chore(k8s): safeguard production secrets with example template and add Makefile k8s helpers

.gitignore

@@ -20,3 +20,8 @@ npm-debug.log*
 # Raw WordPress XML Exports / Backups
 *.WordPress.*.xml
 *.wxr.xml
+
+# Kubernetes Production Secrets
+k8s/01-secret.yaml
+k8s/*secret.yaml
+!k8s/*.example.yaml

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help dev dev-persistent test lint clean docker-build docker-run
+.PHONY: help dev dev-persistent test lint clean docker-build docker-run k8s-status k8s-logs k8s-restart k8s-sync-content
 
 # Default target
 all: help
@@ -12,11 +12,15 @@ help:
 	@echo "                        (Safe by default: site.db is NEVER mutated)"
 	@echo "  make dev-persistent   Start local server in Persistent DB Mode"
 	@echo "                        (Changes to comments & logs write to site.db)"
-	@echo "  make test            Run complete automated test suite (in isolated temp DB)"
+	@echo "  make test             Run complete automated test suite"
 	@echo "  make lint             Run comprehensive project linter (JS, EJS, CSS)"
 	@echo "  make clean            Remove temporary staging DBs and build caches"
 	@echo "  make docker-build     Build multi-stage production Docker image"
 	@echo "  make docker-run       Run production Docker container on port 3000"
+	@echo "  make k8s-status       Show pods, service, ingress, and PVC in k8s"
+	@echo "  make k8s-logs         Stream live logs from production pod"
+	@echo "  make k8s-restart      Trigger zero-downtime rolling restart"
+	@echo "  make k8s-sync-content Sync local markdown/media into live cluster PVC"
 	@echo "========================================================================"
 
 dev:
@@ -50,3 +54,26 @@ docker-build:
 docker-run:
 	@echo "Running Docker container on http://localhost:3000..."
 	docker run --rm -p 3000:3000 -v $(PWD)/sample-content:/app/content pengzhan.dev:latest
+
+k8s-status:
+	@echo "Checking Kubernetes status in namespace pengzhan-dev..."
+	kubectl get pods,svc,ingress,pvc -n pengzhan-dev -o wide
+
+k8s-logs:
+	@echo "Streaming logs from pengzhan-web deployment..."
+	kubectl logs -f deployment/pengzhan-web -n pengzhan-dev
+
+k8s-restart:
+	@echo "Triggering zero-downtime rolling restart of pengzhan-web..."
+	kubectl rollout restart deployment/pengzhan-web -n pengzhan-dev
+	kubectl rollout status deployment/pengzhan-web -n pengzhan-dev
+
+k8s-sync-content:
+	@echo "Syncing local sample-content/ to Kubernetes /app/content/..."
+	@POD=$$(kubectl get pod -n pengzhan-dev -l app=pengzhan-web -o jsonpath='{.items[0].metadata.name}'); \
+	if [ -z "$$POD" ]; then \
+	  echo "Error: No running pengzhan-web pod found."; exit 1; \
+	fi; \
+	echo "-> Target pod: $$POD"; \
+	kubectl cp sample-content/. pengzhan-dev/$$POD:/app/content/; \
+	echo "-> Sync complete. Hot-reload watcher will index new content."

k8s/01-secret.example.yaml

@@ -0,0 +1,10 @@
+# Template Kubernetes secret for pengzhan.dev
+# Copy this file to k8s/01-secret.yaml (gitignored) and customize before applying.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pengzhan-secrets
+  namespace: pengzhan-dev
+type: Opaque
+stringData:
+  ADMIN_SECRET: "CHANGEME_ADMIN_SECRET"

k8s/01-secret.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: pengzhan-secrets
-  namespace: pengzhan-dev
-type: Opaque
-stringData:
-  ADMIN_SECRET: "admin"