7. Deployment view¶

7.1 Kubernetes topology (state after sub-project 3)¶

flowchart LR
    U[Clients / administrators] --> ING[Ingress geoserver<br/>cookie affinity]
    ING --> SVC[Service geoserver :8080]
    SVC --> D[Deployment geoserver<br/>replicas N ≥ 3<br/>emptyDir data dir]
    D --- HZ[Headless Service geoserver-hz :5701]
    D --- PVC[(PVC RWX geoserver-wps)]
    D --> DBS[(TimescaleDB Service<br/>existing, shared)]
    D --> S3[(S3 object storage<br/>gwc-tiles · rasters)]
    subgraph Config
        S1[(Secret geoserver-db)]
        S2[(Secret meteo-reader)]
        S3[(Secret geoserver-admin)]
        C1[ConfigMap geoserver-env]
        C2[ConfigMap geoserver-cluster-env]
    end
    Config -.-> D
    J[Jobs init-geoserver-db / grant-reader] --> DBS
    SA[(Secret db-admin)] -.-> J
    PDB[PodDisruptionBudget minAvailable 1] -.-> D

Hold "Alt" / "Option" to enable pan & zoom

Object	Role	Sub-project
Jobs `init-geoserver-db`, `grant-meteo-reader` + Secret `db-admin`	Database initialization (pre-install / PreSync hook)	1
Secrets `geoserver-db`, `meteo-reader`, `geoserver-admin`	Application accounts	1, 2
ConfigMaps `geoserver-env`, `geoserver-cluster-env`	Non-secret variables (JNDI, control-flow, cluster, WPS)	2, 3
Deployment `geoserver`	N replicas, reproducible image, `emptyDir` data dir, probes	2, 3
Service `geoserver`	ClusterIP HTTP	2
Headless Service `geoserver-hz`	Hazelcast discovery through DNS	3
Ingress `geoserver`	Exposure + session affinity	3
PVC `geoserver-wps` (RWX)	Shared WPS results	3
PodDisruptionBudget	At least 1 replica during maintenance operations	3
Secret `s3-credentials`	S3 endpoint, keys, buckets (optional: without it, ephemeral local cache)	4

To be completed: ingestion service (5).

7.2 Platform requirements¶

Kubernetes with an Ingress controller supporting session affinity (or HZ_SESSION_SHARING=true).
RWX storage for asynchronous WPS.
Internal DNS access to the headless Service (standard).
Existing TimescaleDB/PostGIS database, with an admin account provided for the initialization Job.
S3-compatible object storage (path-style) with two buckets and one key pair.
Image registry and artifact repository (ADR-0007).