apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}-${REGION_ID}
  namespace: ${K8S_NAMESPACE}
  labels:
    app: ${APP_NAME}-regional
    tia-region: ${REGION_ID}
spec:
  replicas: ${REGION_REPLICAS}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app: ${APP_NAME}-regional
      tia-region: ${REGION_ID}
  template:
    metadata:
      labels:
        app: ${APP_NAME}-regional
        tia-region: ${REGION_ID}
    spec:
      terminationGracePeriodSeconds: ${TERMINATION_GRACE_SECONDS}
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: bridge
          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
          ports:
            - name: bridge-http
              containerPort: 8000
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /etc/google/credentials.json
            - name: PYTHONPATH
              value: /app/src
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
            - name: TIA_XAI_REGION
              value: ${REGION_ID}
          envFrom:
            - configMapRef:
                name: ${APP_NAME}-config
            - secretRef:
                name: ${APP_NAME}-api-secrets
          readinessProbe:
            httpGet: {path: /health, port: 8000}
            initialDelaySeconds: 15
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet: {path: /health, port: 8000}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests: {cpu: "${CPU_TIA_BRIDGE_REQ}", memory: "${MEM_TIA_BRIDGE_REQ}"}
            limits: {cpu: "${CPU_TIA_BRIDGE_LIM}", memory: "${MEM_TIA_BRIDGE_LIM}"}
          volumeMounts:
            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

        - name: agent
          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          args: ["app.agent_entry", "start", "--log-level", "info"]
          ports:
            - name: agent-http
              containerPort: 18081
          envFrom:
            - configMapRef:
                name: ${APP_NAME}-config
            - secretRef:
                name: ${APP_NAME}-api-secrets
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /etc/google/credentials.json
            - name: PYTHONPATH
              value: /app/src
            - name: AGENT_SERVER_PORT
              value: "18081"
            - name: NUM_IDLE_PROCESSES
              value: "1"
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
            - name: TIA_XAI_REGION
              value: ${REGION_ID}
            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
            - name: XAI_WEBSOCKET_URL
              value: ws://127.0.0.1:18100/xai/v1/tts
            - name: XAI_TTS_AUTH_METHOD
              value: API_KEY
            - name: XAI_API_KEY
              value: local-pool-proxy
          startupProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 24
          readinessProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests: {cpu: "${CPU_TIA_REQ}", memory: "${MEM_TIA_REQ}"}
            limits: {cpu: "${CPU_TIA_LIM}", memory: "${MEM_TIA_LIM}"}
          volumeMounts:
            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

        - name: xai-pool
          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          args: ["app.livekit.adapters.xai_pool_proxy"]
          ports:
            - name: xai-pool
              containerPort: 18100
          env:
            - name: PYTHONPATH
              value: /app/src
            - name: TIA_XAI_REGION
              value: ${REGION_ID}
            - name: XAI_POOL_UPSTREAM_URL
              value: ${XAI_UPSTREAM_URL}
            - name: XAI_POOL_SIZE
              value: "${XAI_POOL_SIZE}"
            - name: XAI_POOL_UNAVAILABLE_FREE
              value: "${XAI_POOL_UNAVAILABLE_FREE}"
            - name: XAI_POOL_RECOVER_FREE
              value: "${XAI_POOL_RECOVER_FREE}"
            - name: XAI_POOL_CONNECTION_TTL_S
              value: "${XAI_POOL_CONNECTION_TTL_S}"
            - name: XAI_POOL_REFRESH_JITTER_S
              value: "${XAI_POOL_REFRESH_JITTER_S}"
            - name: XAI_POOL_PREWARM_CONCURRENCY
              value: "${XAI_POOL_PREWARM_CONCURRENCY}"
            - name: XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S
              value: "${XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S}"
            - name: XAI_TTS_VOICE
              value: ${XAI_TTS_VOICE}
            - name: XAI_TTS_LANGUAGE
              value: ${XAI_TTS_LANGUAGE}
            - name: XAI_TTS_AUTH_METHOD
              value: ${XAI_UPSTREAM_AUTH_METHOD}
            - name: OCI_COMPARTMENT_ID
              valueFrom:
                secretKeyRef:
                  name: ${XAI_SECRET_NAME}
                  key: OCI_COMPARTMENT_ID
                  optional: true
            - name: XAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: ${XAI_SECRET_NAME}
                  key: XAI_API_KEY
                  optional: true
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
          readinessProbe:
            httpGet: {path: /readyz, port: 18100}
            initialDelaySeconds: 5
            periodSeconds: 2
            timeoutSeconds: 1
            failureThreshold: 2
            successThreshold: 1
          livenessProbe:
            httpGet: {path: /healthz, port: 18100}
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep ${DRAIN_SECONDS}"]
          resources:
            requests: {cpu: "${CPU_XAI_POOL_REQ}", memory: "${MEM_XAI_POOL_REQ}"}
            limits: {cpu: "${CPU_XAI_POOL_LIM}", memory: "${MEM_XAI_POOL_LIM}"}
          volumeMounts:
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

      volumes:
        - name: google-sa-volume
          secret:
            secretName: ${APP_NAME}-google-sa-secret
        - name: trusted-ca-volume
          secret:
            secretName: shared-tls-secret