deployment.yaml

{{- include "hyperfleet-api.validateValues" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "hyperfleet-api.fullname" . }}
  labels:
    {{- include "hyperfleet-api.labels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  {{- with .Values.strategy }}
  strategy:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "hyperfleet-api.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        # Force pod restart when ConfigMap changes
        {{- if .Values.config.existingConfigMap }}
        # Checksum of external ConfigMap (via lookup)
        checksum/config: {{ (lookup "v1" "ConfigMap" .Release.Namespace .Values.config.existingConfigMap).data | toYaml | sha256sum }}
        {{- else }}
        # Checksum of generated ConfigMap
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        {{- end }}
        {{- if .Values.validationSchema.enabled }}
        {{- if .Values.validationSchema.existingConfigMap }}
        checksum/validation-schema: {{ (lookup "v1" "ConfigMap" .Release.Namespace .Values.validationSchema.existingConfigMap).data | toYaml | sha256sum }}
        {{- else }}
        checksum/validation-schema: {{ include (print $.Template.BasePath "/validation-schema-configmap.yaml") . | sha256sum }}
        {{- end }}
        {{- end }}
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "hyperfleet-api.selectorLabels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "hyperfleet-api.serviceAccountName" . }}
      {{- if .Values.terminationGracePeriodSeconds }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      {{- if and .Values.nativeSidecars (not (semverCompare ">=1.28.0-0" .Capabilities.KubeVersion.Version)) }}
        {{- fail "nativeSidecars requires Kubernetes >= 1.28 (SidecarContainers feature gate). Remove nativeSidecars or upgrade your cluster." }}
      {{- end }}
      {{- if or .Values.nativeSidecars (or .Values.database.postgresql.enabled .Values.database.external.enabled) }}
      initContainers:
      {{- range .Values.nativeSidecars }}
      - {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if or .Values.database.postgresql.enabled .Values.database.external.enabled }}
      {{- if .Values.database.postgresql.enabled }}
      - name: wait-for-db
        image: busybox:1.36
        command: ['sh', '-c', 'until nc -z {{ include "hyperfleet-api.fullname" . }}-postgresql {{ .Values.database.postgresql.port }}; do echo waiting for postgresql; sleep 2; done']
      {{- end }}
      - name: db-migrate
        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        command: ["/app/hyperfleet-api", "migrate"]
        env:
        # Config file from ConfigMap
        - name: HYPERFLEET_CONFIG
          value: /etc/hyperfleet/config.yaml
        # Database credentials from Secret (using secretKeyRef)
        {{- include "hyperfleet-api.databaseEnvVars" . | nindent 8 }}
        volumeMounts:
        - name: config
          mountPath: /etc/hyperfleet
          readOnly: true
      {{- end }}
      {{- end }}
      containers:
      - name: {{ .Chart.Name }}
        securityContext:
          {{- toYaml .Values.securityContext | nindent 10 }}
        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        workingDir: /app
        # Simple command - configuration via ConfigMap and environment variables
        args:
        - serve
        ports:
        - name: http
          containerPort: {{ .Values.ports.api | default 8000 }}
          protocol: TCP
        - name: health
          containerPort: {{ .Values.ports.health | default 8080 }}
          protocol: TCP
        - name: metrics
          containerPort: {{ .Values.ports.metrics | default 9090 }}
          protocol: TCP
        env:
        # Config file from ConfigMap (generated from values)
        - name: HYPERFLEET_CONFIG
          value: /etc/hyperfleet/config.yaml
        {{- with .Values.monitoring.tracing }}
        - name: HYPERFLEET_TRACING_ENABLED
          value: {{ .enabled | quote }}
        {{- if .enabled }}
        - name: OTEL_SERVICE_NAME
          value: {{ .serviceName | quote }}
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: {{ .otlpEndpoint | quote }}
        - name: OTEL_EXPORTER_OTLP_PROTOCOL
          value: {{ .otlpProtocol | quote }}
        - name: OTEL_TRACES_SAMPLER
          value: {{ .sampler | quote }}
        - name: OTEL_TRACES_SAMPLER_ARG
          value: {{ .samplerArg | quote }}
        - name: OTEL_PROPAGATORS
          value: {{ .propagators | quote }}
        - name: K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: OTEL_RESOURCE_ATTRIBUTES
          value: "k8s.namespace.name=$(K8S_NAMESPACE)"
        {{- end }}
        {{- end }}

        # Database credentials from Secret (using secretKeyRef)
        {{- include "hyperfleet-api.databaseEnvVars" . | nindent 8 }}

        # Extra environment variables (escape hatch for overrides)
        {{- with .Values.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}

        livenessProbe:
          httpGet:
            path: /healthz
            port: health
          initialDelaySeconds: 15
          periodSeconds: 20
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /readyz
            port: health
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        {{- with .Values.lifecycle }}
        lifecycle:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        volumeMounts:
        # ConfigMap mount - generated from values or existingConfigMap
        - name: config
          mountPath: /etc/hyperfleet
          readOnly: true

        {{- if .Values.validationSchema.enabled }}
        - name: validation-schema
          mountPath: /etc/hyperfleet/validation-schema
          readOnly: true
        {{- end }}

        # Temp directory for writable filesystem
        - name: tmp
          mountPath: /tmp

        {{- with .Values.extraVolumeMounts }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- range .Values.sidecars }}
      - {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
      # ConfigMap volume - use existing or generated from values
      - name: config
        configMap:
          {{- if .Values.config.existingConfigMap }}
          name: {{ .Values.config.existingConfigMap }}
          {{- else }}
          name: {{ include "hyperfleet-api.fullname" . }}-config
          {{- end }}

      - name: tmp
        emptyDir: {}

      {{- if .Values.validationSchema.enabled }}
      - name: validation-schema
        configMap:
          {{- if .Values.validationSchema.existingConfigMap }}
          name: {{ .Values.validationSchema.existingConfigMap }}
          {{- else }}
          name: {{ include "hyperfleet-api.fullname" . }}-validation-schema
          {{- end }}
      {{- end }}

      {{- with .Values.extraVolumes }}
      {{- toYaml . | nindent 6 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}