apiVersion: apps/v1
kind: Deployment
metadata:
  name: sandbox
  labels:
    app.kubernetes.io/name: sandbox
spec:
  replicas: 1
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: sandbox
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sandbox
    spec:
      serviceAccountName: easyai-workload
      terminationGracePeriodSeconds: 30
      containers:
        - name: sandbox
          image: registry.cn-shanghai.aliyuncs.com/easyaigc/sandbox:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8000
            - name: jupyter
              containerPort: 8888
          envFrom:
            - configMapRef:
                name: easyai-app-config
            - secretRef:
                name: easyai-app-secret
          env:
            - name: NODE_PATH
              value: /app/node_modules:/app/node_modules_extra/node_modules
            - name: NODE_MODULES_EXTRA
              value: /app/node_modules_extra
            - name: NODE_MODULES_EXTRA_PATH
              value: /app/node_modules_extra/node_modules
            - name: SANDBOX_TMPDIR
              value: /app/tmp
            - name: PIP_CACHE_DIR
              value: /app/tmp/.pip
            - name: TMPDIR
              value: /app/tmp
            - name: NPM_CONFIG_CACHE
              value: /app/tmp/.npm
            - name: PYTHON_EXTRA_DIR
              value: /root/.local/lib/python3.12/site-packages
            - name: PYTHON_EXTRA_PATH
              value: /root/.local/lib/python3.12/site-packages
            - name: JUPYTER_DATA_DIR
              value: /app/tmp/jupyter_data
            - name: JUPYTER_RUNTIME_DIR
              value: /app/tmp/jupyter_runtime
            - name: JUPYTER_CONFIG_DIR
              value: /app/tmp/jupyter_config
            - name: JUPYTER_TOKEN
              valueFrom:
                secretKeyRef:
                  name: easyai-app-secret
                  key: SANDBOX_JUPYTER_TOKEN
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: local-packages
              mountPath: /app/local_packages
            - name: python-packages
              mountPath: /root/.local
            - name: node-modules-extra
              mountPath: /app/node_modules_extra
            - name: app-tmp
              mountPath: /app/tmp
            - name: tmp
              mountPath: /tmp
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 45
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
      volumes:
        - name: data
          emptyDir: {}
        - name: local-packages
          emptyDir: {}
        - name: python-packages
          emptyDir: {}
        - name: node-modules-extra
          emptyDir: {}
        - name: app-tmp
          emptyDir: {}
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: sandbox
  labels:
    app.kubernetes.io/name: sandbox
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: sandbox
  ports:
    - name: http
      port: 8000
      targetPort: http
    - name: jupyter
      port: 8888
      targetPort: jupyter