---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mirador-agent
  namespace: libre-wuji
  labels:
    app: mirador-agent
    component: mirador
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mirador-agent
  # Recreate avoids two agents sampling the cluster simultaneously during rollout.
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: mirador-agent
        component: mirador
    spec:
      serviceAccountName: mirador-agent
      automountServiceAccountToken: true

      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534

      containers:
        - name: agent
          image: ghcr.io/libre/mirador/mirador-agent:latest
          imagePullPolicy: Always

          env:
            - name: AGENT_MONITORING_NCL
              value: /etc/mirador/monitoring.json
            - name: AGENT_WORKSPACE_ID
              value: libre-wuji
            - name: AGENT_INTERVAL_SECS
              value: "30"
            # AGENT_NATS_URL — set this to route samples to the daemon.
            # - name: AGENT_NATS_URL
            #   value: nats://nats.libre-wuji.svc.cluster.local:4222
            - name: RUST_LOG
              value: info

          volumeMounts:
            - name: monitoring-config
              mountPath: /etc/mirador
              readOnly: true

          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi

          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]

          livenessProbe:
            exec:
              # The agent process exits on unrecoverable error; if it's running
              # the pid 1 is alive — no HTTP port needed.
              command: ["pgrep", "-x", "mirador-agent"]
            initialDelaySeconds: 10
            periodSeconds: 30
            failureThreshold: 3

      volumes:
        - name: monitoring-config
          configMap:
            name: mirador-agent-config

      restartPolicy: Always