Install yf

# PHP-FPM and nginx in one pod. php runs the project image (Dockerfile); an init container copies its www/ to the
# volume nginx serves, at the same path, so try_files and $realpath_root see what PHP-FPM runs. nginx passes PHP to
# the unix socket of zz-yf.conf on the shared php-socket volume. Both run as non-root on read-only root filesystems:
# PHP writes only to www/uploads/, storage/, logs/ and /tmp.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: yf
  labels:
    app.kubernetes.io/name: yf
spec:
  # uploads is a ReadWriteOnce volume: one pod at a time. More replicas need ReadWriteMany storage (or object storage)
  # for uploads and shared sessions (Redis or the DB), then RollingUpdate
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: yf
  template:
    metadata:
      labels:
        app.kubernetes.io/name: yf
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
        sysctls:
          # nginx runs as its own user and keeps `listen 80` of the reference config
          - name: net.ipv4.ip_unprivileged_port_start
            value: "80"
      initContainers:
        - name: web-root
          image: registry.example.com/myproject:1.0.0
          command: [cp, -R, /var/www/myproject/www/., /web/]
          securityContext:
            runAsUser: 33
            runAsGroup: 33
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          resources:
            requests: { cpu: 50m, memory: 32Mi }
            limits: { memory: 128Mi }
          volumeMounts:
            - { name: web, mountPath: /web }
      containers:
        - name: php
          image: registry.example.com/myproject:1.0.0
          envFrom:
            - configMapRef:
                name: yf-env
          env:
            - name: YF_DB_PSWD
              valueFrom:
                secretKeyRef: { name: yf-db, key: password }
          securityContext:
            runAsUser: 33
            runAsGroup: 33
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits: { memory: 768Mi }
          # the master accepts on its socket; the pages themselves are the readiness probe of nginx
          livenessProbe:
            exec:
              command: [php, -r, 'exit(@stream_socket_client("unix:///run/php/php8.3-fpm.sock") ? 0 : 1);']
            periodSeconds: 20
            timeoutSeconds: 5
          volumeMounts:
            - { name: php-socket, mountPath: /run/php }
            - { name: uploads, mountPath: /var/www/myproject/www/uploads }
            - { name: storage, mountPath: /var/www/myproject/storage }
            - { name: logs, mountPath: /var/www/myproject/logs }
            - { name: tmp, mountPath: /tmp }
            - { name: php-fpm, mountPath: /usr/local/etc/php-fpm.d/zz-yf-k8s.conf, subPath: zz-yf-k8s.conf }
        - name: nginx
          image: nginx:1.30.6-alpine@sha256:583b7f2fce1cdb8da5ad5c39ebd3c33b98b87d493190e548bdee1fa8c619c311
          ports:
            - { name: http, containerPort: 80 }
          securityContext:
            runAsUser: 101
            runAsGroup: 101
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          resources:
            requests: { cpu: 50m, memory: 32Mi }
            limits: { memory: 128Mi }
          # through PHP and the database: a pod that cannot render pages gets no traffic
          readinessProbe:
            httpGet: { path: /, port: http }
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            tcpSocket: { port: http }
            periodSeconds: 20
          volumeMounts:
            - { name: nginx-conf, mountPath: /etc/nginx/conf.d/default.conf, subPath: default.conf }
            - { name: web, mountPath: /var/www/myproject/www, readOnly: true }
            - { name: uploads, mountPath: /var/www/myproject/www/uploads, readOnly: true }
            - { name: nginx-run, mountPath: /run }
            - { name: php-socket, mountPath: /run/php }
            - { name: nginx-cache, mountPath: /var/cache/nginx }
      volumes:
        - { name: web, emptyDir: {} }
        - { name: php-socket, emptyDir: { medium: Memory, sizeLimit: 1Mi } }
        - { name: uploads, persistentVolumeClaim: { claimName: yf-uploads } }
        # cache and logs (storage/logs/, and logs/ for the error log): gone with the pod. A PersistentVolumeClaim like
        # uploads if the site keeps data there
        - { name: storage, emptyDir: { sizeLimit: 1Gi } }
        - { name: logs, emptyDir: { sizeLimit: 256Mi } }
        # sessions and upload temp files of PHP
        - { name: tmp, emptyDir: { sizeLimit: 256Mi } }
        - { name: nginx-run, emptyDir: { medium: Memory, sizeLimit: 1Mi } }
        - { name: nginx-cache, emptyDir: { sizeLimit: 256Mi } }
        - { name: nginx-conf, configMap: { name: yf-nginx } }
        - { name: php-fpm, configMap: { name: yf-php-fpm } }
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: yf-uploads
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi