# services/cassandra/frontend-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cassandra-frontend
  namespace: cassandra
  labels:
    app: cassandra-frontend
spec:
  replicas: 2
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: cassandra-frontend
  template:
    metadata:
      labels:
        app: cassandra-frontend
    spec:
      serviceAccountName: cassandra-frontend
      priorityClassName: cassandra-core
      automountServiceAccountToken: false
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/worker
                    operator: Exists
                  - key: hardware
                    operator: In
                    values: ["rpi5", "rpi4", "amd64"]
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                  - key: atlas.bstein.dev/spillover
                    operator: DoesNotExist
            - weight: 90
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: ["rpi5"]
      securityContext:
        fsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: frontend
          image: registry.bstein.dev/cassandra/cassandra-frontend:0.8.79 # {"$imagepolicy": "cassandra:cassandra-frontend"}
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 20
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]