apiVersion: apps/v1
kind: Deployment
metadata:
  name: catalogue-agent
  namespace: agents
spec:
  # One replica, and that is a constraint rather than a default. Conversation
  # history — which the confirm-before-writing flow depends on — lives in the
  # process, keyed by A2A contextId. A second replica would route the user's
  # "yes" to a pod that never saw the question. Scaling out needs sticky routing
  # on contextId or a shared store first.
  replicas: 1
  selector:
    matchLabels:
      app: catalogue-agent
  template:
    metadata:
      labels:
        app: catalogue-agent
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: agent
          # gitea's own registry, not ghcr: the image sits beside the source it
          # was built from, and the package inherits the repo's visibility. The
          # repo is public, so the pull needs no credentials — which removes an
          # imagePullSecret that would otherwise have to be created by hand in
          # this namespace and kept in step with a GitHub token.
          image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.4.0
          ports:
            - name: http
              containerPort: 8080
          envFrom:
            - configMapRef:
                name: catalogue-agent-config
            - secretRef:
                name: catalogue-agent-secrets
          volumeMounts:
            - name: sttlab-ca
              mountPath: /etc/sttlab-ca
              readOnly: true
          # The Agent Card needs no auth and is served by the same app, so a 200
          # means the A2A routes are genuinely mounted — not merely that the
          # process is alive.
          readinessProbe:
            httpGet:
              path: /.well-known/agent-card.json
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /.well-known/agent-card.json
              port: http
            initialDelaySeconds: 15
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 192Mi
            limits:
              cpu: "1"
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: sttlab-ca
          configMap:
            name: sttlab-ca