apiVersion: apps/v1
kind: Deployment
metadata: { name: api, namespace: uqo-chat }
spec:
  replicas: 2
  selector: { matchLabels: { app: api } }
  template:
    metadata: { labels: { app: api } }
    spec:
      securityContext: { runAsNonRoot: true, seccompProfile: { type: RuntimeDefault } }
      containers:
        - name: api
          image: ghcr.io/ORG/uqo-chat-api:latest
          ports: [{ containerPort: 8190 }]
          envFrom: [{ secretRef: { name: uqo-chat-secrets } }, { configMapRef: { name: uqo-chat-config } }]
          env:
            - { name: SANDBOX_URL, value: http://sandbox-runner:8080 }
            - { name: DATABASE_URL, valueFrom: { secretKeyRef: { name: uqo-chat-secrets, key: DATABASE_URL } } }
          resources: { requests: { cpu: 250m, memory: 512Mi }, limits: { cpu: "1", memory: 1Gi } }
          readinessProbe: { httpGet: { path: /api/v1/ready, port: 8190 }, initialDelaySeconds: 5 }
          livenessProbe: { httpGet: { path: /api/v1/health, port: 8190 }, periodSeconds: 20 }
          volumeMounts: [{ name: data, mountPath: /data }]
      volumes: [{ name: data, persistentVolumeClaim: { claimName: uqo-chat-data } }]
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: uqo-chat-data, namespace: uqo-chat }
spec: { accessModes: [ReadWriteMany], resources: { requests: { storage: 20Gi } } }