# Dev：跑在公司内网一台 Ubuntu 服务器的 k3s 上，不接 CI/CD，由 scripts/deploy-dev.sh 手动 apply
# （见 09-build-deploy.md「环境层级」）。
#
# 跟 UAT/Prod 的两处有意差别：
#   1. replicas: 1 —— 单节点 k3s，起两个副本没有可用性收益，只是多占内存；
#      代价是滚动更新期间会有短暂不可用，Dev 环境可以接受，所以也不配 PDB。
#   2. requests 调小 —— 这台机器上还跑着别的东西。
# 其余（探针、优雅停机、securityContext）与另外两份保持一致，
# 这正是 Dev 用真 K8s 而不是 docker compose 的意义：验证的是真实部署行为。
apiVersion: apps/v1
kind: Deployment
metadata:
  name: conti-backend
  namespace: retailapp-dev
  labels:
    app: conti-backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: conti-backend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: conti-backend
    spec:
      serviceAccountName: conti-backend
      terminationGracePeriodSeconds: 45
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: conti-backend
          image: registry.example.com/conti-backend:__TAG__
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: dev
          envFrom:
            - configMapRef:
                name: conti-backend-env
            # Dev 的 Secret 是写死的假值，由 scripts/deploy-dev.sh 创建，不接 Key Vault
            - secretRef:
                name: conti-backend-secret
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: "250m"
              memory: "768Mi"
            limits:
              memory: "1536Mi"
          startupProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            periodSeconds: 5
            failureThreshold: 30
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["sh", "-c", "sleep 10"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: conti-backend
  namespace: retailapp-dev
  labels:
    app: conti-backend
spec:
  selector:
    app: conti-backend
  ports:
    - name: http
      port: 80
      targetPort: 8080