apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent-codex
  labels:
    app: agent-codex
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: agent-codex
  template:
    metadata:
      labels:
        app: agent-codex
      annotations:
        eks.amazonaws.com/skip-containers: agent-codex
    spec:
      serviceAccountName: agent-codex-sidecar-sa
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: agent-codex
          image: agent-codex:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: websocket
              containerPort: 4500
          env:
            - name: CODEX_HOME
              value: /home/node/.codex
            - name: CODEX_APP_SERVER_TOKEN
              valueFrom:
                secretKeyRef:
                  name: agent-codex-secrets
                  key: CODEX_APP_SERVER_TOKEN
            - name: DS_PROXY_URL
              value: http://127.0.0.1:16383
            - name: LARKSUITE_CLI_AUTH_PROXY
              value: http://127.0.0.1:16384
            - name: LARKSUITE_CLI_PROXY_KEY
              valueFrom:
                secretKeyRef:
                  name: agent-codex-secrets
                  key: LARK_PROXY_KEY
            - name: LARKSUITE_CLI_APP_ID
              valueFrom:
                secretKeyRef:
                  name: agent-codex-secrets
                  key: LARK_APP_ID
            - name: LARKSUITE_CLI_BRAND
              value: feishu
            - name: LARKSUITE_CLI_DEFAULT_AS
              value: bot
            - name: LARKSUITE_CLI_STRICT_MODE
              value: bot
          readinessProbe:
            httpGet:
              path: /readyz
              port: websocket
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: websocket
            initialDelaySeconds: 10
            periodSeconds: 30
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 4Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: Unconfined
          volumeMounts:
            - name: codex-home
              mountPath: /home/node/.codex
            - name: projects
              mountPath: /data/projects
            - name: config
              mountPath: /home/node/.codex/config.toml
              subPath: config.toml
              readOnly: true
            - name: config
              mountPath: /home/node/.codex/model-catalog.local.json
              subPath: model-catalog.local.json
              readOnly: true
        - name: agent-sidecar
          image: agent-sidecar:latest
          imagePullPolicy: IfNotPresent
          env:
            - name: AWS_REGION
              value: us-west-2
          args:
            - "--config"
            - "/etc/agent-sidecar/config.yaml"
          ports:
            - name: sidecar-grpc
              containerPort: 9091
          livenessProbe:
            grpc:
              port: 9091
            initialDelaySeconds: 10
            periodSeconds: 10
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: projects
              mountPath: /data/projects
            - name: codex-home
              mountPath: /home/node/.codex
            - name: agent-sidecar-config
              mountPath: /etc/agent-sidecar/config.yaml
              subPath: config.yaml
              readOnly: true
      volumes:
        - name: codex-home
          persistentVolumeClaim:
            claimName: agent-codex-home
        - name: projects
          persistentVolumeClaim:
            claimName: agent-codex-projects
        - name: config
          configMap:
            name: agent-codex-config
        - name: agent-sidecar-config
          configMap:
            name: agent-sidecar-config