apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: demo-app
  namespace: demo-app
spec:
  replicas: 2
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      app: demo-app
  # Canary: naya version thode traffic par chalta hai, har step ke baad
  # analysis hota hai. Analysis fail hua to Rollouts KHUD purane version par
  # wapas le jaata hai - koi insaan nahi chahiye.
  strategy:
    canary:
      maxUnavailable: 0
      maxSurge: 1
      analysis:
        templates:
          - templateName: app-health
        startingStep: 1
        args:
          - name: service
            value: demo-app.demo-app.svc.cluster.local
      steps:
        - setWeight: 25
        - pause: { duration: 60s }
        - setWeight: 50
        - pause: { duration: 60s }
        - setWeight: 100
  template:
    metadata:
      labels:
        app: demo-app
    spec:
      securityContext:
        runAsNonRoot: true
        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
        # isliye numeric uid dena zaroori hai.
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          # ye tag pipeline commit karti hai - haath se mat badlo
          image: ns31240276.ip-51-195-4.eu:5000/swim/demo-app:3-e9ed75d
          # Secrets Vault se aate hain - git me kabhi nahi.
          env:
            # Tracing: Tempo host ke bridge IP par OTLP sunta hai
            - name: OTEL_SDK_DISABLED
              value: "false"
            - name: OTEL_SERVICE_NAME
              value: "demo-app"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://192.168.124.1:4318"
            - name: OTEL_RESOURCE_ATTRIBUTES
              value: "deployment.environment=k8s,service.namespace=swim"
          envFrom:
            - secretRef:
                name: demo-app-secrets
          ports:
            - containerPort: 8000
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
            - name: tmp
              mountPath: /tmp
          resources:
            requests: { cpu: "50m",  memory: "64Mi" }
            limits:   { cpu: "500m", memory: "256Mi" }
          readinessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 15
            periodSeconds: 20
      volumes:
        - name: tmp
          emptyDir: {}