docs-bot · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
 # Update ARG and FROM together from the Node devcontainer image tags:
 # https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
 ARG VARIANT=dev-24-bookworm
-FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:c39e4aaf0c7c4da594f845aeb98d37510343bff178b320a6f7e9e2e95ca7957e
+FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:02207aa539c49a8714bd18ba482a05381a42ee4768ea19a39a4c58f2ae6f7644
diff --git a/.github/workflows/moda-allowed-ips.yml b/.github/workflows/moda-allowed-ips.yml
@@ -30,8 +30,14 @@ jobs:
           echo "Got a list of Fastly IP addresses: $ips"
 
           echo "Updating the list of allowed IPs in Moda config..."
-          yq -i ".metadata.annotations[\"moda.github.net/allowed-ips\"] = \"$ips\"" \
+          # Update the Kustomize source and the generated file together.
+          # The moda-linter check fails if they don't match.
+          for file in \
+            config/kustomize/overlays/production/services/webapp.yaml \
             config/kubernetes/production/services/webapp.yaml
+          do
+            yq -i ".metadata.annotations[\"moda.github.net/allowed-ips\"] = \"$ips\"" "$file"
+          done
           echo "Updated the list of allowed IPs in Moda config"
 
           echo "Checking if there is a change to make..."

diff --git a/config/kubernetes/default/README.md b/config/kubernetes/default/README.md
@@ -0,0 +1,9 @@
+# Configuration for `default` environment
+
+The configuration in this directory was autogenerated with Kustomize.
+
+It contains the configuration for the **default** environment.
+
+Please avoid editing the files in this directory directly, as they will be overwritten by the next generation.
+
+To learn more about how to use [Kustomize](https://kustomize.io/) at GitHub, please visit [Kustomize on The Hub](https://thehub.github.com/epd/engineering/products-and-services/internal/moda/kustomize/).
diff --git a/config/kubernetes/default/deployments/webapp.yaml b/config/kubernetes/default/deployments/webapp.yaml
@@ -1,59 +1,27 @@
+# This file was generated with Kustomize. Please do not edit manually.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: webapp
   annotations:
     moda.github.net/inject-unified-service-tag-env-var: docs-internal
+  name: webapp
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: webapp
   template:
     metadata:
-      labels:
-        app: webapp
       annotations:
-        # Use logfmt_sloppy because internal logs write unstructured stdout and stderr.
-        # https://thehub.github.com/epd/engineering/dev-practicals/observability/logging/
+        ad.datadoghq.com/tolerate-unready: 'true'
+        ad.datadoghq.com/webapp.logs: '[{"source":"nodejs","service":"docs-internal","tags":["env:staging"]}]'
         fluentbit.io/parser: logfmt_sloppy
         observability.github.com/splunk_index: docs-internal
-        ad.datadoghq.com/webapp.logs: '[{"source":"nodejs","service":"docs-internal","tags":["env:staging"]}]'
-        ad.datadoghq.com/tolerate-unready: 'true'
+      labels:
+        app: webapp
     spec:
-      dnsPolicy: Default
-      terminationGracePeriodSeconds: 60
       containers:
-        - name: webapp
-          image: docs-internal
-          # Retune using 2 weeks of data:
-          # https://app.datadoghq.com/dashboard/6vx-iun-ghs/moda-resource-recommendations?tpl_var_kube_namespace%5B0%5D=docs-internal-staging-balsam&tpl_var_kube_namespace%5B1%5D=docs-internal-staging-boxwood&tpl_var_kube_namespace%5B2%5D=docs-internal-staging-cedar&tpl_var_kube_namespace%5B3%5D=docs-internal-staging-cypress&tpl_var_kube_namespace%5B4%5D=docs-internal-staging-fir&tpl_var_kube_namespace%5B5%5D=docs-internal-staging-hemlock&tpl_var_kube_namespace%5B6%5D=docs-internal-staging-hinoki&tpl_var_kube_namespace%5B7%5D=docs-internal-staging-holly&tpl_var_kube_namespace%5B8%5D=docs-internal-staging-juniper&tpl_var_kube_namespace%5B9%5D=docs-internal-staging-laurel&tpl_var_kube_namespace%5B10%5D=docs-internal-staging-pine&tpl_var_kube_namespace%5B11%5D=docs-internal-staging-redwood&tpl_var_kube_namespace%5B12%5D=docs-internal-staging-sequoia&tpl_var_kube_namespace%5B13%5D=docs-internal-staging-spruce&tpl_var_kube_namespace%5B14%5D=docs-internal-staging-yew&from_ts=0&to_ts=1209600000&live=true
-          # Staging is not budget checked.
-          resources:
-            requests:
-              # requests.cpu: 150m idle schedule floor because staging idles near zero.
-              cpu: 150m
-              # requests.memory: highest-peak pod p99 (1882Mi) * 1.1 for working-set padding.
-              memory: 2070Mi
-            limits:
-              # limits.cpu: highest warmup peak (1.82 cores) * 3 for startup headroom.
-              cpu: 5460m
-              # limits.memory: highest-peak pod max (1882Mi) * 2.
-              # Over the limit means OOMKill; memory is not compressible.
-              memory: 3764Mi
-          ports:
-            - name: http
-              containerPort: 4000
-              protocol: TCP
-          envFrom:
-            - secretRef:
-                name: vault-secrets
-            - configMapRef:
-                name: kube-cluster-metadata
-            # Moda creates application-config from config/moda/configuration/*/env.yaml.
-            - configMapRef:
-                name: application-config
-          env:
+        - env:
             - name: POD_NAME
               valueFrom:
                 fieldRef:
@@ -62,25 +30,46 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-          # Sleep before shutdown so Moda drains connections before old pods exit.
-          # https://thehub.github.com/engineering/products-and-services/internal/moda/feature-documentation/pod-lifecycle/#required-prestop-hook
+          envFrom:
+            - secretRef:
+                name: vault-secrets
+            - configMapRef:
+                name: kube-cluster-metadata
+            - configMapRef:
+                name: application-config
+          image: docs-internal
           lifecycle:
             preStop:
               exec:
-                command: ['sleep', '5']
-          # See config/kubernetes/production/deployments/webapp.yaml for probe details.
-          startupProbe:
+                command:
+                  - sleep
+                  - '5'
+          name: webapp
+          ports:
+            - containerPort: 4000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 5
             httpGet:
               path: /healthcheck
               port: http
-            initialDelaySeconds: 30
-            periodSeconds: 5
-            failureThreshold: 30
+            periodSeconds: 10
             timeoutSeconds: 5
-          readinessProbe:
+          resources:
+            limits:
+              cpu: 5460m
+              memory: 3764Mi
+            requests:
+              cpu: 150m
+              memory: 2070Mi
+          startupProbe:
+            failureThreshold: 30
             httpGet:
               path: /healthcheck
               port: http
-            periodSeconds: 10
-            failureThreshold: 5
+            initialDelaySeconds: 30
+            periodSeconds: 5
             timeoutSeconds: 5
+      dnsPolicy: Default
+      terminationGracePeriodSeconds: 60
diff --git a/config/kubernetes/default/services/webapp.yaml b/config/kubernetes/default/services/webapp.yaml
@@ -1,13 +1,13 @@
+# This file was generated with Kustomize. Please do not edit manually.
 apiVersion: v1
 kind: Service
 metadata:
-  name: webapp
-  labels:
-    service: webapp
   annotations:
-    moda.github.net/domain-name: 'docs-internal-%environment%.service.%region%.github.net'
-    # Expose the employee website as an internal HTTP load balancer.
+    moda.github.net/domain-name: docs-internal-%environment%.service.%region%.github.net
     moda.github.net/load-balancer-type: internal-http
+  labels:
+    service: webapp
+  name: webapp
 spec:
   ports:
     - name: http

diff --git a/config/kubernetes/docs-internal-review-lab/README.md b/config/kubernetes/docs-internal-review-lab/README.md
@@ -0,0 +1,9 @@
+# Configuration for `docs-internal-review-lab` environment
+
+The configuration in this directory was autogenerated with Kustomize.
+
+It contains the configuration for the **docs-internal-review-lab** environment.
+
+Please avoid editing the files in this directory directly, as they will be overwritten by the next generation.
+
+To learn more about how to use [Kustomize](https://kustomize.io/) at GitHub, please visit [Kustomize on The Hub](https://thehub.github.com/epd/engineering/products-and-services/internal/moda/kustomize/).
diff --git a/config/kubernetes/docs-internal-review-lab/deployments/webapp.yaml b/config/kubernetes/docs-internal-review-lab/deployments/webapp.yaml
@@ -0,0 +1,75 @@
+# This file was generated with Kustomize. Please do not edit manually.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    moda.github.net/inject-unified-service-tag-env-var: docs-internal
+  name: webapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: webapp
+  template:
+    metadata:
+      annotations:
+        ad.datadoghq.com/tolerate-unready: 'true'
+        ad.datadoghq.com/webapp.logs: '[{"source":"nodejs","service":"docs-internal","tags":["env:docs-internal-review-lab"]}]'
+        fluentbit.io/parser: logfmt_sloppy
+        observability.github.com/splunk_index: docs-internal
+      labels:
+        app: webapp
+    spec:
+      containers:
+        - env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          envFrom:
+            - secretRef:
+                name: vault-secrets
+            - configMapRef:
+                name: kube-cluster-metadata
+            - configMapRef:
+                name: application-config
+          image: docs-internal
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - sleep
+                  - '5'
+          name: webapp
+          ports:
+            - containerPort: 4000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthcheck
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: 5460m
+              memory: 3764Mi
+            requests:
+              cpu: 150m
+              memory: 2070Mi
+          startupProbe:
+            failureThreshold: 30
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 5
+            timeoutSeconds: 5
+      dnsPolicy: Default
+      terminationGracePeriodSeconds: 60
diff --git a/config/kubernetes/docs-internal-review-lab/ingresses/http.yaml b/config/kubernetes/docs-internal-review-lab/ingresses/http.yaml
@@ -0,0 +1,25 @@
+# This file was generated with Kustomize. Please do not edit manually.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    tailscale.com/http-endpoint: enabled
+    tailscale.com/proxy-group: ingress-proxies
+    tailscale.com/tags: tag:proxima-review-lab
+  name: http
+  namespace: '%namespace%'
+spec:
+  ingressClassName: tailscale
+  rules:
+    - http:
+        paths:
+          - backend:
+              service:
+                name: router
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - '%namespace%'
diff --git a/config/kubernetes/docs-internal-review-lab/services/router.yaml b/config/kubernetes/docs-internal-review-lab/services/router.yaml
@@ -0,0 +1,16 @@
+# This file was generated with Kustomize. Please do not edit manually.
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    service: router
+  name: router
+spec:
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: webapp
+  type: ClusterIP
diff --git a/config/kubernetes/production/README.md b/config/kubernetes/production/README.md
@@ -0,0 +1,9 @@
+# Configuration for `production` environment
+
+The configuration in this directory was autogenerated with Kustomize.
+
+It contains the configuration for the **production** environment.
+
+Please avoid editing the files in this directory directly, as they will be overwritten by the next generation.
+
+To learn more about how to use [Kustomize](https://kustomize.io/) at GitHub, please visit [Kustomize on The Hub](https://thehub.github.com/epd/engineering/products-and-services/internal/moda/kustomize/).