Deploy Applications

Prepare Kubernetes workloads for clean, repeatable delivery on Kupe Cloud.

For the Argo CD wiring itself, see Create Argo CD Applications.

What a deployable app should include

Before a workload is promoted beyond a first test environment, it should usually have:

health probes
resource requests and limits
a Service for in-cluster traffic
an HTTPRoute if the app needs external traffic
structured logs and metrics where possible
everything defined in Git

Example workload

Use the security settings in this example: non-root execution, no privilege escalation, and all capabilities dropped. Workloads missing required settings will not start. Check pod events for a policy error if a deployment stalls.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
      annotations:
        k8s.grafana.com/scrape: "true"
        k8s.grafana.com/metrics.path: "/metrics"
        k8s.grafana.com/metrics.portNumber: "8080"
    spec:
      automountServiceAccountToken: false
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: web
          image: ghcr.io/your-org/web:1.2.3
          ports:
            - containerPort: 8080
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8080
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: web
spec:
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080

If the app needs external traffic

Add an HTTPRoute in your application namespace:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: web
  namespace: web
spec:
  parentRefs:
    - name: external-gateway
      namespace: kube-system
  hostnames:
    - web.<cluster>.<tenant>.clusters.kupe.cloud
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: web
          port: 80

App hostnames must sit under your cluster’s dedicated subdomain *.<cluster>.<tenant>.clusters.kupe.cloud. A platform hostname outside it is rejected at admission. For custom domains, keep the same route model and follow Custom Domains.

Rollout validation

Once Argo CD syncs the application, check the basics in order:

Argo CD shows the app as Synced and Healthy.
The workload reaches the expected replica count.
Service endpoints are ready.
The route is accepted if the app is exposed externally.
Logs and metrics look normal after the rollout.

Useful cluster-side checks:

kubectl get deploy,pods,svc -n <namespace>
kubectl rollout status deploy/<name> -n <namespace>
kubectl get httproute -n <namespace>

Common causes of a failed first deploy

the container is not listening on the port the Service expects
readiness or liveness probes point at the wrong path
resource limits are missing or too low for the workload
the application is deployed to the wrong namespace
the HTTPRoute points at the wrong Service or port
image pull credentials or image tags are wrong