Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied).
- Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did.
- Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry).
- Switches to `nginxinc/nginx-unprivileged` (same pin as schemas-app), listening on 8080 as uid 101; the Service keeps port 80. Traefik Ingress for `/`, PDB, HPA moved to `-prod-frostmoln`; ALB Ingress dropped; Service ClusterIP.
Merging deploys to Frostmoln only; DNS still points at AWS until the cutover.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi
Reviewed-on: https://gitea.unbound.se/dancefinder/dancefinder-app/pulls/3100
## Summary
`k8s/deploy.yaml` takes the image from build-tools: `image: ${IMAGE}` instead of the hard-coded `oci.unbound.se/dancefinder/dancefinder-app:${COMMIT}`.
`deploy` substitutes `${IMAGE}` with `<registry>/<owner>/<name>:<tag>`, where the registry comes from the build-tools config and the tag is the value `${COMMIT}` gets today. The rendered reference is unchanged. Moving off `oci.unbound.se` later becomes one change in infra.
Validated on shiny/time-service#864: merged and deployed to AWS staging and Frostmoln staging with the same image. Prerequisites, all merged:
- unboundsoftware/infra#1808: registry in `BUILDTOOLS_FROSTMOLN_STAGING`
- shiny/acctest#952: acctest pins build-tools to the Gitea registry
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://gitea.unbound.se/dancefinder/dancefinder-app/pulls/3084
Remove cpu from resource limits while keeping memory limits and all
requests intact. CPU limits cause unnecessary throttling and
overcommit alerts when actual usage is far below limits.
Add health check settings to the ALB ingress configuration to ensure
better reliability and monitoring. The changes include defining the
health check path, interval, timeout, and threshold counts, which
enhance the resilience of the service by enabling quicker detection
and response to unhealthy instances.
Changes the ingress class annotation to the new format and
adds the ingressClassName field to specify the ALB ingress
class. This improves compatibility with Kubernetes and aligns
the configuration with the latest best practices.
Refactor Kubernetes resource definitions to replace the label
"app" with "app.kubernetes.io/name" for the dancefinder-app.
This change enhances consistency with Kubernetes best practices
and improves clarity in resource labeling across deployments,
services, and autoscalers.
argoyle
renovate