apiVersion: apps/v1
kind: Deployment
metadata: { name: api }
spec:
  replicas: 2
  selector: { matchLabels: { app: api } }
  template:
    metadata: { labels: { app: api } }
    spec:
      serviceAccountName: rarelens-api
      initContainers:
        # alembic/env.py holds a Postgres advisory lock, so replicas starting together migrate once.
        - name: migrate
          image: rarelens/api
          command: [alembic, upgrade, head]
          envFrom: [{ secretRef: { name: api-secrets } }]
          resources: { requests: { cpu: 100m, memory: 256Mi }, limits: { cpu: 500m, memory: 512Mi } }
      containers:
        - name: api
          image: rarelens/api
          ports: [{ containerPort: 8000 }]
          envFrom:
            - secretRef: { name: api-secrets }
            - configMapRef: { name: api-config }
          readinessProbe: { httpGet: { path: /health, port: 8000 }, periodSeconds: 5 }
          livenessProbe: { httpGet: { path: /health, port: 8000 }, periodSeconds: 10, failureThreshold: 6 }
          resources: { requests: { cpu: 250m, memory: 512Mi }, limits: { cpu: "1", memory: 1Gi } }
          securityContext: { allowPrivilegeEscalation: false }
---
apiVersion: v1
kind: Service
metadata: { name: api }
spec: { selector: { app: api }, ports: [{ port: 80, targetPort: 8000 }] }
---
apiVersion: v1
kind: ServiceAccount
metadata: { name: rarelens-api }