# =============================================================================
# AI Software Factory — API (NestJS) Deployment + Service + HPA
#
# 2 replicas by default, autoscaled 2..10 on CPU.
# The image tag is patched by kustomization.yaml (TAG variable).
# =============================================================================
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/component: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: api
      annotations:
        # Re-roll pods when the configmap changes (see kustomization patch).
        checksum/config: "factory-config"
    spec:
      # If the registry requires auth, set an imagePullSecret here:
      # imagePullSecrets:
      #   - name: ghcr-pull
      containers:
        - name: api
          # Tag is substituted by kustomize (TAG variable).
          image: ghcr.io/ai-software-factory/api:TAG
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 4000
              name: http
          envFrom:
            - configMapRef:
                name: factory-config
            - secretRef:
                name: factory-secrets
          env:
            - name: PORT
              value: "4000"
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: 1000m
              memory: 1Gi
          livenessProbe:
            httpGet:
              path: /api/v1/health
              port: 4000
            initialDelaySeconds: 30
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /api/v1/health/ready
              port: 4000
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            # The image must include a non-root user; runAsUser below is a
            # safe default for the official node base images (node = 1000).
            runAsUser: 1000
            runAsGroup: 1000
            seccompProfile:
              type: RuntimeDefault
      terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
  name: api
  labels:
    app.kubernetes.io/name: api
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: api
  ports:
    - name: http
      port: 4000
      targetPort: 4000
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 2
  maxReplicas: 10
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
        - type: Pods
          value: 2
          periodSeconds: 60
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Pods
          value: 1
          periodSeconds: 120
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70