apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent-manager
  namespace: agent-manager
  labels:
    app: agent-manager
spec:
  replicas: 2
  selector:
    matchLabels:
      app: agent-manager
  template:
    metadata:
      labels:
        app: agent-manager
    spec:
      # 使用专用的 ServiceAccount
      serviceAccountName: agent-manager
      
      # ARM 架构节点选择器
      nodeSelector:
        kubernetes.io/arch: arm64
      
      # 容忍度（如果需要）
      tolerations:
      - key: "kubernetes.io/arch"
        operator: "Equal"
        value: "arm64"
        effect: "NoSchedule"
      
      containers:
      - name: agent-manager
        image: agnettaiji.azurecr.io/ai-agents/agent-manager:latest
        imagePullPolicy: Always
        
        ports:
        - containerPort: 8000
          name: http
          protocol: TCP
        
        # 环境变量 - 从 ConfigMap
        envFrom:
        - configMapRef:
            name: agent-manager-config
        
        # 环境变量 - 从 Secret
        env:
        - name: AZURE_TENANT_ID
          valueFrom:
            secretKeyRef:
              name: agent-manager-secret
              key: AZURE_TENANT_ID
        - name: AZURE_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: agent-manager-secret
              key: AZURE_CLIENT_ID
        - name: AZURE_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: agent-manager-secret
              key: AZURE_CLIENT_SECRET
        
        # 挂载 kubeconfig（用于管理其他 Agent）
        volumeMounts:
        - name: kubeconfig
          mountPath: /root/.kube
          readOnly: true
        
        # 资源限制
        resources:
          requests:
            memory: "256Mi"
            cpu: "200m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        
        # 健康检查
        livenessProbe:
          httpGet:
            path: /
            port: 8000
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 3
        
        readinessProbe:
          httpGet:
            path: /
            port: 8000
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
      
      volumes:
      - name: kubeconfig
        secret:
          secretName: kubeconfig-secret
          optional: true
      
      # 使用 ACR 拉取镜像的凭据
      imagePullSecrets:
      - name: acr-secret