Add K8s manifests and CD pipeline for K3s deployment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

k8s/configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cfb-manager-config
+  namespace: default
+data:
+  CFB_BOUNCER_HOST: "10.253.100.131"
+  CFB_BOUNCER_PORT: "22"
+  CFB_BOUNCER_USER: "root"
+  CFB_CROWDSEC_HOST: "10.253.100.240"
+  CFB_CROWDSEC_PORT: "22"
+  CFB_CROWDSEC_USER: "root"

k8s/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cfb-manager
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cfb-manager
+  template:
+    metadata:
+      labels:
+        app: cfb-manager
+    spec:
+      imagePullSecrets:
+        - name: gitea-registry
+      containers:
+        - name: cfb-manager
+          image: gitea.anvil.it.com/kaffa/cf-bouncer-manager:latest
+          command: ["uv", "run", "uvicorn", "api_server:app", "--host", "0.0.0.0", "--port", "8000"]
+          ports:
+            - containerPort: 8000
+          envFrom:
+            - configMapRef:
+                name: cfb-manager-config
+          volumeMounts:
+            - name: ssh-key
+              mountPath: /root/.ssh
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          readinessProbe:
+            tcpSocket:
+              port: 8000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 8000
+            initialDelaySeconds: 60
+            periodSeconds: 30
+      volumes:
+        - name: ssh-key
+          secret:
+            secretName: cfb-ssh-key
+            defaultMode: 0600
+            items:
+              - key: id_rsa
+                path: id_rsa

k8s/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cfb-manager
+  namespace: default
+spec:
+  type: ClusterIP
+  selector:
+    app: cfb-manager
+  ports:
+    - port: 8000
+      targetPort: 8000
+      protocol: TCP