              www-membership-client: "true"
+      ports:
+        - protocol: TCP
+          port: 5432
+{% endif %}