Replace compose runtime with scoped kind deployment

deploy/docker-compose.yml

@@ -1,48 +0,0 @@
-services:
-  postgres:
-    image: postgres:16-alpine
-    environment:
-      POSTGRES_USER: nuthatch
-      POSTGRES_PASSWORD: nuthatch
-      POSTGRES_DB: nuthatch
-
-  redis:
-    image: redis:7-alpine
-
-  minio:
-    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
-
-  minio-init:
-    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        until mc alias set local http://minio:9000 minioadmin minioadmin; do sleep 1; done
-        mc mb --ignore-existing local/nuthatch
-        exit 0
-
-  nuthatch:
-    build:
-      context: ..
-      dockerfile: Dockerfile
-    environment:
-      NUTHATCH_LISTEN: 0.0.0.0:8080
-      NUTHATCH_PUBLIC_BASE_URL: http://127.0.0.1:8080
-      NUTHATCH_JWT_SECRET: dev-only-change-me-to-a-long-random-string
-      NUTHATCH_PG_CONN: host=postgres port=5432 user=nuthatch password=nuthatch dbname=nuthatch
-      NUTHATCH_REDIS_URL: redis://redis:6379/0
-      NUTHATCH_S3_ENDPOINT: http://minio:9000
-      NUTHATCH_S3_REGION: us-east-1
-      NUTHATCH_S3_BUCKET: nuthatch
-      NUTHATCH_S3_ACCESS_KEY: minioadmin
-      NUTHATCH_S3_SECRET_KEY: minioadmin
-      NUTHATCH_S3_PATH_STYLE: "true"
-      NUTHATCH_AUTH_MODE: dev
-    ports:
-      - "8080:8080"
-    restart: on-failure

deploy/kubernetes/nuthatch.yaml.in

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+data:
+  NUTHATCH_LISTEN: 0.0.0.0:8080
+  NUTHATCH_PUBLIC_BASE_URL: http://nuthatch-@@LANE@@:8080
+  NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
+  NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
+  NUTHATCH_S3_REGION: "@@S3_REGION@@"
+  NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
+  NUTHATCH_S3_PATH_STYLE: "true"
+  NUTHATCH_AUTH_MODE: dev
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+type: Opaque
+stringData:
+  NUTHATCH_JWT_SECRET: synthetic-kind-jwt-secret-@@LANE@@
+  NUTHATCH_PG_CONN: "@@PG_CONN@@"
+  NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
+  NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: nuthatch-@@LANE@@}
+  template:
+    metadata:
+      labels: {app: nuthatch-@@LANE@@}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: nuthatch
+          image: @@APP_IMAGE@@
+          imagePullPolicy: Never
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: ["ALL"]}
+          envFrom:
+            - configMapRef: {name: nuthatch-@@LANE@@}
+            - secretRef: {name: nuthatch-@@LANE@@}
+          ports:
+            - {name: http, containerPort: 8080}
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 2
+            failureThreshold: 15
+          readinessProbe:
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 2
+            failureThreshold: 30
+          resources:
+            requests: {cpu: 100m, memory: 96Mi}
+            limits: {cpu: "2", memory: 512Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+spec:
+  selector: {app: nuthatch-@@LANE@@}
+  ports:
+    - {name: http, port: 8080, targetPort: http}