apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}
  namespace: ${K8S_NAMESPACE}
spec:
  replicas: 10
  selector:
    matchLabels:
      app: ${APP_NAME}
  template:
    metadata:
      labels:
        app: ${APP_NAME}
    spec:
      hostAliases:
      - ip: ${IP_LANGFUSE}
        hostnames:
        - ${DNS_LANGFUSE}
      - ip: ${IP_CLUSTER_AI}
        hostnames:
        - ${HOSTNAME_CLUSTER_AI}
      - ip: 10.151.0.100
        hostnames:
          - pmid.internal.timbrasil.com.br
      - ip: ${IP_ADB}
        hostnames:
          - ${HOST_ADB_1}
          - ${HOST_ADB_2}
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: ${APP_NAME}
        image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
        ports:
        - containerPort: 8000
        env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: "/etc/google/credentials.json"

        envFrom:
        - secretRef:
            name: ${APP_NAME}-api-secrets
        - configMapRef:
            name: ${APP_NAME}-config
        - secretRef:
            name: ${APP_NAME}-api-secrets-extras

        volumeMounts:
        - name: google-sa-volume
          mountPath: "/etc/google"
          readOnly: true

        livenessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 30
          periodSeconds: 20
          timeoutSeconds: 5
          failureThreshold: 3

        readinessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 20
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 3

        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "2048Mi"
            cpu: "1"

      volumes:
      - name: google-sa-volume
        secret:
          secretName: ${APP_NAME}-google-sa-secret
---
apiVersion: v1
kind: Service
metadata:
  name: ${APP_NAME}-service
  namespace: ${K8S_NAMESPACE}
spec:
  type: NodePort
  selector:
    app: ${APP_NAME}
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8000
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ${APP_NAME}-ingress-https
  namespace: ${K8S_NAMESPACE}
  annotations:
    oci-native-ingress.oraclecloud.com/healthcheck-path: "/health"
    oci-native-ingress.oraclecloud.com/healthcheck-protocol: "HTTP"
    oci-native-ingress.oraclecloud.com/healthcheck-return-code: "200"
    oci-native-ingress.oraclecloud.com/backend-tls-enabled: "false"
spec:
  ingressClassName: default-ingress-class
  tls:
  - hosts:
    - ${DNS}
    secretName: shared-tls-secret
  rules:
  - host: ${DNS}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}-service
            port:
              number: 443
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ${APP_NAME}-ingress-http
  namespace: ${K8S_NAMESPACE}
  annotations:
    oci-native-ingress.oraclecloud.com/healthcheck-path: "/health"
    oci-native-ingress.oraclecloud.com/healthcheck-protocol: "HTTP"
    oci-native-ingress.oraclecloud.com/healthcheck-return-code: "200"
spec:
  ingressClassName: default-ingress-class
  rules:
  - host: ${DNS}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}-service
            port:
              number: 80