배포

# gunicorn.conf.py
def worker_exit(server, worker):
    from sophonz.opentelemetry import shutdown
 
    shutdown()

OTEL_SERVICE_NAME=checkout-api
OTEL_EXPORTER_OTLP_ENDPOINT=https://in.sophonz.ai
OTEL_PROPAGATORS=tracecontext,baggage
OTEL_RESOURCE_ATTRIBUTES=service.namespace=shop
OTEL_METRICS_EXPORTER=none
SOPHONZ_STARTUP_LOGS=false

FROM python:3.13-slim
 
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1
 
RUN groupadd --system --gid 1001 app \
 && useradd --system --uid 1001 --gid app --no-create-home \
      --home-dir /nonexistent --shell /usr/sbin/nologin app
 
COPY requirements.txt /tmp/requirements.txt
RUN python -m venv /opt/venv \
 && /opt/venv/bin/pip install --requirement /tmp/requirements.txt \
 && rm /tmp/requirements.txt
 
WORKDIR /app
COPY gunicorn.conf.py ./
COPY myservice/ ./myservice/
# 빌드 시점에 바이트 컴파일합니다: 런타임에는 루트 파일시스템이 읽기 전용입니다.
RUN python -m compileall -q /app
 
ENV PATH=/opt/venv/bin:$PATH
USER 1001:1001
EXPOSE 8000
 
CMD ["gunicorn", "--config", "/app/gunicorn.conf.py", "myservice.wsgi:app"]

# requirements.txt
sophonz-opentelemetry[flask,psycopg]==0.1.0
flask
gunicorn
psycopg[binary,pool]

# gunicorn.conf.py
worker_tmp_dir = "/tmp"          # 워커 하트비트 파일
control_socket_disable = True    # 최신 gunicorn은 $HOME 아래에 제어 소켓을 만듭니다

CMD ["uvicorn", "myservice.main:app", "--host", "0.0.0.0", "--port", "8000", \
     "--loop", "asyncio", "--proxy-headers", "--forwarded-allow-ips", "*", \
     "--timeout-graceful-shutdown", "20"]

kubectl create secret generic sophonz-service-key \
  --from-literal=SOPHONZ_API_KEY='sk_...'

apiVersion: v1
kind: ConfigMap
metadata:
  name: checkout-api-config
data:
  PORT: "8000"
  WEB_CONCURRENCY: "2"
  OTEL_SERVICE_NAME: checkout-api
  OTEL_EXPORTER_OTLP_ENDPOINT: https://in.sophonz.ai
  OTEL_PROPAGATORS: tracecontext,baggage
  OTEL_RESOURCE_ATTRIBUTES: service.namespace=shop
  OTEL_METRICS_EXPORTER: none
  SOPHONZ_STARTUP_LOGS: "false"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: checkout-api
spec:
  replicas: 2
  selector:
    matchLabels:
      app: checkout-api
  template:
    metadata:
      labels:
        app: checkout-api
    spec:
      automountServiceAccountToken: false
      # gunicorn graceful_timeout(20초)에 SDK flush(최대 5초)를 더한 값.
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: checkout-api
          image: registry.example.com/checkout-api:1.0.0
          ports:
            - name: http
              containerPort: 8000
          envFrom:
            - configMapRef:
                name: checkout-api-config
          env:
            # 일부러 필수로 둡니다: 키가 없으면 SDK는 경고만 남기고,
            # 파드는 텔레메트리 없이 실행됩니다.
            - name: SOPHONZ_API_KEY
              valueFrom:
                secretKeyRef:
                  name: sophonz-service-key
                  key: SOPHONZ_API_KEY
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: DATABASE_URL
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          readinessProbe:
            httpGet:
              path: /ready
              port: http
          livenessProbe:
            httpGet:
              path: /health
              port: http
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}