apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-api
  namespace: hello-api
spec:
  replicas: 2
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      app: hello-api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: hello-api
    spec:
      securityContext:
        runAsNonRoot: true
        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
        # isliye numeric uid dena zaroori hai.
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          # ye tag pipeline commit karti hai - haath se mat badlo
          image: ns31240276.ip-51-195-4.eu:5000/swim/hello-api:14
          # Secrets Vault se aate hain - git me kabhi nahi.
          envFrom:
            - secretRef:
                name: hello-api-secrets
          ports:
            - containerPort: 8000
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
            - name: tmp
              mountPath: /tmp
          resources:
            requests: { cpu: "50m",  memory: "64Mi" }
            limits:   { cpu: "500m", memory: "256Mi" }
          readinessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 15
            periodSeconds: 20
      volumes:
        - name: tmp
          emptyDir: {}