apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "svcforge.fullname" . }}-api
  labels:
    {{- include "svcforge.labels" . | nindent 4 }}
    app.kubernetes.io/component: api
spec:
  replicas: {{ .Values.api.replicas }}
  selector:
    matchLabels:
      {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "api") | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "svcforge.labels" . | nindent 8 }}
        {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "api") | nindent 8 }}
    spec:
      serviceAccountName: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "api") }}
      {{- with .Values.image.pullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      # 60s: an in-flight POST must finish and the pool must close cleanly. The api holds
      # no lease, so this is generosity, not correctness — the worker's 60s is the one
      # that matters.
      terminationGracePeriodSeconds: 60
      securityContext:
        {{- include "svcforge.podSecurityContext" . | nindent 8 }}
      containers:
        - name: api
          image: {{ include "svcforge.image" (dict "ctx" $ "component" "api") }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "svcforge.containerSecurityContext" . | nindent 12 }}
          ports:
            - name: http
              containerPort: {{ .Values.api.service.targetPort }}
          envFrom:
            - secretRef:
                name: {{ include "svcforge.secretName" . }}
          env:
            {{- include "svcforge.env" . | nindent 12 }}
            - name: SVCFORGE_JWKS_URL
              value: {{ .Values.auth.jwksUrl | quote }}
            - name: SVCFORGE_JWT_ISSUER
              value: {{ .Values.auth.issuer | quote }}
            - name: SVCFORGE_JWT_AUDIENCE
              value: {{ .Values.auth.audience | quote }}
            - name: OTEL_SERVICE_NAME
              value: svcforge-api
          # readiness gates traffic, liveness restarts. They must not be the same probe:
          # /readyz checks the pool, and a pool that is briefly exhausted should stop
          # taking traffic, not get the pod killed.
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 20
            timeoutSeconds: 3
            failureThreshold: 3
          resources:
            {{- toYaml .Values.api.resources | nindent 12 }}
          volumeMounts:
            # readOnlyRootFilesystem: true, so anything that writes needs a mount.
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}