titan-iac/services/cassandra/backend-deployment.yaml

# services/cassandra/backend-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cassandra-backend
  namespace: cassandra
  labels:
    app: cassandra-backend
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app: cassandra-backend
  template:
    metadata:
      labels:
        app: cassandra-backend
      annotations:
        cassandra.bstein.dev/redeploy: "2026-08-04-0.8.150-lane-semantics"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "cassandra"
        vault.hashicorp.com/agent-inject-secret-cassandra-env.sh: "kv/data/atlas/cassandra/cassandra-db"
        vault.hashicorp.com/agent-inject-template-cassandra-env.sh: |
          {{- with secret "kv/data/atlas/cassandra/cassandra-db" }}
          unset DATABASE_URL
          export CASSANDRA_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
          export CASSANDRA_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
          export CASSANDRA_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
          export CASSANDRA_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
          export CASSANDRA_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
          export CASSANDRA_DATABASE_SSLMODE="disable"
          {{- end }}
          {{- with secret "kv/data/atlas/cassandra/cassandra-oidc" }}
          export CASSANDRA_OIDC_CLIENT_SECRET="{{ .Data.data.client_secret }}"
          {{- end }}
          {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
          export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
          export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
          {{- end }}
          {{- end }}
    spec:
      serviceAccountName: cassandra-backend
      priorityClassName: cassandra-core
      nodeSelector:
        cassandra.bstein.dev/node-pool: oceanus
        kubernetes.io/arch: amd64
      tolerations:
        - key: veles.bstein.dev/simulation
          operator: Equal
          value: "true"
          effect: NoSchedule
      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: database-init
          image: registry.bstein.dev/cassandra/cassandra-backend:0.9.2 # {"$imagepolicy": "cassandra:cassandra-backend"}
          imagePullPolicy: Always
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu
              if [ -f /vault/secrets/cassandra-env.sh ]; then
                . /vault/secrets/cassandra-env.sh
              fi
              exec cassandra-db --init --wait-seconds 120
          envFrom:
            - configMapRef:
                name: cassandra-config
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 512Mi
      containers:
        - name: backend
          image: registry.bstein.dev/cassandra/cassandra-backend:0.9.2 # {"$imagepolicy": "cassandra:cassandra-backend"}
          imagePullPolicy: Always
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu
              if [ -f /vault/secrets/cassandra-env.sh ]; then
                . /vault/secrets/cassandra-env.sh
              fi
              exec cassandra-web --host 0.0.0.0 --port 8796 --no-resume-queued
          ports:
            - name: http
              containerPort: 8796
              protocol: TCP
          env:
            - name: CASSANDRA_SIM_IMAGE
              value: registry.bstein.dev/cassandra/cassandra-sim-worker:0.9.0 # {"$imagepolicy": "cassandra:cassandra-sim-worker"}
            - name: CASSANDRA_GENERATOR_WORKER_IMAGE
              value: registry.bstein.dev/cassandra/cassandra-generator-worker:0.9.0 # {"$imagepolicy": "cassandra:cassandra-generator-worker"}
          envFrom:
            - configMapRef:
                name: cassandra-config
          readinessProbe:
            httpGet:
              path: /api/v1/ready
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /api/v1/live
              port: http
            initialDelaySeconds: 20
            periodSeconds: 20
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 250m
              memory: 2Gi
            limits:
              cpu: "1"
              memory: 8Gi
          securityContext:
            runAsNonRoot: true
            runAsUser: 10001
            runAsGroup: 10001
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: artifacts
              mountPath: /data/cassandra-artifacts
      volumes:
        - name: artifacts
          persistentVolumeClaim:
            claimName: cassandra-artifacts