apiVersion: apps/v1
kind: Deployment
metadata:
  name: assistant-agent
  namespace: agents
spec:
  # One replica, and that is a constraint rather than a default. Conversation
  # history lives in the process, keyed by A2A contextId — and a specialist's
  # approval round trip passes back through here, so a second replica would
  # route the user's "approve" to a pod holding none of the exchange. Scaling
  # out needs sticky routing on contextId or a shared store first.
  replicas: 1
  selector:
    matchLabels:
      app: assistant-agent
  template:
    metadata:
      labels:
        app: assistant-agent
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: agent
          # gitea's own registry: the image sits beside the source it was built
          # from and inherits the repo's public visibility, so the pull needs no
          # credentials at all.
          image: gitea.sttlab.eu/stt/classic-models-agent-assistant:v0.2.1
          ports:
            - name: http
              containerPort: 8080
          envFrom:
            - configMapRef:
                name: assistant-agent-config
            - secretRef:
                name: assistant-agent-secrets
          volumeMounts:
            - name: sttlab-ca
              mountPath: /etc/sttlab-ca
              readOnly: true
          # The Agent Card needs no auth and is served by the same app, so a 200
          # means the A2A routes are genuinely mounted — not merely that the
          # process is alive.
          readinessProbe:
            httpGet:
              path: /.well-known/agent-card.json
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /.well-known/agent-card.json
              port: http
            initialDelaySeconds: 15
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 192Mi
            limits:
              cpu: "1"
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: sttlab-ca
          configMap:
            name: sttlab-ca