# LMR gateway on k3s. Config and secrets live in the cluster:
#   configmap/lmr-config  GATEWAY_* settings
#   secret/lmr-secret     GATEWAY_DB_URL, GATEWAY_OIDC_CLIENT_SECRET, GATEWAY_SECURITY_ENCRYPTION_KEY
#   secret/regcred2       registry pull credentials
# Apply with: kubectl apply -f deploy/k8s/lmr.yaml
# Roll a new image with: kubectl rollout restart deployment/localmodelroutex
apiVersion: apps/v1
kind: Deployment
metadata:
  name: localmodelroutex
  namespace: default
  labels:
    app: localmodelroutex
spec:
  replicas: 3
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      app: localmodelroutex
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
  template:
    metadata:
      labels:
        app: localmodelroutex
    spec:
      imagePullSecrets:
        - name: regcred2
      terminationGracePeriodSeconds: 30
      containers:
        - name: localmodelroutex
          image: registry.govekar.net/lovrog05/localmodelroutex:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
          envFrom:
            - configMapRef:
                name: lmr-config
            - secretRef:
                name: lmr-secret
          # Startup covers OIDC discovery and the first database connection.
          # Up to 2 minutes before the liveness probe takes over.
          startupProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 24
          # /healthz only checks that the process answers. A database or
          # network blip must not restart the pod, so this never touches the DB.
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          # /readyz pings the database with a 3 second internal timeout. The
          # pod leaves the Service while the database is unreachable and
          # returns when it recovers, without a restart.
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
            successThreshold: 1
---
apiVersion: v1
kind: Service
metadata:
  name: lmr
  namespace: default
  labels:
    app: localmodelroutex
spec:
  type: LoadBalancer
  selector:
    app: localmodelroutex
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP