deployment.yaml

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: {{ .Chart.Name }}
  labels:
    app: {{ include "notifications.name" . }}
    chart: {{ include "notifications.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    checksum/config: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ include "notifications.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ include "notifications.name" . }}
        release: {{ .Release.Name }}
    spec:
      volumes:
      - name: nginx-config-volume
        configMap:
          name: nginx-config
      - name: cloudsql-instance-credentials
        secret:
          secretName: cloudsql-instance-credentials
      - name: oauth-public
        configMap:
          name: oauth-public-key

      containers:
      - name: nginx
        image: nginx:1.10
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        ports:
        - name: http
          containerPort: {{ .Values.httpPort | default 80 }}
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /
            port: {{ .Values.httpPort | default 80 }}
        readinessProbe:
          httpGet:
            path: /
            port: {{ .Values.httpPort | default 80 }}
        volumeMounts:
        - name: nginx-config-volume
          mountPath: /etc/nginx/nginx.conf
          subPath: nginx.conf
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.11
        command: ["/cloud_sql_proxy",
                  "-instances={{ .Values.db.host }}=tcp:3306",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        securityContext:
          runAsUser: 2  # non-root user
          allowPrivilegeEscalation: false
        volumeMounts:
        - name: cloudsql-instance-credentials
          mountPath: /secrets/cloudsql
          readOnly: true
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        envFrom:
        - secretRef:
            name: {{ .Chart.Name }}-environment
        volumeMounts:
        - name: oauth-public
          mountPath: /app/storage/oauth-public.key
          subPath: oauth-public.key
          readOnly: true

env.yaml

apiVersion: v1
kind: Secret
metadata:
  name: {{ .Chart.Name }}-environment
type: Opaque
data:
  DB_PASSWORD: {{ required "A database password must be supplied" .Values.db.password | b64enc }}
  APP_KEY: {{ required "You must provide an app key" .Values.app_key | b64enc }}
  # ... the rest of your env
  

ingress.yaml

{{- $fullName := include "notifications.fullname" . -}}
{{- $ingressPath := .Values.ingress.path -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    app: {{ include "notifications.name" . }}
    chart: {{ include "notifications.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ . | quote }}
      http:
        paths:
          - path: {{ $ingressPath }}
            backend:
              serviceName: {{ $fullName }}
              servicePort: http
  {{- end }}
{{- end }}

migrate.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "notifications.fullname" . }}-migration-{{ randAlphaNum 5 | lower }}
spec:
  parallelism: 1
  completions: 1
  backoffLimit: 3
  template:
    spec:
      restartPolicy: Never
      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials
        - name: exit-signals
          emptyDir: {}
      containers:
        - name: cloudsql-proxy
          image: gcr.io/cloudsql-docker/gce-proxy:1.13
          command: ["/bin/sh", "-c"]
          args:
            - |
              /cloud_sql_proxy -instances={{ .Values.db.host }}=tcp:3306 -credential_file=/secrets/cloudsql/credentials.json &
              CHILD_PID=$!
              until [ -f "/opt/exit-signals/SIGTERM" ]; do sleep 1; done;
              kill $CHILD_PID;
              exit 0;
          securityContext:
            runAsUser: 2  # non-root user
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: cloudsql-instance-credentials
              mountPath: /secrets/cloudsql
              readOnly: true
            - mountPath: /opt/exit-signals
              name: exit-signals
              readOnly: true
        - name: {{ .Chart.Name }}-migration
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          command: ["/bin/sh", "-c"]
          args:
            - |
              trap "touch /opt/exit-signals/SIGTERM;" EXIT
              php artisan migrate --force
          volumeMounts:
            - mountPath: /opt/exit-signals
              name: exit-signals
          envFrom:
            - secretRef:
                name: {{ .Chart.Name }}-environment

service.yaml

apiVersion: v1
kind: Service
metadata:
  name: {{ include "notifications.fullname" . }}
  labels:
    app: {{ include "notifications.name" . }}
    chart: {{ include "notifications.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.port }}
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: {{ include "notifications.name" . }}
    release: {{ .Release.Name }}