experiment(k8s): scaffold k3s-local + Kapsule poc overlays for matchID

[rhanka]

Summary

Scaffold of deploy/k8s/ with a kustomize base + overlays for:

• overlays/local — k3d / k3s local: NodePort, hostPath PV, no nodeSelector.
• overlays/poc — Scaleway Kapsule poc: pool=burst nodeSelector, scw-bssd PVCs, Traefik IngressRoute.
• overlays/prod — placeholder only; production remains out of scope for this POC branch.

This PR lands the POC scaffolding. It is not a production migration and it does not replace the current deploy-remote path.

Scope

Workloads in base/:

Pod	Image	Port
deces-backend	matchid/deces-backend:latest	8080
deces-ui	matchid/deces-ui:latest	8083
elasticsearch	docker.elastic.co/elasticsearch/elasticsearch:7.17.28	9200
redis	redis:7-alpine	6379

ES is pinned to 7.17.28 for the POC quota. The long-term ES-to-surch swap remains a separate experiment.

External Contract

• rhanka/poc-k8s#3 intake for matchID is merged.
• The live Kapsule smoke must follow the poc-k8s tenant mechanism: tenant namespace + tenant kubeconfig / KUBE_CONFIG_DATA, or the later OIDC contract if/when it lands there.
• This PR does not invent a separate production-style SCW credential path for matchID.

Validation

• Local k8s smoke CI is green:
  • push run 25975527555: smoke-local (k3s in runner) success
  • PR run 25975528412: smoke-local (k3s in runner) success
• PR code review result: merge-with-followup, no blocker.

Follow-Ups

• Track B: wire the POC Kapsule smoke according to ../poc-k8s contract, then run it.
• Track k8s-hardening: do not promote to prod while images are :latest / IfNotPresent, ES is single-node, and app state issues from deploy/k8s/K8S_READINESS_AUDIT.md remain open.

Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 51708952-9a78-4548-b618-fad2db50e136

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch experiment/k8s

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[rhanka]

Verdict

merge-with-followup — POC scaffolding is solid, smoke is green, no security gaps. Follow-ups are honest non-blockers given the experimental gate.

Follow-ups

• base/elasticsearch.statefulset.yaml:46-65 + overlays/local/elasticsearch.local-storage.yaml:13-24: the local overlay's comment claims it keeps "ONLY the fix-data-permissions init container", but kustomize strategic-merge merges initContainers by name, so the rendered output still includes sysctl-vm-max-map-count. It's harmless on k3d (the || true swallows the read-only sysctl failure), but the comment lies about behavior. Either drop the comment, or use a JSON-6902 patch / $patch: replace to actually replace the list.
• base/deces-backend.deployment.yaml:25, base/deces-ui.deployment.yaml:28: :latest everywhere. Accepted for POC, but pin a digest before promoting to prod/ overlay — imagePullPolicy: IfNotPresent with :latest will silently freeze on whatever the node first cached.
• Audit P0 gap: packages/deces-backend/src/webhook.ts:100 declares export const webhookRegistry = new Map<string, WebhookRecord>() — same in-memory ban/validation pattern as authentification.ts:4-5 (registry holds 4h-ban records, attempt counters). Pod restart drops all validated webhooks; multi-replica = inconsistent ban state. Same class of bug as audit's P0 Fix/make dev #1 and Refacto Makefile structure for monorepo #2 — worth promoting to P0 in K8S_READINESS_AUDIT.md for the surch swap.
• base/deces-backend.deployment.yaml:83-86: deces-backend-secrets is optional: true and not shipped. Fine while no auth is wired, but once OTP / Brevo lands, missing-secret-silent-success will hide config drift. Consider flipping optional: false + provisioning via sealed-secrets or external-secrets when the POC actually exercises auth.
• base/redis.deployment.yaml: ephemeral Deployment (no PVC). BullMQ job state is lost on Redis pod eviction — fine for smoke, but the README only mentions it under "production should use managed Redis"; worth a # WARNING next to replicas: 1 for the next dev.
• .github/workflows/k8s-smoke.yml:42: concurrency.group keys on target || 'local', so a workflow_dispatch for poc on the same ref won't cancel an in-flight local push run. Probably intentional (different clusters), but worth a comment.

Nits

• base/deces-ui.configmap.yaml: several values are unquoted strings with spaces (e.g. API_AGG_GLOBAL_BURST: 30 nodelay). YAML accepts it, but quote them for grep-friendliness and parser-agnosticism.
• Audit mail.ts:60, authentification.ts:4-5, processStream.ts:57-60 claims spot-checked and accurate.
• Smoke run #25975527555 confirms kubectl apply -k overlays/local/ reconciles end-to-end with {"msg":"OK"} on /deces/api/v1/healthcheck.