From 770298ef3e72f5d6432a03a564111fa54928c482 Mon Sep 17 00:00:00 2001
From: ic-builder <ic-builder@turnsys.com>
Date: Sun, 6 Sep 2026 12:33:52 -0500
Subject: [PATCH] deploy kuma-glpi-bridge on pfv-k8s (NodePort 30801)

Incident pipeline: Kuma webhook -> GLPI ticket. Digest-pinned image,
imperative Secret glpi-creds (not in git), non-root/read-only pod.

CR: https://cmdb.knownelement.com/front/change.form.php?id=22
Ticket: https://projects.knownelement.com/issues/824
---
 .../apps/kuma-glpi-bridge/deployment.yaml     | 41 +++++++++++++++++++
 .../apps/kuma-glpi-bridge/kustomization.yaml  |  5 +++
 .../apps/kuma-glpi-bridge/namespace.yaml      |  4 ++
 clusters/pfv-k8s/apps/kustomization.yaml      |  5 ++-
 4 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 clusters/pfv-k8s/apps/kuma-glpi-bridge/deployment.yaml
 create mode 100644 clusters/pfv-k8s/apps/kuma-glpi-bridge/kustomization.yaml
 create mode 100644 clusters/pfv-k8s/apps/kuma-glpi-bridge/namespace.yaml

diff --git a/clusters/pfv-k8s/apps/kuma-glpi-bridge/deployment.yaml b/clusters/pfv-k8s/apps/kuma-glpi-bridge/deployment.yaml
new file mode 100644
index 0000000..7fe06e6
--- /dev/null
+++ b/clusters/pfv-k8s/apps/kuma-glpi-bridge/deployment.yaml
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: kuma-glpi-bridge}
+  template:
+    metadata:
+      labels: {app: kuma-glpi-bridge}
+    spec:
+      containers:
+        - name: bridge
+          image: git.knownelement.com/knel/kuma-glpi-bridge@sha256:9810ba15517079df99d8921bbe6d48380898adbc8f9185865b74b44f9c234616
+          ports: [{containerPort: 8080}]
+          envFrom: [{secretRef: {name: glpi-creds}}]
+          resources:
+            requests: {cpu: 10m, memory: 16Mi}
+            limits: {memory: 64Mi}
+          livenessProbe:
+            httpGet: {path: /healthz, port: 8080}
+            initialDelaySeconds: 5
+          securityContext:
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  type: NodePort
+  selector: {app: kuma-glpi-bridge}
+  ports:
+    - port: 8080
+      nodePort: 30801
diff --git a/clusters/pfv-k8s/apps/kuma-glpi-bridge/kustomization.yaml b/clusters/pfv-k8s/apps/kuma-glpi-bridge/kustomization.yaml
new file mode 100644
index 0000000..ad6b3f5
--- /dev/null
+++ b/clusters/pfv-k8s/apps/kuma-glpi-bridge/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - deployment.yaml
diff --git a/clusters/pfv-k8s/apps/kuma-glpi-bridge/namespace.yaml b/clusters/pfv-k8s/apps/kuma-glpi-bridge/namespace.yaml
new file mode 100644
index 0000000..caccbfa
--- /dev/null
+++ b/clusters/pfv-k8s/apps/kuma-glpi-bridge/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kuma-glpi-bridge
diff --git a/clusters/pfv-k8s/apps/kustomization.yaml b/clusters/pfv-k8s/apps/kustomization.yaml
index aa78611..cda9bb4 100644
--- a/clusters/pfv-k8s/apps/kustomization.yaml
+++ b/clusters/pfv-k8s/apps/kustomization.yaml
@@ -1,4 +1,5 @@
-# apps: tenant workloads per ADR-0001 tenant classes. Empty until #700 lands.
+# apps: platform/ops workloads + tenant workloads per ADR-0001 tenant classes.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: []
+resources:
+  - kuma-glpi-bridge