feat: add terraform deployment for K8s invidious

deployments/invidious/main.tf

@@ -0,0 +1,153 @@
+# SPDX-License-Identifier: GPL-2.0-only
+terraform {
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.25"
+    }
+  }
+  required_version = ">= 1.6.2"
+}
+
+provider "kubernetes" {
+  config_path    = var.kubeconfig_path
+  config_context = var.kubeconfig_context
+}
+
+resource "kubernetes_deployment_v1" "app" {
+  metadata {
+    name = var.app_name
+    namespace = data.kubernetes_namespace_v1.app.metadata[0].name
+    labels = merge({
+      "app.kubernetes.io/name"       = var.app_name
+      "app.kubernetes.io/version"    = var.app_version
+      "app.kubernetes.io/managed-by" = "opentofu"
+      "app.kubernetes.io/instance"   = var.app_name
+    }, var.deployment_additional_labels)
+    annotations = var.deployment_annotations
+  }
+  spec {
+    selector {
+      match_labels = {
+        "app.kubernetes.io/name" = var.app_name
+      }
+    }
+    template {
+      metadata {
+        annotations = var.pods_annotations
+        labels = merge({
+          "app.kubernetes.io/component"  = "server"
+          "app.kubernetes.io/name"       = var.app_name
+          "app.kubernetes.io/version"    = var.app_version
+          "app.kubernetes.io/part-of"    = var.app_name
+          "app.kubernetes.io/managed-by" = "opentofu"
+          "app.kubernetes.io/instance"   = var.app_name
+        }, var.pods_additional_labels)
+      }
+      spec {
+        service_account_name = var.service_account_name
+        security_context {
+          run_as_non_root = true
+          run_as_group    = 1000
+          run_as_user     = 1000
+        }
+        ## Web service
+        container {
+          name              = var.app_name
+          image             = var.container_invidious_image
+          image_pull_policy = var.container_invidious_image_pull_policy
+          port {
+            name            = "http"
+            container_port  = 3000
+            protocol        = "TCP"
+          }
+          security_context {
+            allow_privilege_escalation = false
+            privileged                 = false
+            capabilities {
+              drop = ["ALL"]
+            }
+          }
+          readiness_probe {
+            initial_delay_seconds = 60
+            failure_threshold     = 3
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 3
+            http_get {
+              port = "http"
+              path = "/"
+              scheme = "HTTP"
+            }
+          }
+          liveness_probe {
+            initial_delay_seconds = 60
+            failure_threshold     = 3
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 5
+            http_get {
+              port = "http"
+              path = "/"
+              scheme = "HTTP"
+            }
+          }
+          startup_probe {
+            initial_delay_seconds = 60
+            failure_threshold = 30
+            period_seconds = 5
+            success_threshold = 1
+            timeout_seconds = 1
+            http_get {
+              port = "http"
+              path = "/"
+              scheme = "HTTP"
+            }
+          }
+          env_from {
+            secret_ref {
+              name     = kubernetes_secret_v1.app_secrets.metadata[0].name
+              optional = false
+            }
+          }
+          # Linked to https://github.com/iv-org/invidious/issues/2970
+          env {
+            name = "INVIDIOUS_PORT"
+            value = 3000
+          }
+          resources {
+            requests = var.container_invidious_resources_requests
+          }
+        }
+        ## IV Sig helper
+        container {
+          name              = "${var.app_name}-sig-helper"
+          image             = var.container_iv_sig_helper_image
+          image_pull_policy = var.container_iv_sig_helper_image_pull_policy
+          args              = ["--tcp", "127.0.0.1:12999"]
+
+          port {
+            name            = "http"
+            container_port  = 12999
+            protocol        = "TCP"
+          }
+          security_context {
+            allow_privilege_escalation = false
+            privileged                 = false
+            read_only_root_filesystem  = true
+            capabilities {
+              drop = ["ALL"]
+            }
+          }
+          env {
+            name = "RUST_LOG"
+            value = "info"
+          }
+          resources {
+            requests = var.container_iv_sig_helper_resources_requests
+          }
+        }
+      }
+    }
+  }
+}