# Deployment do serviço documents no hml2 (lab).
# Aplicar uma vez à mão: kubectl --context=hml2-corepetro apply -f k8s/hml/
# Depois disso o cd.yml só faz `kubectl set image` na imagem nova.
#
# Pré-requisitos no cluster (mesmos do routines, nenhum secret novo):
#   - secret `secret-token`                 → JWT compartilhado do core
#   - secret `sqluserhomolgeneric`          → usuário/senha do Cloud SQL
#   - secret `cloudsql-instance-credentials`→ credencial do cloudsql-proxy
#   - database `documents` criado na instância clubpetro-homologation
#   - bucket privado `corepetro_store_documents` (PDFs; URL assinada na leitura)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: documents-deployment
  labels:
    app: documents
spec:
  replicas: 1
  selector:
    matchLabels:
      app: documents
  template:
    metadata:
      labels:
        app: documents
    spec:
      containers:
        - name: documents
          image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/documents:lab-1
          imagePullPolicy: Always
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
            limits:
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 15
            periodSeconds: 15
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 45
            periodSeconds: 30
          env:
            - name: PORT
              value: '3000'
            - name: NODE_ENV
              value: homologation
            - name: ERROR_CODE
              value: DOC
            # SEM isto o JwtAuthGuard do authmodule libera TODA request
            # (`''.includes('')` === true). O boot falha se estiver vazio.
            - name: INTERNAL_PATH
              value: default.svc.cluster.local
            - name: TZ
              value: America/Sao_Paulo
            - name: DOCUMENTS_TIMEZONE
              value: America/Sao_Paulo
            - name: DOCUMENTS_BUCKET
              value: corepetro_store_documents
            - name: URL_HOMOLOGATION
              value: https://lab.clubpetro.com/api/v2/documents
            - name: SECRET_TOKEN
              valueFrom:
                secretKeyRef:
                  name: secret-token
                  key: secret
            - name: TYPEORM_CONNECTION
              value: postgres
            # 127.0.0.1 = sidecar cloudsql-proxy abaixo
            - name: TYPEORM_HOST
              value: 127.0.0.1
            - name: TYPEORM_PORT
              value: '5432'
            - name: TYPEORM_SLAVE
              value: 127.0.0.1
            - name: TYPEORM_SLAVE_PORT
              value: '5432'
            - name: TYPEORM_DATABASE
              value: documents
            - name: TYPEORM_USERNAME
              valueFrom:
                secretKeyRef:
                  name: sqluserhomolgeneric
                  key: username
            - name: TYPEORM_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sqluserhomolgeneric
                  key: passphrase
            - name: TYPEORM_SYNCHRONIZE
              value: 'false'
            - name: TYPEORM_MIGRATIONS_RUN
              value: 'true'
            - name: TYPEORM_LOGGING
              value: 'false'

        - name: cloudsql-proxy
          image: gcr.io/cloudsql-docker/gce-proxy:1.14
          resources:
            requests:
              cpu: 2m
              memory: 32Mi
          command:
            [
              '/cloud_sql_proxy',
              '-instances=corepetro:us-central1:clubpetro-homologation=tcp:5432',
              '-credential_file=/secrets/cloudsql/credentials.json',
            ]
          securityContext:
            runAsUser: 2
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: cloudsql-instance-credentials
              mountPath: /secrets/cloudsql
              readOnly: true

      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials