Kubernetes deployment overview

MobilityManager ships Kubernetes manifests under k8s/, organised as a Kustomize base with per-environment overlays. This article explains the structure and how to deploy the application to a cluster.

Manifest layout

The application manifests live under k8s/mobilitymanager:

• base/ — the Deployment, Service, and PodDisruptionBudget shared by all environments.
• overlays/dev/ and overlays/prod/ — environment-specific ConfigMap, Ingress, and Kustomize patches.

The base Deployment runs two replicas of the container on port 8080, with pod anti-affinity across zones and a PodDisruptionBudget that keeps at least one pod available.

Configuration and secrets

Non-sensitive settings come from a ConfigMap (mobilitymanager-config) and secrets from a Secret (mobilitymanager-secrets), both injected via envFrom:

• ConfigMap: ASPNETCORE_ENVIRONMENT, ASPNETCORE_URLS, DatabaseProvider, LicensePortal__BaseUrl, and DocumentStorage__EnableEncryptionAtRest.
• Secret: ConnectionStrings__SystemConnection, ConnectionStrings__TenantConnection, and Jwt__Key.

Create or update the Secret without committing credentials. For example:

kubectl -n mobilitymanager-prod create secret generic mobilitymanager-secrets \
  --from-literal=ConnectionStrings__SystemConnection='...' \
  --from-literal=ConnectionStrings__TenantConnection='...' \
  --from-literal=Jwt__Key='...' \
  --dry-run=client -o yaml | kubectl apply -f -

Warning: secret.example.yaml is a template only. Never commit real connection strings or signing keys; manage them through your cluster's secret store.

Health probes and security context

The Deployment wires the built-in health endpoints to Kubernetes probes: /livez for liveness, /readyz for readiness, and /healthz as the startup probe. The pod runs hardened: a non-root numeric UID, a read-only root filesystem, dropped Linux capabilities, and no privilege escalation. Writable paths are provided as emptyDir volumes for /tmp, /app/data, and /app/logs.

Deploy with Kustomize

1. Ensure the ConfigMap values and Secret exist in the target namespace.
2. Preview the rendered manifests:

   kubectl kustomize k8s/mobilitymanager/overlays/prod

3. Apply the overlay:

   kubectl apply -k k8s/mobilitymanager/overlays/prod

4. Watch the rollout:

   kubectl -n mobilitymanager-prod rollout status deployment/mobilitymanager

Note: The included Ingress uses a Cloudflare Tunnel ingress class and terminates TLS outside the pod. Replace the ingress class and hostnames to match your own cluster.

Related

• Deployment architecture overview
• Configuring the database connection strings
• Understanding the health endpoints
• Production hardening checklist