apiVersion: apps/v1
kind: Deployment
metadata:
  name: control-plane
  namespace: cosmic-clash
  labels:
    app.kubernetes.io/name: control-plane
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: control-plane
  template:
    metadata:
      labels:
        app.kubernetes.io/name: control-plane
    spec:
      terminationGracePeriodSeconds: 10
      serviceAccountName: control-plane
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: control-plane
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                topologyKey: kubernetes.io/hostname
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: control-plane
      containers:
        - name: control-plane
          image: ghcr.io/cosmic-clash/control-plane@sha256:0000000000000000000000000000000000000000000000000000000000000000
          args:
            - --rate-limit=120
            - --rate-limit-window=1m
            - --rate-limit-max-keys=10000
            # Ingress NetworkPolicy admits only the labelled edge gateway.
            # Cover common private/CGNAT/ULA pod networks; overlays should
            # narrow this to their actual gateway CIDR where available.
            - --trusted-proxy-cidrs=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16,fc00::/7
          ports:
            - name: http
              containerPort: 8080
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            periodSeconds: 5
            timeoutSeconds: 2
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 1
              memory: 512Mi
          env:
            - name: COSMIC_CLASH_POSTGRES_DSN
              valueFrom:
                secretKeyRef:
                  name: cosmic-clash-database
                  key: dsn
            - name: COSMIC_CLASH_WORKLOAD_SECRET
              valueFrom:
                secretKeyRef:
                  name: cosmic-clash-workload
                  key: secret
            # Player sign-in. The publisher key is the credential Valve issues
            # to us, never to a client, so it is mounted only here -- no other
            # workload and no game server ever sees it. Both values must be
            # present or POST /v1/session/steam keeps returning 503: silently
            # accepting an unverified ticket would be worse than refusing to
            # authenticate. Optional until the App ID exists (issue #15), so the
            # Deployment still rolls out without the Secret.
            - name: COSMIC_CLASH_STEAM_PUBLISHER_KEY
              valueFrom:
                secretKeyRef:
                  name: cosmic-clash-steam
                  key: publisher-key
                  optional: true
            - name: COSMIC_CLASH_STEAM_APP_ID
              valueFrom:
                secretKeyRef:
                  name: cosmic-clash-steam
                  key: app-id
                  optional: true