Harden production deployment manifests

deploy/prod/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - webshare-api-externalsecret.yaml
   - site-analyzer-deployment.yaml
   - site-analyzer-service.yaml
+  - site-analyzer-hpa.yaml
   - lightpanda-cdp-deployment.yaml
   - lightpanda-cdp-service.yaml
   - lightpanda-cdp-hpa.yaml
@@ -13,6 +14,7 @@ resources:
   - lightpanda-mcp-hpa.yaml
   - scraper-deployment.yaml
   - scraper-service.yaml
+  - scraper-hpa.yaml
   - traefik-middleware-strip-prefix.yaml
   - ingressroute-microservices.yaml
 images:

deploy/prod/lightpanda-cdp-deployment.yaml

@@ -23,7 +23,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: lightpanda-cdp
-          image: lightpanda/browser:nightly
+          image: lightpanda/browser@sha256:7b05b1c2f618fad9ed77786132f47ef71091875528bc46e6b3852b75c361cb05
           args:
             - /bin/lightpanda
             - serve

deploy/prod/lightpanda-mcp-deployment.yaml

@@ -20,8 +20,6 @@ spec:
       labels:
         app: lightpanda-mcp
     spec:
-      imagePullSecrets:
-        - name: ghcr-pull-secret
       terminationGracePeriodSeconds: 30
       containers:
         - name: lightpanda-mcp

deploy/prod/scraper-deployment.yaml

@@ -15,8 +15,6 @@ spec:
       labels:
         app: scraper
     spec:
-      imagePullSecrets:
-        - name: ghcr-pull-secret
       containers:
         - name: scraper
           image: ghcr.io/openstaticfish/microservices/scraper:4c6b1dc752feab5ef4c52f40d5c97a85ec59bcba

deploy/prod/scraper-hpa.yaml

@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: scraper
+  namespace: microservices
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: scraper
+  minReplicas: 1
+  maxReplicas: 5
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70

deploy/prod/site-analyzer-deployment.yaml

@@ -20,8 +20,6 @@ spec:
       labels:
         app: site-analyzer
     spec:
-      imagePullSecrets:
-        - name: ghcr-pull-secret
       terminationGracePeriodSeconds: 30
       containers:
         - name: site-analyzer

deploy/prod/site-analyzer-hpa.yaml

@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: site-analyzer
+  namespace: microservices
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: site-analyzer
+  minReplicas: 1
+  maxReplicas: 5
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70