From afc05deb910c989ecc80aa684c7bf6d482cf42c5 Mon Sep 17 00:00:00 2001
From: haopengzhan <haopengzhan@gmail.com>
Date: Wed, 16 Sep 2026 23:30:21 -0700
Subject: [PATCH] chore(k8s): safeguard production secrets with example
 template and add Makefile k8s helpers

---
 .gitignore                 |  7 +++++-
 Makefile                   | 47 ++++++++++++++++++++++++++++++--------
 k8s/01-secret.example.yaml | 10 ++++++++
 k8s/01-secret.yaml         |  8 -------
 4 files changed, 53 insertions(+), 19 deletions(-)
 create mode 100644 k8s/01-secret.example.yaml
 delete mode 100644 k8s/01-secret.yaml

diff --git a/.gitignore b/.gitignore
index 76f2192..df42062 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,4 +19,9 @@ npm-debug.log*
 
 # Raw WordPress XML Exports / Backups
 *.WordPress.*.xml
-*.wxr.xml
\ No newline at end of file
+*.wxr.xml
+
+# Kubernetes Production Secrets
+k8s/01-secret.yaml
+k8s/*secret.yaml
+!k8s/*.example.yaml
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 2435e17..0d3bd4e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help dev dev-persistent test lint clean docker-build docker-run
+.PHONY: help dev dev-persistent test lint clean docker-build docker-run k8s-status k8s-logs k8s-restart k8s-sync-content
 
 # Default target
 all: help
@@ -8,15 +8,19 @@ help:
 	@echo " pengzhan.dev — Engineering Makefile"
 	@echo "========================================================================"
 	@echo "Available commands:"
-	@echo "  make dev             Start local server in Ephemeral Staging Mode"
-	@echo "                       (Safe by default: site.db is NEVER mutated)"
-	@echo "  make dev-persistent  Start local server in Persistent DB Mode"
-	@echo "                       (Changes to comments & logs write to site.db)"
-	@echo "  make test            Run complete automated test suite (in isolated temp DB)"
-	@echo "  make lint            Run comprehensive project linter (JS, EJS, CSS)"
-	@echo "  make clean           Remove temporary staging DBs and build caches"
-	@echo "  make docker-build    Build multi-stage production Docker image"
-	@echo "  make docker-run      Run production Docker container on port 3000"
+	@echo "  make dev              Start local server in Ephemeral Staging Mode"
+	@echo "                        (Safe by default: site.db is NEVER mutated)"
+	@echo "  make dev-persistent   Start local server in Persistent DB Mode"
+	@echo "                        (Changes to comments & logs write to site.db)"
+	@echo "  make test             Run complete automated test suite"
+	@echo "  make lint             Run comprehensive project linter (JS, EJS, CSS)"
+	@echo "  make clean            Remove temporary staging DBs and build caches"
+	@echo "  make docker-build     Build multi-stage production Docker image"
+	@echo "  make docker-run       Run production Docker container on port 3000"
+	@echo "  make k8s-status       Show pods, service, ingress, and PVC in k8s"
+	@echo "  make k8s-logs         Stream live logs from production pod"
+	@echo "  make k8s-restart      Trigger zero-downtime rolling restart"
+	@echo "  make k8s-sync-content Sync local markdown/media into live cluster PVC"
 	@echo "========================================================================"
 
 dev:
@@ -50,3 +54,26 @@ docker-build:
 docker-run:
 	@echo "Running Docker container on http://localhost:3000..."
 	docker run --rm -p 3000:3000 -v $(PWD)/sample-content:/app/content pengzhan.dev:latest
+
+k8s-status:
+	@echo "Checking Kubernetes status in namespace pengzhan-dev..."
+	kubectl get pods,svc,ingress,pvc -n pengzhan-dev -o wide
+
+k8s-logs:
+	@echo "Streaming logs from pengzhan-web deployment..."
+	kubectl logs -f deployment/pengzhan-web -n pengzhan-dev
+
+k8s-restart:
+	@echo "Triggering zero-downtime rolling restart of pengzhan-web..."
+	kubectl rollout restart deployment/pengzhan-web -n pengzhan-dev
+	kubectl rollout status deployment/pengzhan-web -n pengzhan-dev
+
+k8s-sync-content:
+	@echo "Syncing local sample-content/ to Kubernetes /app/content/..."
+	@POD=$$(kubectl get pod -n pengzhan-dev -l app=pengzhan-web -o jsonpath='{.items[0].metadata.name}'); \
+	if [ -z "$$POD" ]; then \
+	  echo "Error: No running pengzhan-web pod found."; exit 1; \
+	fi; \
+	echo "-> Target pod: $$POD"; \
+	kubectl cp sample-content/. pengzhan-dev/$$POD:/app/content/; \
+	echo "-> Sync complete. Hot-reload watcher will index new content."
diff --git a/k8s/01-secret.example.yaml b/k8s/01-secret.example.yaml
new file mode 100644
index 0000000..58556ff
--- /dev/null
+++ b/k8s/01-secret.example.yaml
@@ -0,0 +1,10 @@
+# Template Kubernetes secret for pengzhan.dev
+# Copy this file to k8s/01-secret.yaml (gitignored) and customize before applying.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pengzhan-secrets
+  namespace: pengzhan-dev
+type: Opaque
+stringData:
+  ADMIN_SECRET: "CHANGEME_ADMIN_SECRET"
diff --git a/k8s/01-secret.yaml b/k8s/01-secret.yaml
deleted file mode 100644
index 7ddd4d8..0000000
--- a/k8s/01-secret.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: pengzhan-secrets
-  namespace: pengzhan-dev
-type: Opaque
-stringData:
-  ADMIN_SECRET: "admin"