# deployment.yaml — AIOps 应用 (embed 前端嵌入后端, 单容器单端口)
# ----------------------------------------------------------------------------
# - 镜像 lghost/aiops:<tag>（前端通过 go:embed 内嵌进同一二进制）
# - 单端口 8080 = API + WebSocket + 前端 SPA 静态资源
# - 配置优先级: 环境变量 > config.yaml > 默认值 (viper AutomaticEnv)
# - 环境变量命名: 配置键 database.host → DATABASE_HOST (全大写, 点变下划线)
# - Service: NodePort 30080 → 8080
#
# 部署: kubectl apply -f deployment.yaml
# ----------------------------------------------------------------------------
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aiops
  namespace: devops
  labels:
    app.kubernetes.io/name: aiops
    app.kubernetes.io/component: app
spec:
  # MODE=local 使用 SQLite，必须保持 1 副本（多副本数据不共享）// Logan.Li
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app.kubernetes.io/name: aiops
      app.kubernetes.io/component: app
  template:
    metadata:
      labels:
        app.kubernetes.io/name: aiops
        app.kubernetes.io/component: app
    spec:
      # 不使用 hostNetwork，避免 Pod 直接共享节点网络命名空间。 // Logan.Li
      dnsPolicy: ClusterFirst
      enableServiceLinks: false
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      # 首次部署时在 PVC 中预创建库文件，避免 subPath 挂载成目录 // Logan.Li
      initContainers:
        - name: init-local-db
          image: busybox:1.36
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
          command:
            - sh
            - -c
            - |
              if [ -f /vol/data/sqlite3.db ] && [ ! -f /vol/sqlite3.db ]; then
                cp /vol/data/sqlite3.db /vol/sqlite3.db
              fi
              if [ -f /vol/data/redka/redka.db ] && [ ! -f /vol/redka.db ]; then
                cp /vol/data/redka/redka.db /vol/redka.db
              fi
              [ -f /vol/sqlite3.db ] || install -m 660 /dev/null /vol/sqlite3.db
              [ -f /vol/redka.db ] || install -m 660 /dev/null /vol/redka.db
              chown 10001:10001 /vol/sqlite3.db /vol/redka.db
          volumeMounts:
            - name: data
              mountPath: /vol
      containers:
        - name: aiops
          image: lghost/aiops:v0.1.1
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
          # ── 运行时环境变量 (环境变量 > config.yaml > 默认值) ──
          # mode=local → SQLite + redka 本地存储，无需外部 MySQL/Redis // Logan.Li
          # 切换集群模式时改为 mode=release 并取消注释下方 DATABASE_/REDIS_ 变量
          env:
            - name: TZ
              value: Asia/Shanghai
            - name: MODE
              value: local
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: aiops-secret
                  key: jwt-secret
            # --- 集群模式（mode=release）时通过 Secret 引用数据库凭据。 // Logan.Li
            # - name: DATABASE_DRIVER
            #   value: "mysql"
            # - name: DATABASE_HOST
            #   value: "mysql"
            # - name: DATABASE_USER
            #   value: "aiops"
            # - name: DATABASE_PASSWORD
            #   valueFrom:
            #     secretKeyRef:
            #       name: aiops-secret
            #       key: mysql-password
            # - name: DATABASE_DBNAME
            #   value: "aiops"
            # - name: REDIS_DRIVER
            #   value: "redis"
            # - name: REDIS_HOST
            #   value: "redis"

          volumeMounts:
            - name: config
              mountPath: /app/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: uploads
              mountPath: /app/uploads
            # local 模式：sqlite3.db / redka.db 与 /app/aiops 同级持久化 // Logan.Li
            - name: data
              mountPath: /app/sqlite3.db
              subPath: sqlite3.db
            - name: data
              mountPath: /app/redka.db
              subPath: redka.db

          securityContext:
            runAsNonRoot: true
            runAsUser: 10001
            runAsGroup: 10001
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault

          readinessProbe:
            httpGet:
              path: /version
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /version
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 30
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
      volumes:
        - name: config
          configMap:
            name: aiops-config
        - name: uploads
          persistentVolumeClaim:
            claimName: aiops-uploads
        - name: data
          persistentVolumeClaim:
            claimName: aiops-data
---
apiVersion: v1
kind: Service
metadata:
  name: aiops
  namespace: devops
  labels:
    app.kubernetes.io/name: aiops
spec:
  type: NodePort
  selector:
    app.kubernetes.io/name: aiops
    app.kubernetes.io/component: app
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      nodePort: 30080
      protocol: TCP
---
# 限制集群内 MySQL/Redis 仅接受 AIOps Pod 连接。 // Logan.Li
# AIOps 需要接收集群外 Agent 的上报；在确定 Ingress 与 Agent 出口 CIDR 前，
# 不对应用 Pod 启用默认拒绝策略，以免阻断运维采集链路。 // Logan.Li
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mysql-ingress-from-aiops-only
  namespace: devops
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: mysql
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: aiops
      ports:
        - protocol: TCP
          port: 3306
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis-ingress-from-aiops-only
  namespace: devops
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: redis
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: aiops
      ports:
        - protocol: TCP
          port: 6379