Add Core Hub staging deployment profile

k8s/railiance-staging/00-namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: core-hub-staging
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/part-of: core-hub
+    environment: staging

k8s/railiance-staging/20-runtime.yaml

@@ -0,0 +1,113 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: core-hub-staging-runtime
+  namespace: core-hub-staging
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/part-of: core-hub
+    environment: staging
+data:
+  CORE_HUB_ENV: staging
+  CORE_HUB_AUTO_CREATE_TABLES: "0"
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: core-hub-staging-migrate
+  namespace: core-hub-staging
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: core-hub
+    environment: staging
+spec:
+  backoffLimit: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: core-hub
+        app.kubernetes.io/component: migration
+        app.kubernetes.io/part-of: core-hub
+        environment: staging
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: migrate
+          image: gitea.coulomb.social/coulomb/core-hub:staging-placeholder
+          imagePullPolicy: IfNotPresent
+          command: ["alembic", "upgrade", "head"]
+          envFrom:
+            - configMapRef:
+                name: core-hub-staging-runtime
+            - secretRef:
+                name: core-hub-staging-env
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: core-hub-api
+  namespace: core-hub-staging
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: core-hub
+    environment: staging
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: core-hub
+      app.kubernetes.io/component: api
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: core-hub
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: core-hub
+        environment: staging
+    spec:
+      containers:
+        - name: api
+          image: gitea.coulomb.social/coulomb/core-hub:staging-placeholder
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8010
+          envFrom:
+            - configMapRef:
+                name: core-hub-staging-runtime
+            - secretRef:
+                name: core-hub-staging-env
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: core-hub-api
+  namespace: core-hub-staging
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: core-hub
+    environment: staging
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/component: api
+  ports:
+    - name: http
+      port: 8010
+      targetPort: http

k8s/railiance-staging/README.md

@@ -0,0 +1,53 @@
+# Core Hub Railiance Staging Profile
+
+This directory contains the service-repo staging profile for Core Hub. It is a
+handoffable profile, not the final Railiance app chart. When `railiance-apps`
+gets the permanent chart/Helm ownership, keep these contracts intact or record
+an explicit supersede decision.
+
+## Runtime Shape
+
+- Namespace: `core-hub-staging`
+- API deployment: `deploy/core-hub-api`
+- Service: `svc/core-hub-api` on port `8010`
+- Migration job: `job/core-hub-staging-migrate`
+- Non-secret ConfigMap: `core-hub-staging-runtime`
+- Secret reference: `core-hub-staging-env`
+
+`core-hub-staging-env` must be provisioned by the approved custody path before
+running the migration job or API deployment. It must contain:
+
+- `CORE_HUB_DATABASE_URL`: async SQLAlchemy URL, normally
+  `postgresql+asyncpg://...` for the staging database.
+- `CORE_HUB_API_TOKEN`: operator token used by deployed smokes and protected
+  bootstrap/API operations.
+
+Do not add plaintext secret values to these manifests.
+
+## Image
+
+The committed manifest uses `gitea.coulomb.social/coulomb/core-hub:staging-placeholder`.
+Operators should patch or render the immutable image tag for the deployment and
+migration job before apply.
+
+## Apply Skeleton
+
+```bash
+kubectl apply -f k8s/railiance-staging/00-namespace.yaml
+kubectl -n core-hub-staging get secret core-hub-staging-env
+kubectl apply -f k8s/railiance-staging/20-runtime.yaml
+kubectl -n core-hub-staging set image job/core-hub-staging-migrate \
+  migrate=gitea.coulomb.social/coulomb/core-hub:<tag>
+kubectl -n core-hub-staging wait --for=condition=complete \
+  job/core-hub-staging-migrate --timeout=180s
+kubectl -n core-hub-staging set image deploy/core-hub-api \
+  api=gitea.coulomb.social/coulomb/core-hub:<tag>
+kubectl -n core-hub-staging rollout status deploy/core-hub-api --timeout=180s
+```
+
+For repeated migrations, delete the previous job first because Kubernetes Jobs
+are effectively immutable:
+
+```bash
+kubectl -n core-hub-staging delete job core-hub-staging-migrate --ignore-not-found
+```