apiVersion: apps/v1
kind: Deployment
metadata:
  name: tim-ai-atend-agnt-integ-tia-iad
  namespace: agnt-ai-atendimento
  labels:
    app: tim-ai-atend-agnt-integ-tia-regional
    tia-region: iad
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app: tim-ai-atend-agnt-integ-tia-regional
      tia-region: iad
  template:
    metadata:
      labels:
        app: tim-ai-atend-agnt-integ-tia-regional
        tia-region: iad
    spec:
      terminationGracePeriodSeconds: 600
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: bridge
          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
          imagePullPolicy: IfNotPresent
          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
          ports:
            - name: bridge-http
              containerPort: 8000
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /etc/google/credentials.json
            - name: PYTHONPATH
              value: /app/src
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
            - name: TIA_XAI_REGION
              value: iad
          envFrom:
            - configMapRef:
                name: tim-ai-atend-agnt-integ-tia-config
            - secretRef:
                name: tim-ai-atend-agnt-integ-tia-api-secrets
          readinessProbe:
            httpGet: {path: /health, port: 8000}
            initialDelaySeconds: 15
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet: {path: /health, port: 8000}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests: {cpu: "250m", memory: "512Mi"}
            limits: {cpu: "1000m", memory: "1Gi"}
          volumeMounts:
            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

        - name: agent
          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
          imagePullPolicy: IfNotPresent
          args: ["app.agent_entry", "start", "--log-level", "info"]
          ports:
            - name: agent-http
              containerPort: 18081
          envFrom:
            - configMapRef:
                name: tim-ai-atend-agnt-integ-tia-config
            - secretRef:
                name: tim-ai-atend-agnt-integ-tia-api-secrets
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /etc/google/credentials.json
            - name: PYTHONPATH
              value: /app/src
            - name: AGENT_SERVER_PORT
              value: "18081"
            - name: NUM_IDLE_PROCESSES
              value: "1"
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
            - name: TIA_XAI_REGION
              value: iad
            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
            - name: XAI_WEBSOCKET_URL
              value: ws://127.0.0.1:18100/xai/v1/tts
            - name: XAI_TTS_AUTH_METHOD
              value: API_KEY
            - name: XAI_API_KEY
              value: local-pool-proxy
          startupProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 24
          readinessProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet: {path: /, port: 18081}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests: {cpu: "500m", memory: "1Gi"}
            limits: {cpu: "2000m", memory: "2Gi"}
          volumeMounts:
            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

        - name: xai-pool
          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
          imagePullPolicy: IfNotPresent
          args: ["app.livekit.adapters.xai_pool_proxy"]
          ports:
            - name: xai-pool
              containerPort: 18100
          env:
            - name: PYTHONPATH
              value: /app/src
            - name: TIA_XAI_REGION
              value: iad
            - name: XAI_POOL_UPSTREAM_URL
              value: wss://peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com/xai/v1/tts
            - name: XAI_POOL_SIZE
              value: "50"
            - name: XAI_POOL_UNAVAILABLE_FREE
              value: "2"
            - name: XAI_POOL_RECOVER_FREE
              value: "5"
            - name: XAI_POOL_CONNECTION_TTL_S
              value: "540"
            - name: XAI_POOL_REFRESH_JITTER_S
              value: "45"
            - name: XAI_POOL_PREWARM_CONCURRENCY
              value: "5"
            - name: XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S
              value: "1.0"
            - name: XAI_TTS_VOICE
              value: c8x2ieiocufs
            - name: XAI_TTS_LANGUAGE
              value: pt-BR
            - name: XAI_TTS_AUTH_METHOD
              value: API_KEY
            - name: OCI_COMPARTMENT_ID
              valueFrom:
                secretKeyRef:
                  name: xai-iad-credentials
                  key: OCI_COMPARTMENT_ID
                  optional: true
            - name: XAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: xai-iad-credentials
                  key: XAI_API_KEY
                  optional: true
            - name: REQUESTS_CA_BUNDLE
              value: /etc/ssl/custom/tls.crt
            - name: SSL_CERT_FILE
              value: /etc/ssl/custom/tls.crt
          readinessProbe:
            httpGet: {path: /readyz, port: 18100}
            initialDelaySeconds: 5
            periodSeconds: 2
            timeoutSeconds: 1
            failureThreshold: 2
            successThreshold: 1
          livenessProbe:
            httpGet: {path: /healthz, port: 18100}
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep 30"]
          resources:
            requests: {cpu: "200m", memory: "256Mi"}
            limits: {cpu: "1000m", memory: "768Mi"}
          volumeMounts:
            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}

      volumes:
        - name: google-sa-volume
          secret:
            secretName: tim-ai-atend-agnt-integ-tia-google-sa-secret
        - name: trusted-ca-volume
          secret:
            secretName: shared-tls-secret