# Production baseline: stateless public API on Kubernetes 1.36+ / Linux.
#
# Assumptions:
# - the image is built to run as UID/GID 10001
# - nodes/runtime support Pod user namespaces and the SupplementalGroupsPolicy CRI field
# - the node fleet supports the RuntimeDefault AppArmor profile
# - exactly three failure zones are required for full capacity
# - NetworkPolicy is defined separately from the real dependency graph
#
# Digest pinning prevents tag drift. Image signature/provenance verification
# belongs in admission policy and is intentionally not faked in this manifest.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api
automountServiceAccountToken: false

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  revisionHistoryLimit: 3
  minReadySeconds: 10
  progressDeadlineSeconds: 300

  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1

  selector:
    matchLabels:
      app: api

  template:
    metadata:
      labels:
        app: api

    spec:
      serviceAccountName: api

      # Defense in depth: this workload has no Kubernetes API dependency.
      automountServiceAccountToken: false
      enableServiceLinks: false

      # Separate host user namespace reduces host impact if the container
      # runtime or application is compromised.
      hostUsers: false

      # Explicit process identity. UID/GID must match the image build.
      # No fsGroup: this workload mounts no writable persistent volumes.
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        supplementalGroupsPolicy: Strict

        seccompProfile:
          type: RuntimeDefault

        appArmorProfile:
          type: RuntimeDefault

      # preStop consumes part of this budget. The application receives
      # SIGTERM afterwards and gets the remaining time to shut down cleanly.
      terminationGracePeriodSeconds: 30

      # One replica per zone. With fewer than three eligible zones the
      # scheduler fails closed rather than concentrating replicas.
      topologySpreadConstraints:
        - maxSkew: 1
          minDomains: 3
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: api

      containers:
        - name: api

          # Immutable production artifact.
          image: registry.example.com/api@sha256:7d3ce5b2d6480ffa1b3c9d24e7a6510c8b3daf12e34c56b78d90a1b2c3d491af
          imagePullPolicy: IfNotPresent

          ports:
            - name: http
              containerPort: 8080
              protocol: TCP

          securityContext:
            privileged: false
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            procMount: Default

            capabilities:
              drop:
                - ALL

          # Measured propagation budget for endpoint/LB removal.
          # Kubelet-native sleep also works with distroless images.
          lifecycle:
            preStop:
              sleep:
                seconds: 5

          # Startup prevents liveness from killing a legitimately slow boot.
          startupProbe:
            httpGet:
              path: /health/startup
              port: http
            periodSeconds: 2
            timeoutSeconds: 2
            failureThreshold: 30

          # Readiness controls traffic eligibility.
          readinessProbe:
            httpGet:
              path: /health/ready
              port: http
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 2

          # Liveness must detect process failure/deadlock only.
          # It must not depend on downstream services.
          livenessProbe:
            httpGet:
              path: /health/live
              port: http
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3

          # No CPU limit intentionally: avoid CFS throttling on a
          # latency-sensitive API. Memory cannot throttle, so it is bounded.
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              memory: 512Mi

---
# Deployment rollout policy does not protect against voluntary disruptions
# such as node drains. Keep at most one healthy replica unavailable while
# allowing broken pods to be evicted so they cannot deadlock maintenance.

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api
spec:
  maxUnavailable: 1
  unhealthyPodEvictionPolicy: AlwaysAllow

  selector:
    matchLabels:
      app: api