apiVersion: apps/v1
kind: Deployment
metadata:
  name: cx-triage
  namespace: ${NAMESPACE}
  labels: { app: cx-triage }
spec:
  replicas: ${REPLICAS}
  strategy: { type: RollingUpdate }
  selector:
    matchLabels: { app: cx-triage }
  template:
    metadata:
      labels: { app: cx-triage }
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        fsGroup: 10001
      containers:
        - name: app
          image: ${IMAGE_REF}
          imagePullPolicy: IfNotPresent
          ports: [{ containerPort: 8080, name: http }]
          envFrom:
            - configMapRef: { name: cx-triage-config }
            - secretRef: { name: cx-triage }
          readinessProbe:
            httpGet: { path: /api/health, port: http }
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /api/health, port: http }
            # Startup warms a week of alert history, so allow a slow first start.
            initialDelaySeconds: 60
            periodSeconds: 30
          resources:
            requests: { cpu: 100m, memory: 256Mi }
            limits:   { cpu: "1",  memory: 1Gi }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
          volumeMounts:
            - { name: tmp,  mountPath: /tmp }
            - { name: data, mountPath: /data }
      volumes:
        - name: tmp
          emptyDir: {}
        - name: data
          emptyDir: {}   # state lives in Postgres; this is scratch only