# services/hermes/model-gate-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-model-gate
  namespace: hermes
  labels:
    app: hermes-model-gate
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: hermes-model-gate
  template:
    metadata:
      annotations:
        fluentbit.io/exclude: "true"
        ai.bstein.dev/config-rev: "20260928-lan-rtx3080-v4"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-run-as-user: "65532"
        vault.hashicorp.com/agent-run-as-group: "65532"
        vault.hashicorp.com/role: hermes-model-gate
        vault.hashicorp.com/agent-inject-secret-lan-api-token: kv/data/atlas/hermes/model-gate-lan-api
        vault.hashicorp.com/agent-inject-template-lan-api-token: |
          {{- with secret "kv/data/atlas/hermes/model-gate-lan-api" -}}
          {{ .Data.data.token }}
          {{- end -}}
        vault.hashicorp.com/agent-inject-perms-lan-api-token: "0400"
      labels:
        app: hermes-model-gate
    spec:
      serviceAccountName: hermes-model-gate
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - arm64
                  - key: node-role.kubernetes.io/worker
                    operator: In
                    values:
                      - "true"
                  - key: kubernetes.io/hostname
                    operator: NotIn
                    values:
                      - titan-04
                      - titan-13
                      - titan-15
                      - titan-17
                      - titan-19
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 90
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values:
                      - rpi5
      containers:
        - name: model-gate
          image: python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df
          imagePullPolicy: IfNotPresent
          command:
            - python
            - /opt/model-gate/model_gate.py
          ports:
            - name: http
              containerPort: 8080
            - name: handoff
              containerPort: 8081
            - name: lan-api
              containerPort: 8082
          env:
            - name: PYTHONPATH
              value: /opt/batch
            - name: UPSTREAM_URL
              value: http://ollama.ai.svc.cluster.local:11434
            - name: LOCAL_IMAGE_URL
              value: http://hermes-local-image.hermes.svc.cluster.local:9004
            - name: HANDOFF_TIMEOUT_SEC
              value: "1200"
            - name: IMAGE_NAMESPACE
              value: hermes
            - name: IMAGE_DEPLOYMENT
              value: hermes-local-image
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65532
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
          volumeMounts:
            - name: batch-script
              mountPath: /opt/batch
              readOnly: true
            - name: script
              mountPath: /opt/model-gate
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: batch-script
          configMap:
            name: hermes-batch-api
        - name: script
          configMap:
            name: hermes-model-gate
            defaultMode: 0555
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-model-gate
  namespace: hermes
  labels:
    app: hermes-model-gate
spec:
  type: ClusterIP
  selector:
    app: hermes-model-gate
  ports:
    - name: http
      port: 11434
      targetPort: http
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-model-gate-lan-api
  namespace: hermes
  annotations:
    traefik.ingress.kubernetes.io/service.serverstransport: hermes-hermes-model-gate-lan@kubernetescrd
  labels:
    app: hermes-model-gate
spec:
  type: ClusterIP
  selector:
    app: hermes-model-gate
  ports:
    - name: http
      port: 8082
      targetPort: lan-api
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-gpu-handoff
  namespace: hermes
  labels:
    app: hermes-model-gate
spec:
  type: ClusterIP
  selector:
    app: hermes-model-gate
  ports:
    - name: http
      port: 11434
      targetPort: handoff