# ── 引擎(副本跨机打散;私有仓拉取凭据=cluster-up 6b 的 sema-regcred,经 default SA 注入;
#    values.imagePullSecrets 为显式纵深)──────────────────────────────────────────
apiVersion: v1
kind: Secret
metadata:
  name: sema-server-env
  namespace: {{ .Release.Namespace }}
stringData:
  SERVICE_AUTH_TOKEN: {{ required "server.serviceAuthToken is required" .Values.server.serviceAuthToken | quote }}
  MODEL_API_KEY: {{ required "server.modelApiKey is required" .Values.server.modelApiKey | quote }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sema-server
  namespace: {{ .Release.Namespace }}
spec:
  replicas: {{ .Values.server.replicas }}
  selector:
    matchLabels: { app: sema-server }
  template:
    metadata:
      labels: { app: sema-server }
    spec:
{{- with .Values.imagePullSecrets }}
      imagePullSecrets:
{{- range . }}
        - name: {{ . }}
{{- end }}
{{- end }}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels: { app: sema-server }
      containers:
        - name: server
          image: {{ required "server.image is required" .Values.server.image | quote }}
          imagePullPolicy: {{ .Values.server.pullPolicy }}
          ports: [{ containerPort: 8090 }]
          env:
            - { name: PORT, value: "8090" }
            - { name: DB_BACKEND, value: pg }
            - { name: SESSION_BACKEND, value: auto }
            - { name: PG_HOST, value: sema-pg-rw.{{ .Release.Namespace }}.svc }
            - { name: PG_PORT, value: "5432" }
            - { name: PG_USER, value: sema }
            - { name: PG_DATABASE, value: sema }
            - { name: PG_PASSWORD, valueFrom: { secretKeyRef: { name: sema-pg-app, key: password } } }
            - { name: MINIO_ENDPOINT, value: "http://sema-minio.{{ .Release.Namespace }}.svc:9000" }
            - { name: MINIO_ACCESS_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
            - { name: MINIO_SECRET_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } } }
{{- /* SendUserFile 公网直链(可选):不设 s3PublicEndpoint = 工具签发时 fail-loud 提示补配。
       公桶匿名策略必须 GetObject-only(mc anonymous set-json;set download 会连带开 ListBucket)。 */}}
{{- if .Values.server.s3PublicEndpoint }}
            - { name: S3_PUBLIC_ENDPOINT, value: {{ .Values.server.s3PublicEndpoint | quote }} }
{{- end }}
{{- if .Values.server.s3PublicBucket }}
            - { name: S3_PUBLIC_BUCKET, value: {{ .Values.server.s3PublicBucket | quote }} }
{{- end }}
{{- if .Values.server.sendUserFileSandboxPutEndpoint }}
            - { name: SEND_USER_FILE_SANDBOX_PUT_ENDPOINT, value: {{ .Values.server.sendUserFileSandboxPutEndpoint | quote }} }
{{- end }}
            - { name: SERVICE_AUTH_TOKEN, valueFrom: { secretKeyRef: { name: sema-server-env, key: SERVICE_AUTH_TOKEN } } }
            - { name: MODEL_GATEWAY_BASEURL, value: {{ required "server.modelGatewayBaseurl is required" .Values.server.modelGatewayBaseurl | quote }} }
            - { name: MODEL_ID, value: {{ required "server.modelId is required" .Values.server.modelId | quote }} }
            - { name: MODEL_API_KEY, valueFrom: { secretKeyRef: { name: sema-server-env, key: MODEL_API_KEY } } }
            - { name: MODEL_VISION, value: {{ .Values.server.modelVision | quote }} }
            - { name: REQUIRE_PRINCIPAL, value: {{ .Values.server.requirePrincipal | default "false" | quote }} }
            - { name: SANDBOX_PKG_SOURCE, value: {{ .Values.server.sandboxPkgSource | quote }} }
            - { name: REMOTE_EXEC, value: k8s }
            - { name: K8S_API_URL, value: "https://kubernetes.default.svc" }
{{- if .Values.server.k8sInsecureTls }}
            - { name: K8S_INSECURE_TLS, value: "true" }
{{- end }}
            - { name: K8S_NAMESPACE, value: {{ .Values.sandbox.namespace }} }
{{- if .Values.sandbox.runtimeClass }}
            - { name: K8S_RUNTIME_CLASS, value: {{ .Values.sandbox.runtimeClass }} }
{{- end }}
            - { name: K8S_SANDBOX_IMAGE, value: {{ .Values.sandbox.image | quote }} }
            - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
          readinessProbe:
            httpGet: { path: /health, port: 8090 }
            initialDelaySeconds: 5
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: sema-server
  namespace: {{ .Release.Namespace }}
spec:
  type: NodePort
  selector: { app: sema-server }
  ports:
    - port: 8090
      targetPort: 8090
      nodePort: {{ .Values.server.nodePort }}