---
# AegisLM API Kubernetes Deployment
# Multi-Agent Adversarial LLM Evaluation Framework

apiVersion: apps/v1
kind: Deployment
metadata:
  name: aegislm-api
  namespace: aegislm
  labels:
    app: aegislm
    component: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: aegislm
      component: api
  template:
    metadata:
      labels:
        app: aegislm
        component: api
    spec:
      serviceAccountName: aegislm
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: api
          image: aegislm/api:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
              name: http
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            runAsUser: 1000
          env:
            - name: PYTHONUNBUFFERED
              value: "1"
            - name: API_HOST
              value: "0.0.0.0"
            - name: API_PORT
              value: "8000"
          envFrom:
            - configMapRef:
                name: aegislm-config
            - secretRef:
                name: aegislm-secrets
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: 1000m
              memory: 2Gi
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          livenessProbe:
            httpGet:
              path: /health/live
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8000
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
      volumes:
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 64Mi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: component
                      operator: In
                      values:
                        - api
                topologyKey: kubernetes.io/hostname