apiVersion: apps/v1
kind: Deployment
metadata:
  name: cals
  namespace: epcare
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cals
  template:
    metadata:
      labels:
        app: cals
    spec:
      nodeSelector:
        kubernetes.io/hostname: NODE_HOSTNAME   # Patched per overlay (e.g. ep01)
      imagePullSecrets:
        - name: gitlab-registry
      containers:
        - name: cals
          image: registry.gitlab.com/signalytic/client-external/client-apps-log-sync/cals/arm64:1.3
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 601
              protocol: TCP
          envFrom:
            - secretRef:
                name: cals-env
            - secretRef:
                name: global-env
          volumeMounts:
            - name: cals-logs
              mountPath: /var/log/syslog-ng
            - name: ssh-key
              mountPath: /root/.ssh/id_ed25519
              subPath: id_ed25519
              readOnly: true
          readinessProbe:
            tcpSocket:
              port: 601
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            tcpSocket:
              port: 601
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
      volumes:
        - name: cals-logs
          persistentVolumeClaim:
            claimName: cals-logs-pvc
        - name: ssh-key
          secret:
            secretName: cals-ssh-key
            defaultMode: 0400