Nextcloud mono pod

Migration procedure:

1. Apply only the deployment (app).
2. Apply all.
3. Remove dangling resources.

Security

The pod security context has been removed. Is it dangerous ?

nextcloud/manifests/app.yml

@@ -9,29 +9,6 @@ metadata:
     app.kubernetes.io/part-of: Nextcloud
   name: ${FQDN}-app
   namespace: ${NS}
-spec:
-  ports:
-  - name: api
-    port: 9000
-    protocol: TCP
-    targetPort: api
-  selector:
-    app.kubernetes.io/component: app
-    app.kubernetes.io/instance: ${FQDN}
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/part-of: Nextcloud
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/component: web
-    app.kubernetes.io/instance: ${FQDN}
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/part-of: Nextcloud
-  name: ${FQDN}-web
-  namespace: ${NS}
 spec:
   ports:
   - name: http
@@ -39,11 +16,10 @@ spec:
     protocol: TCP
     targetPort: http
   selector:
-    app.kubernetes.io/component: web
+    app.kubernetes.io/component: app
     app.kubernetes.io/instance: ${FQDN}
     app.kubernetes.io/name: nextcloud
     app.kubernetes.io/part-of: Nextcloud
-  sessionAffinity: None
   type: ClusterIP
 ---
 apiVersion: extensions/v1beta1
@@ -66,7 +42,7 @@ spec:
     http:
       paths:
       - backend:
-          serviceName: ${FQDN}-web
+          serviceName: ${FQDN}-app
           servicePort: http
         path: /
   tls:
@@ -117,20 +93,36 @@ spec:
                 operator: In
                 values:
                 - "true"
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-          - topologyKey: kubernetes.io/hostname
-            labelSelector:
-              matchExpressions:
-              - key: app.kubernetes.io/instance
-                operator: In
-                values:
-                - ${FQDN}
-              - key: app.kubernetes.io/component
-                operator: In
-                values:
-                - app
       containers:
+      - image: libresh/nextcloud:${NC_WEB_IMAGE_TAG}
+        imagePullPolicy: Always
+        name: web
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        env:
+        - name: BACKEND_HOST
+          value: localhost
+        livenessProbe:
+          httpGet:
+            path: /heartbeat
+            port: 80
+            httpHeaders:
+            - name: Host
+              value: localhost
+        readinessProbe:
+          httpGet:
+            path: /heartbeat
+            port: 80
+            httpHeaders:
+            - name: Host
+              value: localhost
+        resources: 
+          requests:
+            memory: "80Mi"
+          limits:
+            memory: "400Mi"
       - command: ["/bin/sh"]
         args:
         - -c
@@ -180,17 +172,19 @@ spec:
         imagePullPolicy: Always
         name: app
         livenessProbe:
-          exec:
-            command:
-            - /php-fpm-healthcheck
-          initialDelaySeconds: 10
-          periodSeconds: 60
+          httpGet:
+            path: /heartbeat
+            port: 80
+            httpHeaders:
+            - name: Host
+              value: localhost
         readinessProbe:
-          exec:
-            command:
-            - /php-fpm-healthcheck
-          initialDelaySeconds: 10
-          periodSeconds: 60
+          httpGet:
+            path: /heartbeat
+            port: 80
+            httpHeaders:
+            - name: Host
+              value: localhost
         ports:
         - containerPort: 9000
           name: api
@@ -205,92 +199,6 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext:
-        fsGroup: 82
-        runAsGroup: 82
-        runAsUser: 82
-      terminationGracePeriodSeconds: 30
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/component: web
-    app.kubernetes.io/instance: ${FQDN}
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/part-of: Nextcloud
-  name: ${FQDN}-web
-  namespace: ${NS}
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 2
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: web
-      app.kubernetes.io/instance: ${FQDN}
-      app.kubernetes.io/name: nextcloud
-      app.kubernetes.io/part-of: Nextcloud
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: web
-        app.kubernetes.io/instance: ${FQDN}
-        app.kubernetes.io/name: nextcloud
-        app.kubernetes.io/part-of: Nextcloud
-    spec:
-      affinity:
-        podAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 10
-              podAffinityTerm:
-                topologyKey: kubernetes.io/hostname
-                labelSelector:
-                  matchExpressions:
-                  - key: app.kubernetes.io/instance
-                    operator: In
-                    values:
-                    - ${FQDN}
-                  - key: app.kubernetes.io/component
-                    operator: In
-                    values:
-                    - app
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-          - topologyKey: kubernetes.io/hostname
-            labelSelector:
-              matchExpressions:
-              - key: app.kubernetes.io/instance
-                operator: In
-                values:
-                - ${FQDN} 
-              - key: app.kubernetes.io/component
-                operator: In
-                values:
-                - web
-      containers:
-      - image: libresh/nextcloud:${NC_WEB_IMAGE_TAG}
-        imagePullPolicy: Always
-        name: web
-        ports:
-        - containerPort: 80
-          name: http
-          protocol: TCP
-        env:
-        - name: BACKEND_HOST
-          value: ${FQDN}-app
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
       terminationGracePeriodSeconds: 30
 ---
 apiVersion: batch/v1beta1