apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "svcforge.fullname" . }}-reconciler
  labels:
    {{- include "svcforge.labels" . | nindent 4 }}
    app.kubernetes.io/component: reconciler
spec:
  # A singleton. Hardcoded, not a value: two reconcilers would double-enqueue drift tasks
  # and race on TTL expiry, and there is no knob that makes that acceptable. If you want
  # this to be tunable, you want a lease first — and the lease belongs in Postgres, not in
  # a Redis lock (a GC pause plus a Redis lock still gives you two reconcilers).
  replicas: 1
  strategy:
    # Recreate, not RollingUpdate. RollingUpdate would briefly run the old and new pod at
    # once, which is exactly the thing replicas: 1 exists to prevent.
    type: Recreate
  selector:
    matchLabels:
      {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "reconciler") | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "svcforge.labels" . | nindent 8 }}
        {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "reconciler") | nindent 8 }}
    spec:
      serviceAccountName: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "reconciler") }}
      {{- with .Values.image.pullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      terminationGracePeriodSeconds: 60
      securityContext:
        {{- include "svcforge.podSecurityContext" . | nindent 8 }}
      containers:
        - name: reconciler
          image: {{ include "svcforge.image" (dict "ctx" $ "component" "reconciler") }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "svcforge.containerSecurityContext" . | nindent 12 }}
          ports:
            - name: metrics
              containerPort: 9000
          envFrom:
            - secretRef:
                name: {{ include "svcforge.secretName" . }}
          env:
            {{- include "svcforge.env" . | nindent 12 }}
            - name: SVCFORGE_RECONCILE_INTERVAL_S
              value: {{ .Values.reconciler.intervalSeconds | quote }}
            - name: OTEL_SERVICE_NAME
              value: svcforge-reconciler
          # The reconciler's health is not "is the process up", it is "did it tick".
          # That question is answered by SvcforgeReconcilerStale off
          # svcforge_reconciler_last_tick_timestamp_seconds, not by a probe — a probe here
          # would restart the pod and reset the very gauge the alert reads.
          resources:
            {{- toYaml .Values.reconciler.resources | nindent 12 }}
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: helm-home
              mountPath: /tmp/helm
      volumes:
        - name: tmp
          emptyDir: {}
        - name: helm-home
          emptyDir: {}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}