# opsx-loki 平台本体
#
# 关键约束：
#   1) replicas 必须为 1：JSON DB 为单写者，多副本会互相覆盖。
#   2) strategy 必须为 Recreate：RollingUpdate 期间会同时存在两个 Pod 挂同一个
#      RWO PVC，两个进程同时写 opsxloki.json 会导致数据丢失。
#   3) /app/data 必须挂 PVC，否则重启后 DB / kubeconfig / known_hosts 全丢。
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opsx-loki
  namespace: log
  labels:
    app: opsx-loki
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: opsx-loki
  template:
    metadata:
      labels:
        app: opsx-loki
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: opsx-loki
          image: lghost/opsxloki:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: DATA_DIR
              value: /app/data
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: opsxloki-secrets
                  key: JWT_SECRET
            - name: ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: opsxloki-secrets
                  key: ENCRYPTION_KEY
            # 可选：挂载本地集群 kubeconfig 时启用
            # - name: KUBECONFIG
            #   value: /home/opsxloki/.kube/config
          volumeMounts:
            - name: data
              mountPath: /app/data
            # 可选：本地集群 kubeconfig（in-cluster 管理本集群时用）
            # - name: kubeconfig
            #   mountPath: /home/opsxloki/.kube
            #   readOnly: true
          readinessProbe:
            httpGet:
              path: /api/v1/health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /api/v1/health
              port: http
            initialDelaySeconds: 30
            periodSeconds: 20
            failureThreshold: 5
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: opsxloki-data
        # - name: kubeconfig
        #   secret:
        #     secretName: opsxloki-kubeconfig