Deploy on Kubernetes

The deploy/k8s overlay provides a namespace, gateway Deployment, worker Deployment, migration Job, Services, and an Ingress example.

Supply dependencies and secrets

Provide PostgreSQL 14 or newer and Redis 7.2 or newer. PostgreSQL must use a deterministic C or C.UTF-8 collation. Redis is coordination state: configure noeviction; persistence is optional.

Replace the secret template with your secret-management workflow. The manifests expect:

• gw-secrets for connection strings and secret configuration
• gw-keys for the JWT, cursor, KEK, and session key files

Key files are mounted read-only. The pod security context and 0440 secret mode let the unprivileged process read them without making them world-readable.

Apply and verify

After adapting image references, hosts, storage, and secret sources:

kubectl apply -k deploy/k8s/
kubectl -n email-gw get jobs,pods,deployments
kubectl -n email-gw rollout status deployment/gateway

The migration Job must complete before the gateway reports ready. The probes distinguish liveness from readiness: /healthz remains available while /readyz checks dependencies, migrations, and draining state.

Configure the Ingress for TLS, WebSocket upgrades, and long upstream timeouts. Keep the metrics Service private to the cluster or protect it with your monitoring network policy.

Scale gateway and worker Deployments independently. Never scale workers to zero while the service is accepting requests.