feat: deploy to Frostmoln production

Replace the AWS deploy-prod job (failing since CI left AWS) with deploy-prod-frostmoln, and run under the restricted Pod Security profile with the namespace's oci-registry pull secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi

k8s/deploy.yaml

@@ -22,6 +22,13 @@ spec:
       labels:
         app.kubernetes.io/name: dancefinder-app
     spec:
+      imagePullSecrets:
+      - name: oci-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -36,17 +43,21 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: dancefinder-app
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         readinessProbe:
           httpGet:
             path: /health
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         imagePullPolicy: Always
         image: ${IMAGE}
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         resources:
           requests:
             cpu: 10m
@@ -64,9 +75,8 @@ metadata:
   labels:
     app.kubernetes.io/name: dancefinder-app
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: dancefinder-app
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dancefinder-app
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: "dancefinder.unbound.se"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: dancefinder-app
+            port:
+              number: 80

k8s/ingress-prod.yaml

@@ -1,29 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: dancefinder-app-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/group.order: "101"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: "/health"
-    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "30"
-    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
-    alb.ingress.kubernetes.io/healthy-threshold-count: "2"
-    alb.ingress.kubernetes.io/unhealthy-threshold-count: "2"
-spec:
-  ingressClassName: "alb"
-  rules:
-    - host: "dancefinder.unbound.se"
-      http:
-        paths:
-          - path: /*
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: dancefinder-app
-                port:
-                  number: 80

k8s/pdb-prod-frostmoln.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: dancefinder-app
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dancefinder-app