Decision Control — Deployment

# 1. Postgres
docker run -d --name dc-postgres \
  -e POSTGRES_DB=decision_control \
  -e POSTGRES_USER=dc \
  -e POSTGRES_PASSWORD=dc \
  -p 5432:5432 \
  postgres:18

# 2. Decision Control
docker run --rm --name decision-control \
  -p 8080:8080 \
  -e SPRING_PROFILES_ACTIVE=postgres \
  -e SPRING_DATASOURCE_URL=jdbc:postgresql://host.docker.internal:5432/decision_control \
  -e SPRING_DATASOURCE_USERNAME=dc \
  -e SPRING_DATASOURCE_PASSWORD=dc \
  -e HIBERNATE_DDL_AUTO=update \
  -e ALETYX_OIDC_PROVIDER=none \
  <your-registry>/aletyx/decision-control-horizon:<version>

# decision-control.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: decision-control
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: decision-control-config
  namespace: decision-control
data:
  SPRING_PROFILES_ACTIVE: "postgres"
  APP_HOST: "https://<your-host>"
  CORS_PROXY_ALLOWED_ORIGINS: "https://<your-host>"
  HIBERNATE_DDL_AUTO: "validate"
  SPRING_DATASOURCE_URL: "jdbc:postgresql://<db-host>:5432/<db-name>"
  SPRING_DATASOURCE_USERNAME: "<db-user>"
  ALETYX_OIDC_PROVIDER: "entra"
  ALETYX_OIDC_CLIENT_ID: "<your-entra-client-id>"
  ALETYX_OIDC_SCOPES: "openid,profile,email"
  ALETYX_OIDC_ROLE_CLAIM_PATH: "roles"
  ALETYX_OIDC_TENANT_CLAIM_NAME: "tid"
  ALETYX_OIDC_ENTRA_TENANT_ID: "<your-entra-tenant-id>"
  ALETYX_OIDC_ENTRA_AUDIENCE: "<your-entra-client-id>"
  ALETYX_OIDC_RBAC_ENABLED: "true"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS: "user,tower-approvers"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_PUBLISH: "user,tower-approvers"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS_AUTHOR: "user"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS_MANAGE: "tower-approvers"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS_MONITOR: "tower-approvers"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS_PROMPT: "user,tower-approvers"
  ALETYX_OIDC_RBAC_ROLES_ALLOWED_ACCESS_RUN: "user,tower-approvers"
---
apiVersion: v1
kind: Secret
metadata:
  name: decision-control-secret
  namespace: decision-control
type: Opaque
stringData:
  SPRING_DATASOURCE_PASSWORD: "<your-db-password>"
  ALETYX_OIDC_ENTRA_CLIENT_SECRET: "<your-entra-client-secret>"
  ALETYX_OIDC_INTERNAL_SECRET: "<your-shared-internal-secret>"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: decision-control
  namespace: decision-control
spec:
  replicas: 1
  selector:
    matchLabels: { app: decision-control }
  template:
    metadata:
      labels: { app: decision-control }
    spec:
      containers:
        - name: decision-control
          image: <your-registry>/aletyx/decision-control-horizon:<version>
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef: { name: decision-control-config }
            - secretRef:    { name: decision-control-secret }
          readinessProbe:
            httpGet: { path: /actuator/health, port: 8080 }
            initialDelaySeconds: 30
          livenessProbe:
            httpGet: { path: /actuator/health, port: 8080 }
            initialDelaySeconds: 60
---
apiVersion: v1
kind: Service
metadata:
  name: decision-control
  namespace: decision-control
spec:
  selector: { app: decision-control }
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: decision-control
  namespace: decision-control
  annotations:
    cert-manager.io/cluster-issuer: <your-cluster-issuer>
spec:
  ingressClassName: <your-ingress-class>
  tls:
    - hosts: [ "<your-host>" ]
      secretName: decision-control-tls
  rules:
    - host: <your-host>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: decision-control
                port: { number: 80 }

kubectl apply -f decision-control.yaml
kubectl rollout status deployment/decision-control -n decision-control