# 平台本体 —— 单副本 + Recreate(SQLite 单写者,滚动更新会双写互踩,参照 opsx-loki 同款约束)
# 镜像: 把 image 改为你的仓库地址,或用本仓库根目录 Dockerfile 自行构建推送
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opsxsql
  namespace: sql
  labels:
    app.kubernetes.io/name: opsxsql
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: opsxsql
  template:
    metadata:
      labels:
        app.kubernetes.io/name: opsxsql
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: opsxsql
          image: lghost/opsxsql:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 9000
          env:
            # 可选：默认账号（admin/dba/auditor/developer）初始密码。
            # 不设置则首次启动生成 16 位随机密码，写入 PVC 的 initial-admin-password.txt
            # 获取：kubectl -n sql exec deploy/opsxsql -- cat /app/data/initial-admin-password.txt
            # - name: ADMIN_INIT_PASSWORD
            #   valueFrom:
            #     secretKeyRef:
            #       name: opsxsql-secrets
            #       key: ADMIN_INIT_PASSWORD
            #       optional: true
            - name: PORT
              value: "9000"
            - name: DB_PATH
              value: /app/data/sqlite3.db
            - name: DEBUG
              value: "false"
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: opsxsql-secrets
                  key: SECRET_KEY
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: opsxsql-secrets
                  key: JWT_SECRET
          volumeMounts:
            - name: data
              mountPath: /app/data
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 20
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "2"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: opsxsql-data