Deployment Recipes

diid-push can be deployed using multiple orchestration engines depending on infrastructure requirements.

Kubernetes CronJob

Using --once inside a Kubernetes CronJob delegates scheduling to Kubernetes:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: diid-push
spec:
  schedule: "0 * * * *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            fsGroup: 65532
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: diid-push
              image: registry.gitlab.com/keldcode-group/diid-dev/diid-push:latest
              args: ["spec", "--config=/config/diid.yaml", "--once"]
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: ["ALL"]
              envFrom:
                - secretRef:
                    name: diid-push-secrets
              volumeMounts:
                - name: config
                  mountPath: /config
                  readOnly: true
          volumes:
            - name: config
              configMap:
                name: diid-push-config

Provision secrets and configuration maps:

kubectl create configmap diid-push-config --from-file=diid.yaml=./diid.yaml
kubectl create secret generic diid-push-secrets \
  --from-literal=DIID_MY_API_TOKEN=... \
  --from-literal=BACKSTAGE_TOKEN=...

---

Docker Compose (Daemon Mode)

Run diid-push continuously in daemon mode using Docker Compose:

services:
  diid-push:
    image: registry.gitlab.com/keldcode-group/diid-dev/diid-push:latest
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      DIID_MY_API_TOKEN: ${DIID_MY_API_TOKEN}
      BACKSTAGE_TOKEN: ${BACKSTAGE_TOKEN}
    volumes:
      - ./diid.yaml:/config/diid.yaml:ro

---

GitHub Actions Workflow [Work in progress]

Incorporate spec sync into build pipelines:

name: Sync Spec to diid

on:
  push:
    branches: [main]

jobs:
  sync-spec:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install diid-push
        run: |
          curl -sSfL https://gitlab.com/keldcode-group/diid-dev/diid-push/-/releases/permalink/latest/downloads/diid-push_linux_amd64.tar.gz \
            | tar -xz -C /usr/local/bin diid-push

      - name: Sync Spec
        run: diid-push spec --config=diid.yaml --once --spec=my-api
        env:
          DIID_MY_API_TOKEN: ${{ secrets.DIID_MY_API_TOKEN }}