# Prod。与 deployment-uat.yaml 逐字一致，只差 namespace 和 SPRING_PROFILES_ACTIVE
# ——两个环境跑的是同一个镜像，差异只在外部注入的配置上（见 09-build-deploy.md 附录）。
# 改动这份时请同步改另外两份，别让三份漂移。
apiVersion: apps/v1
kind: Deployment
metadata:
  name: conti-backend
  namespace: retailapp-prod
  labels:
    app: conti-backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: conti-backend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: conti-backend
    spec:
      serviceAccountName: conti-backend
      terminationGracePeriodSeconds: 45
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: conti-backend
          image: registry.example.com/conti-backend:__TAG__
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: prod
          envFrom:
            - configMapRef:
                name: conti-backend-env
            - secretRef:
                name: conti-backend-secret
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: "500m"
              memory: "1Gi"
            limits:
              memory: "2Gi"
          startupProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            periodSeconds: 5
            failureThreshold: 30
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["sh", "-c", "sleep 10"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: conti-backend
  namespace: retailapp-prod
  labels:
    app: conti-backend
spec:
  selector:
    app: conti-backend
  ports:
    - name: http
      port: 80
      targetPort: 8080