# SAMMS ENTERPRISE SOVEREIGN OPERATING SYSTEM - Backend Kubernetes Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sesos-backend
  labels:
    app: sesos
    component: backend
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: sesos
      component: backend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: sesos
        component: backend
        version: v1
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: sesos-backend
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: backend
          image: sesos-backend:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          env:
            - name: ENVIRONMENT
              value: "production"
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: database-url
            - name: REDIS_URL
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: redis-url
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: secret-key
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: jwt-secret
            - name: ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: encryption-key
            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: openai-api-key
                  optional: true
            - name: SMTP_HOST
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: smtp-host
            - name: SMTP_PORT
              value: "587"
            - name: SMTP_USER
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: smtp-user
            - name: SMTP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sesos-secrets
                  key: smtp-password
          resources:
            requests:
              cpu: "250m"
              memory: "512Mi"
            limits:
              cpu: "1000m"
              memory: "2Gi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /ready
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: logs
              mountPath: /app/logs
      volumes:
        - name: tmp
          emptyDir: {}
        - name: logs
          emptyDir: {}
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: sesos
                    component: backend
                topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: sesos
              component: backend
---
apiVersion: v1
kind: Service
metadata:
  name: sesos-backend
  labels:
    app: sesos
    component: backend
spec:
  type: ClusterIP
  ports:
    - port: 8000
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: sesos
    component: backend
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sesos-backend
  labels:
    app: sesos
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: sesos-backend-hpa
  labels:
    app: sesos
    component: backend
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: sesos-backend
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 10
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
        - type: Percent
          value: 100
          periodSeconds: 15
        - type: Pods
          value: 4
          periodSeconds: 15
      selectPolicy: Max
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: sesos-backend-pdb
  labels:
    app: sesos
    component: backend
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: sesos
      component: backend