Demonstration application¶
The application provides basic user management to follow a change from source code into Kubernetes. This documentation focuses on its build and runtime contracts, which shape CI/CD and infrastructure.
Components¶
| Element | Backend | Frontend |
|---|---|---|
| Maven project | es.canals / artifact rest |
es.canals.web / artifact frontend |
| Runtime | Java 17; Spring Boot 3.3.3; WebFlux | Java 17; Spring Boot 3.3.3; WebFlux |
| Responsibility | REST API, validation and JPA/MySQL persistence | FreeMarker and Vue components served by Java |
| Artifact | target/app.jar |
target/app.jar |
| Default effective port | 8080 (REST_PORT) |
8080 (WEB_PORT) |
| Kubernetes name | rest |
web |
| Runtime dependency | MySQL and the rest Secret |
Browser access to API routes |
The frontend is not built by a Node/npm pipeline: Maven packages the server and its resources. Its POM includes Sass and minification tasks. Documenting every visual component is unnecessary to reproduce the DevOps path.
API and persistence¶
Controllers implement user reads, creation, updates and deletion under /api/v1/users, with an item route /{username}. The collection accepts search and pagination parameters. This identifies the contract; it does not replace an OpenAPI specification, which is absent from the reviewed repositories.
The backend consumes REST_DB_HOST, REST_DB_PORT, REST_DB_DATABASE, REST_DB_USER and REST_DB_PASSWORD. Hibernate uses ddl-auto: update. No versioned database migration system is present in the snapshot. Rolling back an image does not reverse schema or data changes.
Browser requests¶
The frontend uses WEB_REST_URL, defaulting to http://rest:8080 in application configuration. Its Deployment explicitly supplies an empty string. Frontend endpoint generation then permits same-origin paths such as /api/v1/users, matching the Ingress that routes /api/v1 to the backend and / to the frontend.
The internal DNS name rest is only resolvable inside the cluster: it is not a URL an external browser can reach. When changing GKE exposure, verify actual browser requests and preserve API routing.
Container contract¶
Both Dockerfiles start from eclipse-temurin:17-jre-alpine, copy the JAR and run Java as UID 10001. Manifests add GID 10002, a read-only root filesystem, dropped capabilities and seccomp. The frontend Dockerfile declares EXPOSE 8081, while application configuration and manifests use 8080; EXPOSE does not change Spring's port. This is a documentation mismatch worth normalizing.
Each service has one replica, a 512 MiB memory request and a 1 GiB memory limit. Readiness and liveness probes open a TCP connection to port 8080. They do not verify a database query or a business operation. CPU requests/limits, HPA and PodDisruptionBudget are not declared.
Demonstration scope¶
The security configuration permits requests without business authentication; the backend also disables CSRF and allows broad CORS. OAuth dependencies in the POM do not establish a functioning identity integration. Use demonstration data and define authentication before employing the example with real users.
Neither project contains versioned src/test suites, and packaging uses -DskipTests. Quality and security analyses are covered in their chapter; they are separate from functional tests.