k8scd/ghost-blog/ghost-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ghost-blog
  namespace: ghost-blog
  labels:
    app: ghost-blog
    app.kubernetes.io/name: ghost-blog
    app.kubernetes.io/instance: ghost-blog
    app.kubernetes.io/version: '5.92'
    app.kubernetes.io/component: ghost
    app.kubernetes.io/part-of: ghost-blog
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ghost-blog
  minReadySeconds: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 3
  revisionHistoryLimit: 4
  progressDeadlineSeconds: 600
  template:
    metadata:
      namespace: ghost-blog
      labels:
        app: ghost-blog
    spec:
      automountServiceAccountToken: false
      volumes:
      - name: ghost-content
        persistentVolumeClaim:
          claimName: ghost-content
      - name: ghost-config-prod
        secret:
          secretName: ghost-config-prod
          defaultMode: 420
      - name: tmp
        emptyDir:
          sizeLimit: 64Mi
      - name: ghost-logs
        emptyDir:
          sizeLimit: 256Mi

      initContainers:
      - name: permissions-fix
        imagePullPolicy: IfNotPresent
        image: docker.io/busybox:stable-musl
        env:
        - name: GHOST_INSTALL
          value: /home/nonroot/app/ghost
        - name: GHOST_CONTENT
          value: /home/nonroot/app/ghost/content
        - name: NODE_ENV
          value: production
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 100m
            memory: 128Mi
        command:
          - /bin/sh
          - '-c'
          - |
            set -e
            export DIRS='files logs apps themes data public settings images media'
            echo 'Check if base dirs exists, if not, create them'
            echo "Directories to check: $DIRS"
            for dir in $DIRS; do
              if [ ! -d $GHOST_CONTENT/$dir ]; then
                echo "Creating $GHOST_CONTENT/$dir directory"
                mkdir -pv $GHOST_CONTENT/$dir || echo "Error creating $GHOST_CONTENT/$dir directory"
              fi
              chown -Rfv 65532:65532 $GHOST_CONTENT/$dir && echo "chown ok on $dir" || echo "Error changing ownership of $GHOST_CONTENT/$dir directory"
            done
            exit 0
        volumeMounts:
        - name: ghost-content
          mountPath: /home/nonroot/app/ghost/content
          readOnly: false
        - name: ghost-logs
          mountPath: /home/nonroot/app/ghost/versions/5.114.0/content/logs
          readOnly: false

      containers:
      - name: ghost-blog
        image: ghcr.io/sredevopsorg/ghost-on-kubernetes:latest
        imagePullPolicy: Always
        ports:
        - name: ghost
          containerPort: 2368
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /ghost/api/v4/admin/site/
            port: ghost
            httpHeaders:
            - name: X-Forwarded-Proto
              value: https
            - name: Host
              value: blog.hensen.io
          periodSeconds: 10
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3
          initialDelaySeconds: 10
        livenessProbe:
          httpGet:
            path: /ghost/api/v4/admin/site/
            port: ghost
            httpHeaders:
            - name: X-Forwarded-Proto
              value: https
            - name: Host
              value: blog.hensen.io
          periodSeconds: 300
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 1
          initialDelaySeconds: 30
        env:
        - name: NODE_ENV
          value: production
        resources:
          limits:
            cpu: 800m
            memory: 800Mi
          requests:
            cpu: 200m
            memory: 400Mi
        volumeMounts:
        - name: ghost-content
          mountPath: /home/nonroot/app/ghost/content
          readOnly: false
        - name: ghost-config-prod
          readOnly: true
          mountPath: /home/nonroot/app/ghost/config.production.json
          subPath: config.production.json
        - name: tmp
          mountPath: /tmp
          readOnly: false
        - name: ghost-logs
          mountPath: /home/nonroot/app/ghost/versions/5.114.0/content/logs
          readOnly: false
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 65532
      restartPolicy: Always
      terminationGracePeriodSeconds: 15
      dnsPolicy: ClusterFirst
      securityContext:
        seccompProfile:
          type: RuntimeDefault