# `platform/k8s/`

Helm umbrella chart for deploying LOMA-PORTAL to Kubernetes.

```
platform/k8s/
├── Chart.yaml                  Umbrella metadata
├── values.yaml                 Production defaults
├── values.staging.yaml         Staging overrides
├── values.production.yaml      Production overrides
└── templates/
    ├── _helpers.tpl            Common labels + image helper
    ├── api-dotnet.deployment.yaml   Deployment + Service + HPA
    ├── ingress.yaml            Single Ingress routing /api → .NET, / → Angular
    └── (api-nest, worker-nest, web-*) — add by mirroring api-dotnet template
```

## Skeleton, not complete

The api-dotnet template is the **reference**. Mirror it for `api-nest`, `worker-nest`, `web-angular`, and `web-next` as each app is ready to deploy. Keep them consistent — same security context, probe pattern, HPA shape.

## Install

```bash
helm dependency update platform/k8s/
helm upgrade --install loma-portal platform/k8s/ \
  -f platform/k8s/values.yaml \
  -f platform/k8s/values.production.yaml \
  --namespace loma-portal --create-namespace
```

Secrets (`api-dotnet-secrets`, `api-nest-secrets`, `worker-nest-secrets`) come from a sealed-secrets or external-secrets controller — never from this repo.

## Conventions

- **Security context**: `runAsNonRoot: true`, `allowPrivilegeEscalation: false`, drop all caps. Match the Dockerfile's non-root user (uid 1000).
- **Probes**: `/health/live` (liveness) + `/health/ready` (readiness). Match the health endpoints baked into the images.
- **HPA**: CPU-based for API hosts; queue-depth-based for the worker (requires `prometheus-adapter`).
- **Resource requests** sized for the typical case; limits for the burst case.
- **Prometheus annotations** on every pod that exposes `/metrics`.

## Why one chart, not five

The team is small. One umbrella chart with shared helpers beats five charts to keep in step. Split when scale demands it (different release cadence per app).
