apiVersion: apps/v1
kind: Deployment
metadata:
  name: iam-service
  namespace: iam-local
  labels:
    app: iam-service
    version: local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iam-service
  template:
    metadata:
      labels:
        app: iam-service
        version: local
    spec:
      containers:
      - name: iam-service
        image: iam-service:local
        imagePullPolicy: IfNotPresent  # Use local image, don't pull from registry
        ports:
        - containerPort: 5001
          name: http
          protocol: TCP
        
        # Environment variables from ConfigMap
        envFrom:
        - configMapRef:
            name: iam-service-config
        
        # Sensitive environment variables from Secret
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: iam-service-secrets
              key: database-url
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: iam-service-secrets
              key: jwt-secret
        - name: JWT_REFRESH_SECRET
          valueFrom:
            secretKeyRef:
              name: iam-service-secrets
              key: jwt-refresh-secret
        - name: JWT_ID_SECRET
          valueFrom:
            secretKeyRef:
              name: iam-service-secrets
              key: jwt-id-secret
        - name: ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              name: iam-service-secrets
              key: encryption-key
        
        # Resource limits (adjust based on Docker Desktop allocation)
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        
        # Liveness probe - is the container running?
        livenessProbe:
          httpGet:
            path: /health/live
            port: 5001
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        
        # Readiness probe - is the container ready to serve traffic?
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 5001
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 5
          failureThreshold: 3
        
        # Startup probe - give container time to start
        startupProbe:
          httpGet:
            path: /health/live
            port: 5001
          initialDelaySeconds: 0
          periodSeconds: 5
          timeoutSeconds: 5
          failureThreshold: 12  # 60 seconds total (12 * 5s)
      
      # Restart policy
      restartPolicy: Always
