apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}-app
  namespace: ${K8S_NAMESPACE}
spec:
  replicas: ${TIA_REPLICAS}
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: ${APP_NAME}-app
  template:
    metadata:
      labels:
        app: ${APP_NAME}-app
    spec:
      hostAliases:
      - ip: "10.151.225.135"
        hostnames:
        - "speech-agent-ai-atendi-fqa-01.cognitiveservices.azure.com"
      - ip: 10.153.35.23
        hostnames:
        - tim-ai-atend-agnt-opentelemetry
      - ip: 10.154.0.154
        hostnames:
        - peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com
      - ip: 10.154.16.244
        hostnames:
        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
      - ip: ${REDIS_IP}
        hostnames:
        - ${REDIS_HOST}
      - ip: 10.154.16.244
        hostnames:
        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: ${APP_NAME}-app-bridge
          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          args:
            - app.bridge_entry
            - --host
            - 0.0.0.0
            - --port
            - "8000"
            - --log-level
            - info
          ports:
            - name: http
              containerPort: 8000
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: "/etc/google/credentials.json"
            - name: PYTHONPATH
              value: /app/src
            - name: REQUESTS_CA_BUNDLE
              value: "/etc/ssl/custom/tls.crt"
            - name: SSL_CERT_FILE
              value: "/etc/ssl/custom/tls.crt"
          envFrom:
            - configMapRef:
                name: ${APP_NAME}-config
            - secretRef:
                name: ${APP_NAME}-api-secrets
          volumeMounts:
            - name: google-sa-volume
              mountPath: /etc/google
              readOnly: true
            - name: trusted-ca-volume
              mountPath: "/etc/ssl/custom"
              readOnly: true
          readinessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: "${CPU_TIA_BRIDGE_REQ}"
              memory: "${MEM_TIA_BRIDGE_REQ}"
            limits:
              cpu: "${CPU_TIA_BRIDGE_LIM}"
              memory: "${MEM_TIA_BRIDGE_LIM}"

        - name: ${APP_NAME}-app-agent
          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          args:
            - app.agent_entry
            - start
            - --log-level
            - info
          ports:
            - name: agent-http
              containerPort: 18081
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: "/etc/google/credentials.json"
            - name: PYTHONPATH
              value: /app/src
            - name: AGENT_SERVER_PORT
              value: "18081"
            - name: NUM_IDLE_PROCESSES
              value: "1"
            - name: REQUESTS_CA_BUNDLE
              value: "/etc/ssl/custom/tls.crt"
            - name: SSL_CERT_FILE
              value: "/etc/ssl/custom/tls.crt"
          envFrom:
            - configMapRef:
                name: ${APP_NAME}-config
            - secretRef:
                name: ${APP_NAME}-api-secrets
          volumeMounts:
            - name: google-sa-volume
              mountPath: /etc/google
              readOnly: true
            - name: trusted-ca-volume
              mountPath: "/etc/ssl/custom"
              readOnly: true
          startupProbe:
            httpGet:
              path: /
              port: 18081
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 24
          readinessProbe:
            httpGet:
              path: /
              port: 18081
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /
              port: 18081
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: "${CPU_TIA_REQ}"
              memory: "${MEM_TIA_REQ}"
            limits:
              cpu: "${CPU_TIA_LIM}"
              memory: "${MEM_TIA_LIM}"
      volumes:
        - name: google-sa-volume
          secret:
            secretName: ${APP_NAME}-google-sa-secret
        - name: trusted-ca-volume
          secret:
            secretName: shared-tls-secret
---
apiVersion: v1
kind: Service
metadata:
  name: ${APP_NAME}-app
  namespace: ${K8S_NAMESPACE}
  labels:
    app: ${APP_NAME}-app
spec:
  type: NodePort
  selector:
    app: ${APP_NAME}-app
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8000
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8000
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP_NAME}-route
  namespace: ${K8S_NAMESPACE}
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio-gateway 
  hostnames:
    - ${APP_NAME}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      timeouts:
        request: 1600s
      backendRefs:
        - name: ${APP_NAME}-app
          port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP_NAME}-route-http
  namespace: ${K8S_NAMESPACE}
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio-gateway 
  hostnames:
    - ${DNS}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      timeouts:
        request: 1600s
      backendRefs:
        - name: ${APP_NAME}-app
          port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP_NAME}-route-https
  namespace: ${K8S_NAMESPACE}
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio-gateway 
  hostnames:
    - ${DNS}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      timeouts:
        request: 1600s
      backendRefs:
        - name: ${APP_NAME}-app
          port: 443