# AI-orkestern: plattformens AI-endpoint. Claude API-nyckeln och
# JWT-hemligheten kommer från secret:en felsokning-hemligheter —
# de finns aldrig i bilder, manifest eller klient.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ai-orkester
  namespace: guidad-felsokning
  labels: { app: ai-orkester }
spec:
  replicas: 2
  selector:
    matchLabels: { app: ai-orkester }
  template:
    metadata:
      labels: { app: ai-orkester }
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
        - name: ai-orkester
          image: ghcr.io/ORGANISATION/guidad-felsokning-ai-orkester:latest # ersätt med ert registry
          ports:
            - containerPort: 8080
          env:
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef: { name: felsokning-hemligheter, key: anthropic-api-key }
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef: { name: felsokning-hemligheter, key: jwt-secret }
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits: { cpu: "1", memory: 256Mi }
          readinessProbe:
            httpGet: { path: /halsa, port: 8080 }
            initialDelaySeconds: 3
          livenessProbe:
            httpGet: { path: /halsa, port: 8080 }
            periodSeconds: 15
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: [ALL] }
---
apiVersion: v1
kind: Service
metadata:
  name: ai-orkester
  namespace: guidad-felsokning
spec:
  selector: { app: ai-orkester }
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: ai-orkester
  namespace: guidad-felsokning
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: ai-orkester }
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: ai-orkester
  namespace: guidad-felsokning
spec:
  minAvailable: 1
  selector:
    matchLabels: { app: ai-orkester }