apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}
  namespace: ${K8S_NAMESPACE}
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ${APP_NAME}
  template:
    metadata:
      labels:
        app: ${APP_NAME}
    spec:
      hostAliases:
      - ip: 10.153.35.23
        hostnames:
        - agt-ai-atendimento-langfuse-dev.internal.timbrasil.com.br
      - ip: ${IP_CLUSTER_AI}
        hostnames:
        - ${HOSTNAME_CLUSTER_AI}
      - ip: 10.151.3.100
        hostnames:
          - pmidfqa.internal.timbrasil.com.br
      - ip: 10.151.0.100
        hostnames:
          - pmid.internal.timbrasil.com.br
      - ip: ${IP_ADB}
        hostnames:
          - ${HOST_ADB_1}
          - ${HOST_ADB_2}
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: ${APP_NAME}
        image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
        ports:
        - containerPort: 8000
        env:
        - name: TIM_LLM_OCI_AUTH_FILE_LOCATION
          value: "/etc/oci/config"
        - name: TIM_RAG_OCI_AUTH_FILE_LOCATION
          value: "/etc/oci/config"
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: "/etc/google/credentials.json"

        envFrom:
        - secretRef:
            name: ${APP_NAME}-api-secrets
        - configMapRef:
            name: ${APP_NAME}-config
        - secretRef:
            name: ${APP_NAME}-api-secrets-extras

        volumeMounts:
        - name: oci-auth-volume
          mountPath: "/etc/oci"
          readOnly: true
        - name: google-sa-volume
          mountPath: "/etc/google"
          readOnly: true

        livenessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 30
          periodSeconds: 20
          timeoutSeconds: 5
          failureThreshold: 3

        readinessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 20
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 3

        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "1"

      volumes:
      - name: oci-auth-volume
        secret:
          secretName: ${APP_NAME}-oci-app-secret
      - name: google-sa-volume
        secret:
          secretName: ${APP_NAME}-google-sa-secret
---
apiVersion: v1
kind: Service
metadata:
  name: ${APP_NAME}-service
  namespace: ${K8S_NAMESPACE}
spec:
  type: NodePort
  selector:
    app: ${APP_NAME}
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8000
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8000
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP_NAME}-route-http
  namespace: ${K8S_NAMESPACE}
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio-gateway 
  hostnames:
    - ${DNS}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      timeouts:
        request: 1600s
      backendRefs:
        - name: ${APP_NAME}-service
          port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP_NAME}-route-https
  namespace: ${K8S_NAMESPACE} 
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio-gateway 
  hostnames:
    - ${DNS}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      timeouts:
        request: 1600s
      backendRefs:
        - name: ${APP_NAME}-service
          port: 443