Kubernetes Deployment

Deployment Architecture

SecuFile is deployed on an OVH Managed Kubernetes cluster (k8s-dev and k8s-prod) in the secufile namespace.

Pods in the secufile Namespace

Deployment	Image	Role
`api`	secufile-backend	Go API (Gin)
`web-backend`	secufile-webgui-backend	Python backend (FastAPI)
`web-frontend`	secufile-webgui-frontend	React frontend (nginx)
`postgres`	postgres:15	Database
`redis`	redis:7-alpine	Cache and rate limiting
`clamav`	clamav/clamav	Antivirus (optional)

Deployment via SecuOps

SecuOps is the mandatory CLI tool for all Kubernetes operations.

# Build Docker images
secuops build --app=secufile-backend --env=k8s-dev
secuops build --app=filesecure-webgui --env=k8s-dev

# Deploy
secuops deploy --app=secufile-backend --env=k8s-dev
secuops deploy --app=filesecure-webgui --env=k8s-dev

# Check status
secuops status --app=secufile-backend --env=k8s-dev

# View logs
secuops logs --app=secufile-backend --env=k8s-dev

# Update a deployment image
secuops kubectl --env=k8s-dev -- set image deployment/api api=<image> -n secufile
secuops kubectl --env=k8s-dev -- set image deployment/web-backend web-backend=<image> -n secufile
secuops kubectl --env=k8s-dev -- set image deployment/web-frontend web-frontend=<image> -n secufile

Deployment URLs

Environment	Service	URL
k8s-dev	WebGUI	https://secufile.secuaas.dev
k8s-dev	Go API	https://api.secufile.secuaas.dev
k8s-dev	Landing	https://filesecure-landing.secuaas.dev
k8s-prod	WebGUI	https://secufile.secuaas.ovh
k8s-prod	Go API	https://api.secufile.secuaas.ovh

DNS Convention

Following the SecuAAS DNS convention:

Namespace: secufile
Primary URL: secufile.secuaas.dev (dev) / secufile.secuaas.ovh (prod)
API: api.secufile.secuaas.dev / api.secufile.secuaas.ovh

Health Checks

The Kubernetes deployment uses the following probes:

livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 30

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10

/health: Returns 200 if the process is alive
/ready: Returns 200 if PostgreSQL and Redis are reachable, 503 otherwise

Image Registry

Docker images are stored in the OVH Harbor registry:

qq9o8vqe.c1.bhs5.container-registry.ovh.net/secuops/

Tag format: {app}-{component}:main-{HHMMSS} (e.g., secufile-backend-backend:main-012619)

Kubernetes Secrets Management

# List namespace secrets
secuops kubectl --env=k8s-dev -- get secrets -n secufile

# The main secret contains 32+ keys:
# secufile-secrets (JWT, DB, S3, Stripe, Zitadel, OVH, Resend, etc.)

Resource Configuration

Resources are defined in the secuops.yaml configuration file per environment:

Environment	Component	CPU	Memory	Replicas
dev	backend	0.5	256 MB	1
dev	postgres	0.5	256 MB	1
dev	redis	0.25	128 MB	1
staging	backend	0.5	512 MB	2
prod	backend	1.0	512 MB	3
prod	postgres	1.0	1 GB	1
prod	redis	0.5	256 MB	1

Deployment Strategy

The deployment uses a rolling update strategy:

maxSurge: 1 -- One additional pod during updates
maxUnavailable: 0 -- Zero downtime
rollbackOnFailure: true -- Automatic rollback on failure

Kubernetes Deployment

On this page