# Webbklienten: statisk SPA bakom oprivilegierad nginx.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: guidad-felsokning
  labels: { app: web }
spec:
  replicas: 2
  selector:
    matchLabels: { app: web }
  template:
    metadata:
      labels: { app: web }
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
        - name: web
          image: ghcr.io/ORGANISATION/guidad-felsokning-web:latest # ersätt med ert registry
          ports:
            - containerPort: 8080
          resources:
            requests: { cpu: 50m, memory: 64Mi }
            limits: { cpu: 250m, memory: 128Mi }
          readinessProbe:
            httpGet: { path: /, port: 8080 }
            initialDelaySeconds: 3
          livenessProbe:
            httpGet: { path: /, port: 8080 }
            periodSeconds: 15
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: { drop: [ALL] }
---
apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: guidad-felsokning
spec:
  selector: { app: web }
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
  namespace: guidad-felsokning
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: web }
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web
  namespace: guidad-felsokning
spec:
  minAvailable: 1
  selector:
    matchLabels: { app: web }