apiVersion: apps/v1
kind: Deployment
metadata:
  name: vanna-clubpetro-deployment
  labels:
    app: vanna-clubpetro
spec:
  replicas: 1   # ChromaDB SQLite-based — múltiplas réplicas corrompem o vector store
  strategy:
    type: Recreate   # com PVC ReadWriteOnce não dá pra ter 2 pods montando ao mesmo tempo
  selector:
    matchLabels:
      app: vanna-clubpetro
  template:
    metadata:
      labels:
        app: vanna-clubpetro
    spec:
      # Gate E: pod roda como non-root. fsGroup dá posse dos volumes (PVC) ao
      # grupo 10001 pra que o processo non-root consiga escrever no store/cache.
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
      containers:
        - name: vanna-clubpetro
          # A tag é sobrescrita pelo pipeline (kubectl set image). Placeholder:
          image: us-central1-docker.pkg.dev/corepetro/clubpetro/vanna-clubpetro:hml-latest
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          ports:
            - name: http
              containerPort: 8765
          env:
            - name: HOME
              value: /home/app
            - name: VANNA_CORS_ORIGINS
              value: "https://homologation.clubpetro.com"
          envFrom:
            # Gate G: credenciais do ClickHouse num secret DEDICADO ao serviço.
            - secretRef:
                name: vanna-clubpetro-db
            # Config de app (OpenAI, RLS defaults etc.) em secret separado.
            - secretRef:
                name: vanna-clubpetro-secret
          resources:
            requests:
              cpu: "200m"
              memory: "1Gi"
            limits:
              cpu: "1"
              memory: "2Gi"
          readinessProbe:
            httpGet:
              path: /health
              port: 8765
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /health
              port: 8765
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /app/chroma_db
              subPath: chroma_db
            - name: data
              mountPath: /app/data_storage
              subPath: data_storage
            - name: data
              mountPath: /home/app/.cache/chroma
              subPath: chroma-onnx-cache
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: vanna-clubpetro-data